diff --git a/.coderabbit.yaml b/.coderabbit.yaml deleted file mode 100644 index 46a4f0b9..00000000 --- a/.coderabbit.yaml +++ /dev/null @@ -1,5 +0,0 @@ -reviews: - auto_review: - enabled: true - auto_incremental_review: true - drafts: false diff --git a/.gemini/config.yaml b/.gemini/config.yaml deleted file mode 100644 index 3b5e413e..00000000 --- a/.gemini/config.yaml +++ /dev/null @@ -1,23 +0,0 @@ -have_fun: false - -ignore_patterns: - - "**/charts/**" - - "**/vendor/**" - - "**/zz_generated.*.go" - - "**/pkg/generated/**" - - "**/_out/**" - - "**/*.tgz" - - "**/dashboards/**/*.json" - - "**/*.patch" - - "**/*.diff" - - "**/images/*.json" - -code_review: - disable: false - comment_severity_threshold: LOW - max_review_comments: 50 - pull_request_opened: - help: false - summary: true - code_review: true - include_drafts: false diff --git a/.gemini/styleguide.md b/.gemini/styleguide.md deleted file mode 100644 index 7185a625..00000000 --- a/.gemini/styleguide.md +++ /dev/null @@ -1,110 +0,0 @@ -# Cozystack Review Guidelines - -## Project Architecture - -Cozystack is a Kubernetes-based PaaS built on Helm umbrella charts and FluxCD. -Packages live in `packages/{core,system,apps,extra,library,tests}/`. The `library/` group holds reusable helper charts; the `tests/` group exists because library charts are not directly testable. -Each package wraps one or more upstream Helm charts. -Go code in `cmd/`, `internal/`, `pkg/` implements Kubernetes controllers and API server. -Static CRDs are generated by `hack/update-codegen.sh` from types under `api/v1alpha1/`, `api/backups/`, and `api/dashboard/`. -App Kinds (like `Postgres`, `Kafka`) live in `api/apps/v1alpha1/` but are registered dynamically at runtime from `ApplicationDefinition` resources — they are not static CRDs. - -## Vendored Code — Critical Rules - -**Never suggest editing files inside any `charts/` directory under `packages/`.** -Those are upstream Helm charts vendored via `make update` (which runs `helm pull`). -Any direct edit is overwritten on the next update and provides zero value. - -If you find an issue that appears to live in vendored chart code: - -- For configuration-level changes: suggest overrides in the package root `values.yaml`. -- For structural changes: suggest a patch file in `packages//patches/` applied by the Makefile. -- For source-code changes in images: suggest a patch in `packages//images//patches/`. -- For true upstream bugs: point to the upstream repository and suggest an upstream issue/PR. -- Do NOT suggest creating `charts/patches/` — patches never live inside `charts/`. - -Similarly, never propose edits to: - -- `vendor/` — Go dependencies. Changes go through `go get` and `go mod tidy`. -- `zz_generated.*.go` — regenerated by `make generate`. -- `pkg/generated/` — auto-generated Kubernetes client code. -- Image digest values in `values.yaml` — set by CI via `make image`, not by humans. -- `go.mod` / `go.sum` by hand — use `go get` and `go mod tidy`. - -## Commit and PR Requirements - -Each commit must follow [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): brief description`. - -Valid types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`. - -Valid scopes: - -- System: `dashboard`, `platform`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api` -- Apps: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `kubernetes`, `virtual-machine` -- Meta: `api`, `hack`, `tests`, `ci`, `docs` -- Package-specific: any `` matching a directory under `packages/` - -Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer. - -Each commit must have a `Signed-off-by:` trailer (produced by `git commit --signoff`). - -PR body must contain a release note block: - -````text -```release-note -type(scope): human-readable changelog entry -``` -```` - -Flag any PR whose commits lack the Conventional Commits format or signoff, or whose body has no release-note block. - -## Helm Chart Conventions - -Packages follow an umbrella chart pattern: - -- `charts/` — vendored upstream, read-only -- `templates/` — Cozystack-specific extra manifests -- `values.yaml` — override values for the upstream chart -- `values.schema.json` — JSON Schema for dashboard UI and input validation - -When reviewing `values.schema.json`: - -- `make generate` regenerates this file and strips `title`, `description`, and `x-*` custom annotations. Do not suggest adding fields that will be stripped on the next regeneration. -- Focus on type correctness, `required` fields, `enum` values, and default values. -- Flag breaking changes: removing a field, changing its type, or narrowing its enum. - -## Sensitive Components - -**`packages/core/platform/`**: the platform chart that deploys everything. Changes here can require updates to the migration flow — the Helm hook in `packages/core/platform/templates/migration-hook.yaml` and the runner image with scripts in `packages/core/platform/images/migrations/`. Flag any change to this package that lacks a corresponding migration update or an explicit note that backward compatibility is preserved. - -**`api/apps/v1alpha1/`**: app CRD Kinds are registered at runtime from `ApplicationDefinition` resources and the matching `values.schema.json`. Suggest changes to the relevant package schema rather than hand-editing generated types. - -**RBAC, ServiceAccounts, and SecurityContext**: flag overly broad RBAC (`*` on resources or verbs without justification), missing `securityContext`, containers running as root without an explicit reason, and `hostPath`/`hostNetwork` usage without clear rationale. - -## Go Code Standards - -- Use controller-runtime patterns for reconcilers. -- Use structured logging via `logr` — flag `fmt.Print*` and `log.Print*` in controller code. -- Handle errors explicitly. Discarding meaningful errors with `_` is a bug. -- Propagate `context.Context` through call chains. Flag `context.Background()` created inside a reconciler or request handler. -- Prefer `ctrl.Result{RequeueAfter: ...}` over empty requeue for predictable reconciliation loops. -- Tests live beside the code (`*_test.go`). New behavior without tests is worth flagging. - -## What to Review Carefully - -- Logic errors, off-by-one bugs, nil dereferences. -- Missing error handling, especially in reconcilers and API handlers. -- Helm template correctness: missing `quote`, incorrect indentation, wrong scope in `with`/`range`. -- Security: permissive RBAC, privileged containers, secrets in environment variables, hardcoded credentials. -- Missing resource requests/limits on new workloads. -- Breaking changes in `values.schema.json`: removed fields, tightened types, narrower enums. - -## Anti-patterns — Do Not Flag These - -- Large JSON files in `dashboards/` — imported from upstream Grafana sources, not hand-written. -- Files under any `charts/` directory — vendored upstream, left as-is intentionally. -- Whitespace or formatting in `*.patch` / `*.diff` files — machine-applied, not authored. -- Missing comments on generated code. -- `go.sum` changes accompanying `go.mod` changes — expected and correct. -- Fork relationships for vendored tooling images — intentional (e.g., `cozystack/kilo` fork is expected). -- Absence of unit tests for vendored chart overrides — covered by E2E tests in `hack/e2e-apps/`. diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 2482712d..2045ec5a 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1 +1 @@ -* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters @sircthulhu @myasnikovdaniil +* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters @sircthulhu diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index fefdab82..1a119259 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,7 +1,7 @@ --- name: Bug report about: Create a report to help us improve -labels: 'kind/bug' +labels: 'bug' assignees: '' --- diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 044dd6a0..9a52457c 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,11 +1,8 @@ - ### Release note ```release-note - +[] ``` \ No newline at end of file diff --git a/.github/labels.yml b/.github/labels.yml deleted file mode 100644 index 2ce04130..00000000 --- a/.github/labels.yml +++ /dev/null @@ -1,371 +0,0 @@ -# Cozystack repository labels -# -# Label conventions follow the Kubernetes scheme: -# https://github.com/kubernetes/test-infra/blob/master/label_sync/labels.md -# -# Synced into the repository by .github/workflows/labels.yaml -# (EndBug/label-sync@v2). Edit this file via pull request — UI changes -# will be overwritten on the next sync. -# -# Constraints (enforced by the validate job in labels.yaml): -# - description ≤ 100 characters (GitHub REST API limit) -# - color is a 6-character hex string (no leading #) -# - label names are unique -# - aliases do not collide with top-level names -# -# Categories: -# kind/ issue or PR type -# priority/ urgency -# triage/ review state -# lifecycle/ issue or PR lifecycle -# area/ subsystem; extensible — add when 3+ open issues exist -# do-not-merge/ PR merge blockers -# security/ security-finding severity and status (Cozystack-specific) -# size: PR size (auto-applied) -# -# `aliases:` lets EndBug/label-sync rename existing labels without losing -# references on already-tagged issues and PRs. -# -# GitHub-default labels not migrated here (`wontfix`, `invalid`) currently -# carry zero issues/PRs in this repo and will be removed in a follow-up -# cleanup PR rather than aliased to a different namespace. - -# ────────────────────────────────────────────── -# kind/ — issue or PR type -# ────────────────────────────────────────────── - -- name: kind/bug - color: 'd73a4a' - description: Categorizes issue or PR as related to a bug - aliases: ['bug'] - -- name: kind/feature - color: 'a2eeef' - description: Categorizes issue or PR as related to a new feature - aliases: ['enhancement'] - -- name: kind/documentation - color: '0075ca' - description: Categorizes issue or PR as related to documentation - aliases: ['documentation'] - -- name: kind/support - color: 'd876e3' - description: Categorizes issue as a support question - aliases: ['question'] - -- name: kind/cleanup - color: 'c7def8' - description: Categorizes issue or PR as related to cleanup of code, process, or technical debt - -- name: kind/regression - color: 'e11d21' - description: Categorizes issue or PR as related to a regression from a prior release - -- name: kind/flake - color: 'f7c6c7' - description: Categorizes issue or PR as related to a flaky test - -- name: kind/failing-test - color: 'e11d21' - description: Categorizes issue or PR as related to a consistently or frequently failing test - -- name: kind/api-change - color: 'c7def8' - description: Categorizes issue or PR as related to adding, removing, or otherwise changing an API - -- name: kind/breaking-change - color: 'e11d21' - description: Indicates the change introduces a breaking API or behaviour change - -# ────────────────────────────────────────────── -# priority/ — urgency -# ────────────────────────────────────────────── - -- name: priority/critical-urgent - color: 'e11d21' - description: Highest priority. Must be actively worked on as someone's top priority right now - -- name: priority/important-soon - color: 'eb6420' - description: Must be staffed and worked on either currently, or very soon, ideally in time for the next release - -- name: priority/important-longterm - color: 'fbca04' - description: Important over the long term, but may not be staffed and/or may need multiple releases to complete - -- name: priority/backlog - color: 'fef2c0' - description: General backlog priority. Lower than priority/important-longterm - -# ────────────────────────────────────────────── -# triage/ — review state -# ────────────────────────────────────────────── - -- name: triage/needs-triage - color: 'ededed' - description: Indicates an issue needs triage by a maintainer - -- name: triage/accepted - color: '0e8a16' - description: Indicates an issue is ready to be actively worked on - -- name: triage/needs-information - color: 'fbca04' - description: Indicates an issue needs more information in order to work on it - -- name: triage/not-reproducible - color: 'fbca04' - description: Indicates an issue can not be reproduced as described - -- name: triage/duplicate - color: 'cfd3d7' - description: Indicates an issue is a duplicate of another issue - aliases: ['duplicate'] - -- name: triage/unresolved - color: 'cfd3d7' - description: Indicates an issue that can not or will not be resolved - -# ────────────────────────────────────────────── -# lifecycle/ — issue or PR lifecycle -# ────────────────────────────────────────────── - -- name: lifecycle/active - color: '1d76db' - description: Indicates that an issue or PR is actively being worked on by a contributor - -- name: lifecycle/frozen - color: 'db5dd6' - description: Indicates that an issue or PR should not be auto-closed due to staleness - aliases: ['frozen'] - -- name: lifecycle/stale - color: 'dadada' - description: Denotes an issue or PR has remained open with no activity and has become stale - aliases: ['stale'] - -- name: lifecycle/rotten - color: '795548' - description: Denotes an issue or PR that has aged beyond stale and will be auto-closed - -# ────────────────────────────────────────────── -# area/ — subsystem (extensible) -# Add a new area/* when there are 3+ open issues on the topic. -# ────────────────────────────────────────────── - -- name: area/api - color: 'bfd4f2' - description: Issues or PRs related to the cozystack-api aggregated API server - -- name: area/ai - color: 'bfd4f2' - description: Issues or PRs related to AI agent guides, AGENTS.md, docs/agents/ - -- name: area/build - color: 'bfd4f2' - description: Issues or PRs related to image build infrastructure, multi-arch support - -- name: area/ci - color: 'bfd4f2' - description: Issues or PRs related to CI workflows, GitHub Actions, automation - -- name: area/dashboard - color: 'bfd4f2' - description: Issues or PRs related to the dashboard / UI - -- name: area/extra - color: 'bfd4f2' - description: Issues or PRs related to tenant-specific modules (packages/extra/) - -- name: area/database - color: 'bfd4f2' - description: Issues or PRs related to managed databases (postgres, mariadb, redis, etcd, kafka, clickhouse) - -- name: area/kubernetes - color: 'bfd4f2' - description: Issues or PRs related to the tenant Kubernetes app - -- name: area/monitoring - color: 'bfd4f2' - description: Issues or PRs related to the monitoring stack (vlogs, vmstack, grafana, workloadmonitor) - -- name: area/networking - color: 'bfd4f2' - description: Issues or PRs related to networking (ingress, gateway, vpn, metallb, cilium, kube-ovn) - -- name: area/platform - color: 'bfd4f2' - description: Issues or PRs related to platform infrastructure (bundle, flux, talos, installer) - -- name: area/release - color: 'bfd4f2' - description: Issues or PRs related to release tooling (changelog, backport, release pipeline) - -- name: area/storage - color: 'bfd4f2' - description: Issues or PRs related to storage (linstor, seaweedfs, bucket, velero, harbor) - -- name: area/testing - color: 'bfd4f2' - description: Issues or PRs related to testing (e2e, bats, unit tests) - -- name: area/virtualization - color: 'bfd4f2' - description: Issues or PRs related to virtualization (kubevirt, cdi, vmi, vm-import) - -- name: area/uncategorized - color: 'fbca04' - description: PR auto-labeler could not map title scope to a known area/*; please review - -# ────────────────────────────────────────────── -# do-not-merge/ — PR merge blockers (Prow convention) -# ────────────────────────────────────────────── - -- name: do-not-merge/work-in-progress - color: 'e11d21' - description: Indicates that a PR should not merge because it is a work in progress - # Both legacy spellings collapse here. EndBug processes aliases sequentially; - # the second rename hits a name collision and logs a warning — the legacy - # label survives and gets cleaned up in the follow-up dedup PR. - aliases: ['do-not-merge', 'do not merge'] - -- name: do-not-merge/hold - color: 'e11d21' - description: Indicates that a PR should not merge because someone has issued /hold - -# ────────────────────────────────────────────── -# Cozystack-specific (preserved) -# ────────────────────────────────────────────── - -- name: epic - color: 'a335ee' - description: A large development increment that brings definite value to Cozystack users - -- name: community - color: '97458a' - description: Community contributions are welcome in this issue - -- name: help wanted - color: '008672' - description: Extra attention is needed - -- name: good first issue - color: '7057ff' - description: Good for newcomers - -- name: quality-of-life - color: 'aaaaaa' - description: QoL improvements - -- name: upstream-issue - color: 'aaaaaa' - description: Requires resolving an issue in an upstream project - -- name: backport - color: 'fbca04' - description: Should change be backported on previous release - -- name: backport-previous - color: 'fbd876' - description: Backport target — previous release line - -- name: release - color: 'aaaaaa' - description: Releasing a new Cozystack version - -- name: automated - color: 'ededed' - description: Created by automation - -- name: debug - color: '704479' - description: Debugging in progress - -- name: sponsored - color: '00ff00' - description: Sponsored work - -- name: lgtm - color: '238636' - description: This PR has been approved by a maintainer - -- name: ok-to-test - color: '00ff00' - description: Indicates a non-member PR is safe to run CI on - -# ────────────────────────────────────────────── -# size: — PR size (auto-applied by sizing bot) -# ────────────────────────────────────────────── - -- name: 'size:XS' - color: '00ff00' - description: This PR changes 0-9 lines, ignoring generated files - -- name: 'size:S' - color: '77b800' - description: This PR changes 10-29 lines, ignoring generated files - -- name: 'size:M' - color: 'ebb800' - description: This PR changes 30-99 lines, ignoring generated files - -- name: 'size:L' - color: 'eb9500' - description: This PR changes 100-499 lines, ignoring generated files - -- name: 'size:XL' - color: 'ff823f' - description: This PR changes 500-999 lines, ignoring generated files - -- name: 'size:XXL' - color: 'ffb8b8' - description: This PR changes 1000+ lines, ignoring generated files - -# ────────────────────────────────────────────── -# security/ — security-finding severity and status -# ────────────────────────────────────────────── - -- name: security - color: 'aaaaaa' - description: Security-related issues and features - -- name: security/critical - color: 'd73a4a' - description: Critical security vulnerability - -- name: security/high - color: 'e99695' - description: High severity security finding - -- name: security/medium - color: 'f9c513' - description: Medium severity security finding - -- name: security/low - color: '0e8a16' - description: Low severity security finding - -- name: security/triage-needed - color: 'fbca04' - description: Needs security triage - -- name: security/confirmed - color: '1d76db' - description: Confirmed vulnerability - -- name: security/false-positive - color: 'c5def5' - description: Triaged as false positive - -- name: security/accepted-risk - color: 'bfd4f2' - description: Risk accepted with justification - -- name: security/in-progress - color: '0075ca' - description: Fix in progress - -- name: security/fixed - color: '0e8a16' - description: Fix released diff --git a/.github/workflows/codegen-drift.yml b/.github/workflows/codegen-drift.yml deleted file mode 100644 index a26caf5e..00000000 --- a/.github/workflows/codegen-drift.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Codegen Drift Check - -on: - pull_request: - types: [opened, synchronize, reopened] - paths: - - 'api/**' - - 'pkg/apis/**' - - 'pkg/generated/**' - - 'internal/crdinstall/manifests/**' - - 'packages/system/cozystack-controller/definitions/**' - - 'packages/system/application-definition-crd/definition/**' - - 'packages/system/backup-controller/definitions/**' - - 'packages/system/backupstrategy-controller/definitions/**' - - 'hack/update-codegen.sh' - - 'hack/boilerplate.go.txt' - - 'Makefile' - - 'go.mod' - - 'go.sum' - - '.github/workflows/codegen-drift.yml' - -concurrency: - group: codegen-drift-${{ github.workflow }}-${{ github.event.pull_request.number }} - cancel-in-progress: true - -jobs: - codegen-drift: - name: Verify generated code is up to date - runs-on: ubuntu-22.04 - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Set up Go - uses: actions/setup-go@v5 - with: - go-version-file: go.mod - cache: true - - - name: Pre-fetch k8s.io/code-generator module - # hack/update-codegen.sh sources kube_codegen.sh from the Go module cache. - # The module is not declared in go.mod, so fetch it explicitly at the - # version pinned in the script. - run: | - version=$(grep -oP 'code-generator@\Kv[0-9.]+' hack/update-codegen.sh) - tmpdir=$(mktemp -d) - cd "$tmpdir" - go mod init codegen-fetch - go get "k8s.io/code-generator@${version}" - - - name: Run make generate - run: make generate - - - name: Fail on drift - run: | - if [ -n "$(git status --porcelain)" ]; then - echo "::error::'make generate' produced changes. Run 'make generate' locally and commit the result." - git status --short - git diff --color=always - exit 1 - fi diff --git a/.github/workflows/labels.yaml b/.github/workflows/labels.yaml deleted file mode 100644 index 69c18329..00000000 --- a/.github/workflows/labels.yaml +++ /dev/null @@ -1,84 +0,0 @@ -name: Labels - -on: - pull_request: - paths: - - .github/labels.yml - - .github/workflows/labels.yaml - push: - branches: [main] - paths: - - .github/labels.yml - - .github/workflows/labels.yaml - workflow_dispatch: - schedule: - - cron: '17 4 * * 1' # Mondays at 04:17 UTC - -permissions: - contents: read - -concurrency: - group: labels-sync - cancel-in-progress: false - -jobs: - validate: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - - name: Validate labels.yml schema - run: | - python3 - <<'PY' - import re, sys, yaml - - path = '.github/labels.yml' - data = yaml.safe_load(open(path)) - errors = [] - - # 1. description ≤ 100 chars (GitHub REST API limit) - for label in data: - desc = label.get('description', '') or '' - if len(desc) > 100: - errors.append(f"{label['name']}: description {len(desc)} chars (max 100)") - - # 2. color is 6-char hex without leading # - for label in data: - color = label.get('color', '') or '' - if not re.match(r'^[0-9A-Fa-f]{6}$', color): - errors.append(f"{label['name']}: bad color {color!r} (must be 6-char hex without #)") - - # 3. unique top-level names - names = [label['name'] for label in data] - dups = sorted({n for n in names if names.count(n) > 1}) - for n in dups: - errors.append(f"duplicate name: {n}") - - # 4. aliases do not collide with any top-level name - name_set = set(names) - for label in data: - for alias in (label.get('aliases') or []): - if alias in name_set: - errors.append(f"alias {alias!r} (under {label['name']!r}) collides with a top-level name") - - if errors: - for err in errors: - print(f"::error::{err}") - sys.exit(1) - - print(f"labels.yml schema OK ({len(data)} labels)") - PY - - sync: - needs: validate - if: github.event_name != 'pull_request' - runs-on: ubuntu-latest - permissions: - issues: write - pull-requests: write - steps: - - uses: actions/checkout@v4 - - uses: EndBug/label-sync@v2 - with: - config-file: .github/labels.yml - delete-other-labels: false diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml deleted file mode 100644 index 6e6f3017..00000000 --- a/.github/workflows/pr-labeler.yaml +++ /dev/null @@ -1,206 +0,0 @@ -name: PR Auto-Label - -on: - pull_request_target: - types: [opened, edited, reopened, synchronize] - -permissions: - contents: read - pull-requests: write - -jobs: - label: - runs-on: ubuntu-latest - steps: - - name: Apply labels from PR title - uses: actions/github-script@v7 - with: - script: | - // Conventional Commits types accepted by Cozystack (per docs/agents/contributing.md): - // feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert - // Mapping below maps a subset to kind/* — types not listed do not produce a kind/*. - const typeToKind = { - feat: 'kind/feature', - fix: 'kind/bug', - docs: 'kind/documentation', - chore: 'kind/cleanup', - refactor: 'kind/cleanup', - // style, perf, test, build, ci, revert — no kind mapping - }; - - // scope -> area/* mapping. Keys are the scopes observed in cozystack issues - // and PRs. Add new entries when a scope recurs (3+ times). - const scopeToArea = { - // area/api - 'api': 'area/api', - 'cozystack-api': 'area/api', - - // area/ai - 'agents': 'area/ai', - 'ai': 'area/ai', - - // area/build - 'build': 'area/build', - - // area/ci - 'ci': 'area/ci', - - // area/dashboard - 'dashboard': 'area/dashboard', - - // area/database - 'postgres': 'area/database', - 'postgres-operator': 'area/database', - 'mariadb': 'area/database', - 'mariadb-operator': 'area/database', - 'redis': 'area/database', - 'etcd': 'area/database', - 'kafka': 'area/database', - 'clickhouse': 'area/database', - - // area/extra - 'extra': 'area/extra', - - // area/kubernetes - 'kubernetes': 'area/kubernetes', - 'apps/kubernetes': 'area/kubernetes', - - // area/monitoring - 'monitoring': 'area/monitoring', - 'vlogs': 'area/monitoring', - 'vmstack': 'area/monitoring', - 'grafana': 'area/monitoring', - 'workloadmonitor': 'area/monitoring', - - // area/networking - 'ingress': 'area/networking', - 'ingress-nginx': 'area/networking', - 'gateway': 'area/networking', - 'vpn': 'area/networking', - 'metallb': 'area/networking', - 'cilium': 'area/networking', - 'kube-ovn': 'area/networking', - 'tcp-balancer': 'area/networking', - 'securitygroups': 'area/networking', - 'cozy-proxy': 'area/networking', - - // area/platform - 'platform': 'area/platform', - 'bundle': 'area/platform', - 'flux': 'area/platform', - 'fluxcd': 'area/platform', - 'cluster-api': 'area/platform', - 'talos': 'area/platform', - 'installer': 'area/platform', - 'cozyctl': 'area/platform', - 'cozystack-engine': 'area/platform', - 'cozy-lib': 'area/platform', - - // area/release - 'backport': 'area/release', - 'release': 'area/release', - - // area/storage - 'seaweedfs': 'area/storage', - 'seaweedfs-cosi-driver': 'area/storage', - 'bucket': 'area/storage', - 'linstor': 'area/storage', - 'velero': 'area/storage', - 'harbor': 'area/storage', - 'backups': 'area/storage', - - // area/testing - 'tests': 'area/testing', - 'e2e': 'area/testing', - - // area/virtualization - 'kubevirt': 'area/virtualization', - 'cdi': 'area/virtualization', - 'vmi': 'area/virtualization', - 'vm-import': 'area/virtualization', - 'virtual-machine': 'area/virtualization', - 'hami': 'area/virtualization', - 'gpu-operator': 'area/virtualization', - }; - - const pr = context.payload.pull_request; - const title = pr.title || ''; - const body = pr.body || ''; - const existing = new Set((pr.labels || []).map(l => l.name)); - const toAdd = new Set(); - - // 1. Strip "[Backport release-1.x]" prefix if present. - const backportMatch = title.match(/^\[Backport ([^\]]+)\]\s+(.+)$/); - const cleanTitle = backportMatch ? backportMatch[2] : title; - if (backportMatch) { - toAdd.add('area/release'); - toAdd.add('backport'); - } - - // 2. Try Conventional Commits form: type(scope)?(!)?: description - const conv = cleanTitle.match(/^([a-z]+)(?:\(([^)]+)\))?(!)?:\s*.+$/); - // 3. Fall back to bracket form: [scope] description - const bracket = !conv && cleanTitle.match(/^\[([^\]]+)\]\s+.+$/); - - let type = null, scopeStr = null, breaking = false; - if (conv) { - type = conv[1]; - scopeStr = conv[2] || null; - breaking = !!conv[3]; - } else if (bracket) { - scopeStr = bracket[1]; - } - - // 4. Detect BREAKING CHANGE: or BREAKING-CHANGE: footer in body. - // Conventional Commits 1.0 spec item 16 treats them as synonymous. - if (/^BREAKING[ -]CHANGE:/m.test(body)) { - breaking = true; - } - - // 5. Apply kind/* from type. - if (type) { - if (typeToKind[type]) { - toAdd.add(typeToKind[type]); - } else { - core.warning(`type "${type}" has no kind/* mapping — typo or new type? See .github/workflows/pr-labeler.yaml typeToKind`); - } - } - - // 6. Apply area/* from scope. Composite scopes split on comma. - const scopes = (scopeStr || '') - .split(/,\s*/) - .map(s => s.trim()) - .filter(Boolean); - for (const s of scopes) { - if (scopeToArea[s]) { - toAdd.add(scopeToArea[s]); - } else { - core.warning(`scope "${s}" has no area/* mapping — consider extending scopeToArea in .github/workflows/pr-labeler.yaml if it recurs`); - } - } - - // 7. kind/breaking-change. - if (breaking) { - toAdd.add('kind/breaking-change'); - } - - // 8. Fallback: no area/* applied -> area/uncategorized. - const hasArea = [...toAdd].some(l => l.startsWith('area/')); - if (!hasArea) { - toAdd.add('area/uncategorized'); - } - - // 9. Additive only — never remove existing labels. - const newLabels = [...toAdd].filter(l => !existing.has(l)); - if (newLabels.length === 0) { - core.info('No new labels to apply'); - return; - } - - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: pr.number, - labels: newLabels, - }); - core.info(`Applied labels: ${newLabels.join(', ')}`); diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index b2d82ff3..ef1ce088 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -28,7 +28,7 @@ jobs: - name: Install generate run: | - curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.3.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen + curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.0.6/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen - name: Run pre-commit hooks run: | diff --git a/.github/workflows/pull-requests.yaml b/.github/workflows/pull-requests.yaml index d9898616..933c29ec 100644 --- a/.github/workflows/pull-requests.yaml +++ b/.github/workflows/pull-requests.yaml @@ -6,6 +6,8 @@ env: on: pull_request: types: [opened, synchronize, reopened] + paths-ignore: + - 'docs/**/*' # Cancel in‑flight runs for the same PR when a new push arrives. concurrency: @@ -13,32 +15,16 @@ concurrency: cancel-in-progress: true jobs: - detect-changes: - name: Detect changes - runs-on: ubuntu-latest - outputs: - code: ${{ steps.filter.outputs.code }} - steps: - - uses: dorny/paths-filter@v3 - id: filter - with: - filters: | - code: - - '!docs/**' - build: name: Build runs-on: [self-hosted] - timeout-minutes: 30 permissions: contents: read packages: write - needs: ["detect-changes"] - # Never run when the PR carries the "release" label or only docs changed. + # Never run when the PR carries the "release" label. if: | - needs.detect-changes.outputs.code == 'true' - && !contains(github.event.pull_request.labels.*.name, 'release') + !contains(github.event.pull_request.labels.*.name, 'release') steps: - name: Checkout code @@ -159,7 +145,6 @@ jobs: name: "E2E Tests" runs-on: ${{ contains(github.event.pull_request.labels.*.name, 'debug') && 'self-hosted' || 'oracle-vm-24cpu-96gb-x86-64' }} #runs-on: [oracle-vm-32cpu-128gb-x86-64] - timeout-minutes: 120 permissions: contents: read packages: read diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml index 1b68ee32..bba18c2d 100644 --- a/.github/workflows/tags.yaml +++ b/.github/workflows/tags.yaml @@ -16,8 +16,6 @@ jobs: prepare-release: name: Prepare Release runs-on: [self-hosted] - outputs: - skip: ${{ steps.check_release.outputs.skip }} permissions: contents: write packages: write @@ -131,6 +129,7 @@ jobs: git config --unset-all http.https://github.com/.extraheader || true git add . git commit -m "Prepare release ${GITHUB_REF#refs/tags/}" -s || echo "No changes to commit" + git push origin HEAD || true # Tag the api/apps/v1alpha1 submodule for pkg.go.dev - name: Tag API submodule @@ -223,7 +222,7 @@ jobs: repo: context.repo.repo, head, base, - title: `chore(release): cut v${version}`, + title: `Release v${version}`, body: `This PR prepares the release \`v${version}\`.`, draft: false }); @@ -255,21 +254,6 @@ jobs: private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }} owner: cozystack - # Read-only token for the AI step. Minting a separate scoped token - # means the Generate changelog using AI step cannot push branches, - # open PRs, or mutate any repository even with --allow-all-tools, - # regardless of whether the agent follows the prompt's instructions. - - name: Generate read-only GitHub App token - id: app-token-read - uses: actions/create-github-app-token@v1 - with: - app-id: ${{ secrets.COZYSTACK_CI_APP_ID }} - private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }} - owner: cozystack - permission-contents: read - permission-pull-requests: read - permission-metadata: read - - name: Parse tag id: tag uses: actions/github-script@v7 @@ -318,59 +302,50 @@ jobs: - name: Generate changelog using AI if: steps.check_changelog.outputs.exists == 'false' - timeout-minutes: 30 env: COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} - GH_TOKEN: ${{ steps.app-token-read.outputs.token }} - VERSION: ${{ steps.tag.outputs.version }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - copilot \ - --prompt "Generate the release changelog for tag v${VERSION}. Follow the instructions in @docs/agents/changelog.md exactly, including the 'Scope and boundaries' section at the top. Your deliverable is the single file docs/changelogs/v${VERSION}.md — write it and exit; this workflow handles branching, committing, pushing, and opening the PR." \ + copilot --prompt "prepare changelog file for tagged release v${{ steps.tag.outputs.version }}, use @docs/agents/changelog.md for it. Create the changelog file at docs/changelogs/v${{ steps.tag.outputs.version }}.md" \ --allow-all-tools --allow-all-paths < /dev/null - name: Create changelog branch and commit if: steps.check_changelog.outputs.exists == 'false' env: APP_TOKEN: ${{ steps.app-token.outputs.token }} - VERSION: ${{ steps.tag.outputs.version }} run: | - set -euo pipefail - - CHANGELOG_FILE="docs/changelogs/v${VERSION}.md" - CHANGELOG_BRANCH="changelog-v${VERSION}" - - if [ ! -f "$CHANGELOG_FILE" ]; then - echo "::error::Changelog file $CHANGELOG_FILE was not produced by the Generate changelog using AI step" - exit 1 - fi - if [ ! -s "$CHANGELOG_FILE" ]; then - echo "::error::Changelog file $CHANGELOG_FILE is empty" - exit 1 - fi - - # Snapshot the file across the branch switch — the checkout below - # resets tracked files to match origin/main. - TEMP_FILE="$(mktemp)" - trap 'rm -f "$TEMP_FILE"' EXIT - cp "$CHANGELOG_FILE" "$TEMP_FILE" - git config user.name "cozystack-ci[bot]" git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com" - git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}" - - git fetch origin main - git branch -D "$CHANGELOG_BRANCH" 2>/dev/null || true - git checkout -b "$CHANGELOG_BRANCH" origin/main - - mkdir -p "$(dirname "$CHANGELOG_FILE")" - cp "$TEMP_FILE" "$CHANGELOG_FILE" - - # The `check_changelog` step gated this job on the file being absent - # from origin/main, so `git add` + `git commit` must produce a diff. - # If they don't, something is wrong (e.g. empty file) — fail loud. - git add "$CHANGELOG_FILE" - git commit -m "docs: add changelog for v${VERSION}" -s - git push -f origin "$CHANGELOG_BRANCH" + git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY} + + CHANGELOG_FILE="docs/changelogs/v${{ steps.tag.outputs.version }}.md" + CHANGELOG_BRANCH="changelog-v${{ steps.tag.outputs.version }}" + + if [ -f "$CHANGELOG_FILE" ]; then + # Fetch latest main branch + git fetch origin main + + # Delete local branch if it exists + git branch -D "$CHANGELOG_BRANCH" 2>/dev/null || true + + # Create and checkout new branch from main + git checkout -b "$CHANGELOG_BRANCH" origin/main + + # Add and commit changelog + git add "$CHANGELOG_FILE" + if git diff --staged --quiet; then + echo "⚠️ No changes to commit (file may already be committed)" + else + git commit -m "docs: add changelog for v${{ steps.tag.outputs.version }}" -s + echo "✅ Changelog committed to branch $CHANGELOG_BRANCH" + fi + + # Push the branch (force push to update if it exists) + git push -f origin "$CHANGELOG_BRANCH" + else + echo "⚠️ Changelog file was not generated" + exit 1 + fi - name: Create PR for changelog if: steps.check_changelog.outputs.exists == 'false' @@ -411,7 +386,7 @@ jobs: repo: context.repo.repo, head: changelogBranch, base: baseBranch, - title: `docs(release): add changelog for v${version}`, + title: `docs: add changelog for v${version}`, body: `This PR adds the changelog for release \`v${version}\`.\n\n✅ Changelog has been automatically generated in \`docs/changelogs/v${version}.md\`.`, draft: false }); @@ -421,7 +396,7 @@ jobs: owner: context.repo.owner, repo: context.repo.repo, issue_number: pr.data.number, - labels: ['kind/documentation', 'automated'] + labels: ['documentation', 'automated'] }); console.log(`Created PR #${pr.data.number} for changelog`); @@ -465,58 +440,17 @@ jobs: token: ${{ steps.app-token.outputs.token }} ref: main - # Decide whether this release promotes the `next/` trunk to a new released - # version directory. Per the website repo's contract (see website#495): - # - `make release-next` runs only for new minor/major final releases - # (tag matches `vX.Y.Z` with no prerelease suffix AND `vX.Y/` does - # not yet exist on disk). - # - Prereleases and patch releases skip this step and let - # `make update-all` handle routing on its own. - - name: Determine if this release promotes next/ - id: promote - env: - TAG: ${{ steps.tag.outputs.tag }} - run: | - if [[ ! "$TAG" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then - echo "promote=false" >> "$GITHUB_OUTPUT" - echo "Prerelease tag '$TAG' — skipping release-next." - exit 0 - fi - MAJOR="${BASH_REMATCH[1]}" - MINOR="${BASH_REMATCH[2]}" - if [[ "$MAJOR" == "0" ]]; then - DOC_VERSION="v0" - else - DOC_VERSION="v${MAJOR}.${MINOR}" - fi - if [[ -d "content/en/docs/${DOC_VERSION}" ]]; then - echo "promote=false" >> "$GITHUB_OUTPUT" - echo "content/en/docs/${DOC_VERSION}/ already exists — patch release, skipping release-next." - else - echo "promote=true" >> "$GITHUB_OUTPUT" - echo "New minor/major release ${DOC_VERSION} — will promote next/ → ${DOC_VERSION}/." - fi - - - name: Promote next/ to released version - if: steps.promote.outputs.promote == 'true' - env: - GH_TOKEN: ${{ steps.app-token.outputs.token }} - TAG: ${{ steps.tag.outputs.tag }} - run: make release-next RELEASE_TAG="$TAG" - - name: Update docs from release branch env: GH_TOKEN: ${{ steps.app-token.outputs.token }} - TAG: ${{ steps.tag.outputs.tag }} - VERSION: ${{ steps.tag.outputs.version }} - run: make update-all BRANCH="release-$VERSION" RELEASE_TAG="$TAG" + run: make update-all BRANCH=release-${{ steps.tag.outputs.version }} RELEASE_TAG=${{ steps.tag.outputs.tag }} - name: Commit and push id: commit run: | git config user.name "cozystack-ci[bot]" git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com" - git add content hugo.yaml + git add content if git diff --cached --quiet; then echo "No changes to commit" echo "changed=false" >> $GITHUB_OUTPUT diff --git a/.gitignore b/.gitignore index 61003de5..0ecfa223 100644 --- a/.gitignore +++ b/.gitignore @@ -80,7 +80,3 @@ fabric.properties **/.DS_Store tmp/ - -# build revision marker (generated by make image-packages) -packages/core/platform/.build-revision -.claude/ diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 6492b92d..ac0f7e30 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,17 +1,6 @@ repos: - repo: local hooks: - - id: run-make-generate-root - name: Run 'make generate' at repo root - entry: | - flock -x .git/pre-commit.lock sh -c ' - echo "Running make generate at repo root" - make generate || exit $? - git diff --color=always | cat - ' - language: system - files: ^(api/|pkg/apis/|pkg/generated/|internal/crdinstall/manifests/|packages/system/cozystack-controller/definitions/|packages/system/application-definition-crd/definition/|packages/system/backup-controller/definitions/|packages/system/backupstrategy-controller/definitions/|hack/update-codegen\.sh$|hack/boilerplate\.go\.txt$|Makefile$) - pass_filenames: false - id: run-make-generate name: Run 'make generate' in all app directories entry: | diff --git a/AGENTS.md b/AGENTS.md index 1e9c4d15..eb1febf7 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -27,12 +27,6 @@ working with the **Cozystack** project. - Read: [`contributing.md`](./docs/agents/contributing.md) - Action: Read the file to understand git workflow, commit format, PR process -- **Issue and PR labeling, triage** (e.g., "label this issue", "what label should I use", "triage this", "categorize") - - Read: [`.github/labels.yml`](./.github/labels.yml) - - Action: Use labels defined there. Conventions follow the Kubernetes scheme — `kind/*` (type), `area/*` (subsystem), `priority/*` (urgency), `triage/*` (review state), `lifecycle/*` (auto-close), `do-not-merge/*` (PR blockers), `security/*` (severity) - - For `area/*`: accuracy outweighs reuse. If no existing `area/*` truly fits the change, propose a new one via PR (extend `.github/labels.yml` and the scope mapping in `.github/workflows/pr-labeler.yaml`) — do not shoehorn the change into a wrong area. `area/uncategorized` is the auto-labeler fallback; treat it as a signal to pick a fit, create a new area, or correct the PR title - - PR titles: a Conventional Commits header (`type(scope): description`, types from [`contributing.md`](./docs/agents/contributing.md)) auto-applies `kind/*` and `area/*` via `.github/workflows/pr-labeler.yaml`. Append `!` (or add a `BREAKING CHANGE:` footer) to apply `kind/breaking-change` - **Important rules:** - ✅ **ONLY read the file if the task matches the documented process scope** - do not read files for tasks that don't match their purpose - ✅ **ALWAYS read the file FIRST** before starting the task (when applicable) @@ -59,7 +53,7 @@ working with the **Cozystack** project. ### Conventions - **Helm Charts**: Umbrella pattern, vendored upstream charts in `charts/` - **Go Code**: Controller-runtime patterns, kubebuilder style -- **Git Commits**: Conventional Commits (`type(scope): description`) with `--signoff` +- **Git Commits**: `[component] Description` format with `--signoff` ### What NOT to Do - ❌ Edit `/vendor/`, `zz_generated.*.go`, upstream charts directly diff --git a/MAINTAINERS.md b/MAINTAINERS.md index d7061941..9c44daab 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -10,5 +10,3 @@ | Timur Tukaev | [@tym83](https://github.com/tym83) | Ænix | Cozystack Website, Marketing, Community Management | | Kirill Klinchenkov | [@klinch0](https://github.com/klinch0) | Ænix | Core Maintainer | | Nikita Bykov | [@nbykov0](https://github.com/nbykov0) | Ænix | Maintainer of ARM and stuff | -| Matthieu Robin | [@matthieu-robin](https://github.com/matthieu-robin) | Hidora | Managed Applications, Platform Quality & Benchmarking | -| Mattia Eleuteri | [@mattia-eleuteri](https://github.com/mattia-eleuteri) | Hidora | CSI, Storage, Networking & Security | diff --git a/Makefile b/Makefile index acc9b6f6..ca48197c 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -.PHONY: manifests assets unit-tests helm-unit-tests bats-unit-tests preflight +.PHONY: manifests assets unit-tests helm-unit-tests include hack/common-envs.mk @@ -22,13 +22,11 @@ build: build-deps make -C packages/system/lineage-controller-webhook image make -C packages/system/cilium image make -C packages/system/linstor image - make -C packages/system/linstor-gui image make -C packages/system/kubeovn-webhook image make -C packages/system/kubeovn-plunger image make -C packages/system/dashboard image make -C packages/system/metallb image make -C packages/system/kamaji image - make -C packages/system/multus image make -C packages/system/bucket image make -C packages/system/objectstorage-controller image make -C packages/system/grafana-operator image @@ -60,11 +58,7 @@ manifests: cozypkg: go build -ldflags "-X github.com/cozystack/cozystack/cmd/cozypkg/cmd.Version=v$(COZYSTACK_VERSION)" -o _out/bin/cozypkg ./cmd/cozypkg -assets: assets-talos assets-cozypkg openapi-json - -openapi-json: - mkdir -p _out/assets - VERSION=$(shell git describe --tags --always 2>/dev/null || echo dev) go run ./tools/openapi-gen/ 2>/dev/null > _out/assets/openapi.json +assets: assets-talos assets-cozypkg assets-talos: make -C packages/core/talos assets @@ -83,46 +77,11 @@ test: make -C packages/core/testing apply make -C packages/core/testing test -unit-tests: helm-unit-tests bats-unit-tests go-unit-tests +unit-tests: helm-unit-tests helm-unit-tests: hack/helm-unit-tests.sh -# Scoped go test over the cozystack-api surface that this repo owns. Kept -# narrow intentionally - running `go test ./...` pulls in generated code -# round-trip suites whose behavior depends on tool versions outside this -# repo's control (kubebuilder, openapi-gen, etc.) and is better exercised -# from their generator workflows. -go-unit-tests: - go test ./pkg/registry/... ./pkg/config/... ./pkg/cmd/server/... - -# Discover every hack/*.bats file that is NOT an e2e test and run it -# through cozytest.sh. Drop a new *.bats file in hack/ and it is picked -# up automatically on the next `make unit-tests` run. -# -# Caveat: $(wildcard ...) returns space-separated names, so a filename -# containing a literal space would split into multiple tokens here. All -# current bats files use hyphen-separated names; if the project ever -# introduces whitespace-bearing filenames this recipe must be rewritten -# (e.g. to use `find ... -print0 | xargs -0`). -BATS_UNIT_FILES := $(filter-out hack/e2e-%.bats,$(wildcard hack/*.bats)) - -bats-unit-tests: - @if [ -z "$(BATS_UNIT_FILES)" ]; then \ - echo "ERROR: no hack/*.bats unit test files found"; \ - exit 1; \ - fi - @for f in $(BATS_UNIT_FILES); do \ - echo "--- running $$f ---"; \ - hack/cozytest.sh "$$f" || exit 1; \ - done - -# Operator-facing host preflight check. Warns about a standalone -# containerd.service or docker.service running alongside the embedded -# k3s runtime. Safe to run at any time; always exits 0. -preflight: - @hack/check-host-runtime.sh - prepare-env: make -C packages/core/testing apply make -C packages/core/testing prepare-cluster diff --git a/README.md b/README.md index 5bc8d7be..b81af2a7 100644 --- a/README.md +++ b/README.md @@ -6,12 +6,11 @@ [![Support](https://img.shields.io/badge/$-support-12a0df.svg?style=flat)](https://cozystack.io/support/) [![Active](http://img.shields.io/badge/Status-Active-green.svg)](https://github.com/cozystack/cozystack) [![GitHub Release](https://img.shields.io/github/release/cozystack/cozystack.svg?style=flat)](https://github.com/cozystack/cozystack/releases/latest) -[![GitHub Commit](https://img.shields.io/github/commit-activity/y/cozystack/cozystack)](https://github.com/cozystack/cozystack/graphs/contributors) -[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10177/badge)](https://www.bestpractices.dev/projects/10177) +[![GitHub Commit](https://img.shields.io/github/commit-activity/y/cozystack/cozystack)](https://github.com/cozystack/cozystack/graphs/contributors) # Cozystack -**Cozystack** is a free platform and framework for building clouds. +**Cozystack** is a free PaaS platform and framework for building clouds. Cozystack is a [CNCF Sandbox Level Project](https://www.cncf.io/sandbox-projects/) that was originally built and sponsored by [Ænix](https://aenix.io/). diff --git a/SECURITY.md b/SECURITY.md deleted file mode 100644 index b64e533b..00000000 --- a/SECURITY.md +++ /dev/null @@ -1,102 +0,0 @@ -# Security Policy - -## Scope - -This policy applies to the [`cozystack/cozystack`](https://github.com/cozystack/cozystack) repository and to release artifacts produced from it, including Cozystack core components, operators, packaged manifests, container images, and installation assets published by the project. - -Cozystack integrates and ships many upstream cloud native components. If you believe a vulnerability originates in an upstream project rather than in Cozystack-specific code, packaging, defaults, or integration logic, please report it to the upstream project as well. If you are unsure, report it to Cozystack first and we will help route or coordinate the issue. - -## Supported Versions - -As of March 17, 2026, the Cozystack project maintains multiple release lines. Security fixes are prioritized for the latest stable release line and, when needed, backported to other supported lines. - -| Version line | Status | Notes | -| --- | --- | --- | -| `v1.1.x` | Supported | Current stable release line. | -| `v1.0.x` | Supported | Previous stable release line; receives security and important maintenance fixes. | -| `v0.41.x` | Limited support | Legacy pre-v1 line during the v0 to v1 transition; critical security and upgrade-blocking fixes may be backported at maintainer discretion. | -| `< v0.41` | Not supported | Please upgrade to a supported release line before requesting a security fix. | -| `alpha`, `beta`, `rc` releases | Not supported | Pre-release builds are for testing and evaluation only. | - -Supported versions may change over time as new release lines are cut. The authoritative source for current releases is the GitHub Releases page: - - - -## Reporting a Vulnerability - -Please do **not** report security vulnerabilities through public GitHub issues, discussions, pull requests, Telegram, Slack, or other public community channels. - -At the moment, this repository does not publish a dedicated private security mailbox in-tree. If you need to report a vulnerability: - -1. Contact one of the project maintainers listed in `CODEOWNERS` using an existing private channel you already have. -2. If you do not already have a private maintainer contact, use a public community channel only to request a private contact path, without disclosing any vulnerability details. - -Please do not include exploit details, credentials, tokens, private keys, customer data, or other sensitive material in any public message. - -When reporting a vulnerability, please include as much of the following as possible: - -- affected Cozystack version, tag, or commit -- affected component or package, for example operator, API server, dashboard, installer, or a packaged system component -- deployment environment and provider, for example bare metal, Hetzner, Oracle Cloud, or other infrastructure -- prerequisites and exact reproduction steps -- impact, attack scenario, and expected blast radius -- whether authentication, tenant access, cluster-admin access, or network adjacency is required -- known mitigations or workarounds -- whether you believe the issue also affects an upstream dependency - -## What to Expect - -The maintainers will aim to: - -- acknowledge receipt within 3 business days -- perform an initial triage and severity assessment within 7 business days -- keep the reporter informed as the fix and disclosure plan are developed - -Resolution timelines depend on severity, complexity, release branch applicability, and whether coordination with upstream projects is required. - -## Disclosure Process - -The Cozystack project follows a coordinated disclosure model. - -- We ask reporters to keep details private until a fix or mitigation is available and users have had a reasonable opportunity to upgrade. -- When appropriate, maintainers may use GitHub Security Advisories or equivalent coordinated disclosure tooling to manage remediation and public disclosure. -- If appropriate, the project may request or publish a GHSA and/or CVE as part of the disclosure process. -- Fixes will normally be released in the supported version lines affected by the issue, subject to severity and feasibility. - -Public disclosure will typically happen through one or more of the following: - -- GitHub Releases and release notes -- project changelogs and documentation updates -- GitHub Security Advisories, when used for coordinated disclosure - -## Project Security Practices - -Security is part of the normal Cozystack development and release process. Current project practices include: - -- maintainer-owned review through pull requests and `CODEOWNERS` -- automated pull request checks, including pre-commit validation, unit tests, builds, and end-to-end testing -- release automation with patch releases, release branches, and backport workflows -- ongoing maintenance of packaged dependencies and platform integrations across supported release lines - -Because Cozystack is an integration-heavy platform, some vulnerabilities may require coordination across multiple repositories or with upstream maintainers before a public fix can be released. - -## Security Fixes and Announcements - -Security fixes are published in normal release artifacts whenever possible. Users should monitor: - -- GitHub Releases: -- project changelogs in this repository -- the Cozystack website and documentation: - -## Out of Scope - -The following are generally out of scope for private security reporting unless there is a clear Cozystack-specific impact: - -- vulnerabilities in unsupported or end-of-life Cozystack versions -- issues that require access already equivalent to cluster-admin, node root, or direct infrastructure administrator privileges, unless they bypass an expected Cozystack security boundary -- vulnerabilities that exist only in an upstream dependency and are not introduced or materially worsened by Cozystack packaging, configuration, or defaults -- requests for security best-practice advice without a concrete vulnerability - -## Credits - -We appreciate responsible disclosure and will credit reporters in public advisories or release notes unless anonymous disclosure is requested. diff --git a/api/apps/v1alpha1/bucket/types.go b/api/apps/v1alpha1/bucket/types.go deleted file mode 100644 index 96082a67..00000000 --- a/api/apps/v1alpha1/bucket/types.go +++ /dev/null @@ -1,33 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package bucket - -import ( - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Provisions bucket from the `-lock` BucketClass (with object lock enabled). - // +kubebuilder:default:=false - Locking bool `json:"locking"` - // Selects a specific BucketClass by storage pool name. - // +kubebuilder:default:="" - StoragePool string `json:"storagePool,omitempty"` - // Users configuration map. - // +kubebuilder:default:={} - Users map[string]User `json:"users,omitempty"` -} - -type User struct { - // Whether the user has read-only access. - Readonly bool `json:"readonly,omitempty"` -} diff --git a/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go b/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go deleted file mode 100644 index 26f925cd..00000000 --- a/api/apps/v1alpha1/bucket/zz_generated.deepcopy.go +++ /dev/null @@ -1,88 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package bucket - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - if in.Users != nil { - in, out := &in.Users, &out.Users - *out = make(map[string]User, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *User) DeepCopyInto(out *User) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User. -func (in *User) DeepCopy() *User { - if in == nil { - return nil - } - out := new(User) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/clickhouse/types.go b/api/apps/v1alpha1/clickhouse/types.go deleted file mode 100644 index 153ff5e0..00000000 --- a/api/apps/v1alpha1/clickhouse/types.go +++ /dev/null @@ -1,112 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package clickhouse - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of ClickHouse replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Number of ClickHouse shards. - // +kubebuilder:default:=1 - Shards int `json:"shards"` - // Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="small" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume Claim size available for application data. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Size of Persistent Volume for logs. - // +kubebuilder:default:="2Gi" - LogStorageSize resource.Quantity `json:"logStorageSize"` - // TTL (expiration time) for `query_log` and `query_thread_log`. - // +kubebuilder:default:=15 - LogTTL int `json:"logTTL"` - // Users configuration map. - // +kubebuilder:default:={} - Users map[string]User `json:"users,omitempty"` - // Backup configuration. - // +kubebuilder:default:={} - Backup Backup `json:"backup"` - // ClickHouse Keeper configuration. - // +kubebuilder:default:={} - ClickhouseKeeper ClickHouseKeeper `json:"clickhouseKeeper"` -} - -type Backup struct { - // Retention strategy for cleaning up old backups. - // +kubebuilder:default:="--keep-last=3 --keep-daily=3 --keep-within-weekly=1m" - CleanupStrategy string `json:"cleanupStrategy"` - // Enable regular backups (default: false). - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Password for Restic backup encryption. - // +kubebuilder:default:="" - ResticPassword string `json:"resticPassword"` - // Access key for S3 authentication. - // +kubebuilder:default:="" - S3AccessKey string `json:"s3AccessKey"` - // S3 bucket used for storing backups. - // +kubebuilder:default:="s3.example.org/clickhouse-backups" - S3Bucket string `json:"s3Bucket"` - // AWS S3 region where backups are stored. - // +kubebuilder:default:="us-east-1" - S3Region string `json:"s3Region"` - // Secret key for S3 authentication. - // +kubebuilder:default:="" - S3SecretKey string `json:"s3SecretKey"` - // Cron schedule for automated backups. - // +kubebuilder:default:="0 2 * * *" - Schedule string `json:"schedule"` -} - -type ClickHouseKeeper struct { - // Deploy ClickHouse Keeper for cluster coordination. - // +kubebuilder:default:=true - Enabled bool `json:"enabled,omitempty"` - // Number of Keeper replicas. - // +kubebuilder:default:=3 - Replicas int `json:"replicas,omitempty"` - // Default sizing preset. - // +kubebuilder:default:="micro" - ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"` - // Persistent Volume Claim size available for application data. - // +kubebuilder:default:="1Gi" - Size resource.Quantity `json:"size,omitempty"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type User struct { - // Password for the user. - Password string `json:"password,omitempty"` - // User is readonly (default: false). - Readonly bool `json:"readonly,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go b/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go deleted file mode 100644 index 2c3a6ed8..00000000 --- a/api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go +++ /dev/null @@ -1,141 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package clickhouse - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Backup) DeepCopyInto(out *Backup) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup. -func (in *Backup) DeepCopy() *Backup { - if in == nil { - return nil - } - out := new(Backup) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClickHouseKeeper) DeepCopyInto(out *ClickHouseKeeper) { - *out = *in - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClickHouseKeeper. -func (in *ClickHouseKeeper) DeepCopy() *ClickHouseKeeper { - if in == nil { - return nil - } - out := new(ClickHouseKeeper) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() - out.LogStorageSize = in.LogStorageSize.DeepCopy() - if in.Users != nil { - in, out := &in.Users, &out.Users - *out = make(map[string]User, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - out.Backup = in.Backup - in.ClickhouseKeeper.DeepCopyInto(&out.ClickhouseKeeper) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *User) DeepCopyInto(out *User) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User. -func (in *User) DeepCopy() *User { - if in == nil { - return nil - } - out := new(User) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/foundationdb/types.go b/api/apps/v1alpha1/foundationdb/types.go deleted file mode 100644 index 5b0e5920..00000000 --- a/api/apps/v1alpha1/foundationdb/types.go +++ /dev/null @@ -1,162 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package foundationdb - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Cluster configuration. - // +kubebuilder:default:={} - Cluster Cluster `json:"cluster"` - // Storage configuration. - // +kubebuilder:default:={} - Storage Storage `json:"storage"` - // Explicit CPU and memory configuration for each FoundationDB instance. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="medium" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Backup configuration. - // +kubebuilder:default:={} - Backup Backup `json:"backup"` - // Monitoring configuration. - // +kubebuilder:default:={} - Monitoring Monitoring `json:"monitoring"` - // Custom parameters to pass to FoundationDB. - // +kubebuilder:default:={} - CustomParameters []string `json:"customParameters,omitempty"` - // Container image deployment type. - // +kubebuilder:default:="unified" - ImageType ImageType `json:"imageType"` - // Security context for containers. - // +kubebuilder:default:={} - SecurityContext SecurityContext `json:"securityContext"` - // Enable automatic pod replacements. - // +kubebuilder:default:=true - AutomaticReplacements bool `json:"automaticReplacements"` -} - -type Backup struct { - // Enable backups. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Retention policy for backups. - // +kubebuilder:default:="7d" - RetentionPolicy string `json:"retentionPolicy"` - // S3 configuration for backups. - // +kubebuilder:default:={} - S3 BackupS3 `json:"s3"` -} - -type BackupS3 struct { - // S3 bucket name. - // +kubebuilder:default:="" - Bucket string `json:"bucket"` - // S3 credentials. - // +kubebuilder:default:={} - Credentials BackupS3Credentials `json:"credentials"` - // S3 endpoint URL. - // +kubebuilder:default:="" - Endpoint string `json:"endpoint"` - // S3 region. - // +kubebuilder:default:="us-east-1" - Region string `json:"region"` -} - -type BackupS3Credentials struct { - // S3 access key ID. - // +kubebuilder:default:="" - AccessKeyId string `json:"accessKeyId"` - // S3 secret access key. - // +kubebuilder:default:="" - SecretAccessKey string `json:"secretAccessKey"` -} - -type Cluster struct { - // Fault domain configuration. - // +kubebuilder:default:={} - FaultDomain ClusterFaultDomain `json:"faultDomain"` - // Process counts for different roles. - // +kubebuilder:default:={} - ProcessCounts ClusterProcessCounts `json:"processCounts"` - // Database redundancy mode (single, double, triple, three_datacenter, three_datacenter_fallback). - // +kubebuilder:default:="double" - RedundancyMode string `json:"redundancyMode"` - // Storage engine (ssd-2, ssd-redwood-v1, ssd-rocksdb-v1, memory). - // +kubebuilder:default:="ssd-2" - StorageEngine string `json:"storageEngine"` - // Version of FoundationDB to use. - // +kubebuilder:default:="7.3.63" - Version string `json:"version"` -} - -type ClusterFaultDomain struct { - // Fault domain key. - // +kubebuilder:default:="kubernetes.io/hostname" - Key string `json:"key"` - // Fault domain value source. - // +kubebuilder:default:="spec.nodeName" - ValueFrom string `json:"valueFrom"` -} - -type ClusterProcessCounts struct { - // Number of cluster controller processes. - // +kubebuilder:default:=1 - ClusterController int `json:"cluster_controller"` - // Number of stateless processes (-1 for automatic). - // +kubebuilder:default:=-1 - Stateless int `json:"stateless"` - // Number of storage processes (determines cluster size). - // +kubebuilder:default:=3 - Storage int `json:"storage"` -} - -type Monitoring struct { - // Enable WorkloadMonitor integration. - // +kubebuilder:default:=true - Enabled bool `json:"enabled"` -} - -type Resources struct { - // CPU available to each instance. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each instance. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type SecurityContext struct { - // Group ID to run the container. - // +kubebuilder:default:=4059 - RunAsGroup int `json:"runAsGroup"` - // User ID to run the container. - // +kubebuilder:default:=4059 - RunAsUser int `json:"runAsUser"` -} - -type Storage struct { - // Size of persistent volumes for each instance. - // +kubebuilder:default:="16Gi" - Size resource.Quantity `json:"size"` - // Storage class (if not set, uses cluster default). - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` -} - -// +kubebuilder:validation:Enum="unified";"split" -type ImageType string - -// +kubebuilder:validation:Enum="small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go b/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go deleted file mode 100644 index 92d80421..00000000 --- a/api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go +++ /dev/null @@ -1,234 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package foundationdb - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Backup) DeepCopyInto(out *Backup) { - *out = *in - out.S3 = in.S3 -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup. -func (in *Backup) DeepCopy() *Backup { - if in == nil { - return nil - } - out := new(Backup) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *BackupS3) DeepCopyInto(out *BackupS3) { - *out = *in - out.Credentials = in.Credentials -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupS3. -func (in *BackupS3) DeepCopy() *BackupS3 { - if in == nil { - return nil - } - out := new(BackupS3) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *BackupS3Credentials) DeepCopyInto(out *BackupS3Credentials) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupS3Credentials. -func (in *BackupS3Credentials) DeepCopy() *BackupS3Credentials { - if in == nil { - return nil - } - out := new(BackupS3Credentials) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Cluster) DeepCopyInto(out *Cluster) { - *out = *in - out.FaultDomain = in.FaultDomain - out.ProcessCounts = in.ProcessCounts -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Cluster. -func (in *Cluster) DeepCopy() *Cluster { - if in == nil { - return nil - } - out := new(Cluster) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterFaultDomain) DeepCopyInto(out *ClusterFaultDomain) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterFaultDomain. -func (in *ClusterFaultDomain) DeepCopy() *ClusterFaultDomain { - if in == nil { - return nil - } - out := new(ClusterFaultDomain) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterProcessCounts) DeepCopyInto(out *ClusterProcessCounts) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProcessCounts. -func (in *ClusterProcessCounts) DeepCopy() *ClusterProcessCounts { - if in == nil { - return nil - } - out := new(ClusterProcessCounts) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - out.Cluster = in.Cluster - in.Storage.DeepCopyInto(&out.Storage) - in.Resources.DeepCopyInto(&out.Resources) - out.Backup = in.Backup - out.Monitoring = in.Monitoring - if in.CustomParameters != nil { - in, out := &in.CustomParameters, &out.CustomParameters - *out = make([]string, len(*in)) - copy(*out, *in) - } - out.SecurityContext = in.SecurityContext -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Monitoring) DeepCopyInto(out *Monitoring) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Monitoring. -func (in *Monitoring) DeepCopy() *Monitoring { - if in == nil { - return nil - } - out := new(Monitoring) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *SecurityContext) DeepCopyInto(out *SecurityContext) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecurityContext. -func (in *SecurityContext) DeepCopy() *SecurityContext { - if in == nil { - return nil - } - out := new(SecurityContext) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Storage) DeepCopyInto(out *Storage) { - *out = *in - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Storage. -func (in *Storage) DeepCopy() *Storage { - if in == nil { - return nil - } - out := new(Storage) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/go.mod b/api/apps/v1alpha1/go.mod deleted file mode 100644 index d5d57383..00000000 --- a/api/apps/v1alpha1/go.mod +++ /dev/null @@ -1,24 +0,0 @@ -module github.com/cozystack/cozystack/api/apps/v1alpha1 - -go 1.25.0 - -require k8s.io/apimachinery v0.35.2 - -require ( - github.com/fxamacker/cbor/v2 v2.9.0 // indirect - github.com/go-logr/logr v1.4.3 // indirect - github.com/json-iterator/go v1.1.12 // indirect - github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect - github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect - github.com/x448/float16 v0.8.4 // indirect - go.yaml.in/yaml/v2 v2.4.3 // indirect - golang.org/x/net v0.47.0 // indirect - golang.org/x/text v0.31.0 // indirect - gopkg.in/inf.v0 v0.9.1 // indirect - k8s.io/klog/v2 v2.130.1 // indirect - k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect - k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect - sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect - sigs.k8s.io/randfill v1.0.0 // indirect - sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect -) diff --git a/api/apps/v1alpha1/go.sum b/api/apps/v1alpha1/go.sum deleted file mode 100644 index d9b1cf31..00000000 --- a/api/apps/v1alpha1/go.sum +++ /dev/null @@ -1,56 +0,0 @@ -github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= -github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= -github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= -github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= -github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= -github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= -github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= -github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= -github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= -github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= -github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8= -github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= -github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY= -github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= -github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= -go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= -go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= -golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= -golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= -golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= -golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= -gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= -gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= -gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -k8s.io/apimachinery v0.35.2 h1:NqsM/mmZA7sHW02JZ9RTtk3wInRgbVxL8MPfzSANAK8= -k8s.io/apimachinery v0.35.2/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns= -k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= -k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= -k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE= -k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ= -k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck= -k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= -sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= -sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg= -sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU= -sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY= -sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco= -sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= -sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= -sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= diff --git a/api/apps/v1alpha1/harbor/types.go b/api/apps/v1alpha1/harbor/types.go deleted file mode 100644 index 974576b3..00000000 --- a/api/apps/v1alpha1/harbor/types.go +++ /dev/null @@ -1,114 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package harbor - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host). - // +kubebuilder:default:="" - Host string `json:"host,omitempty"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Core API server configuration. - // +kubebuilder:default:={} - Core Core `json:"core"` - // Container image registry configuration. - // +kubebuilder:default:={} - Registry Registry `json:"registry"` - // Background job service configuration. - // +kubebuilder:default:={} - Jobservice Jobservice `json:"jobservice"` - // Trivy vulnerability scanner configuration. - // +kubebuilder:default:={} - Trivy Trivy `json:"trivy"` - // PostgreSQL database configuration. - // +kubebuilder:default:={} - Database Database `json:"database"` - // Redis cache configuration. - // +kubebuilder:default:={} - Redis Redis `json:"redis"` -} - -type Core struct { - // Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="small" - ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"` -} - -type Database struct { - // Number of database instances. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Persistent Volume size for database storage. - // +kubebuilder:default:="5Gi" - Size resource.Quantity `json:"size"` -} - -type Jobservice struct { - // Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"` -} - -type Redis struct { - // Number of Redis replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Persistent Volume size for cache storage. - // +kubebuilder:default:="1Gi" - Size resource.Quantity `json:"size"` -} - -type Registry struct { - // Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="small" - ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"` -} - -type Resources struct { - // Number of CPU cores allocated. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Amount of memory allocated. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type Trivy struct { - // Enable or disable the vulnerability scanner. - // +kubebuilder:default:=true - Enabled bool `json:"enabled"` - // Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"` - // Persistent Volume size for vulnerability database cache. - // +kubebuilder:default:="5Gi" - Size resource.Quantity `json:"size"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go b/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go deleted file mode 100644 index 3e7338ad..00000000 --- a/api/apps/v1alpha1/harbor/zz_generated.deepcopy.go +++ /dev/null @@ -1,186 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package harbor - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Core.DeepCopyInto(&out.Core) - in.Registry.DeepCopyInto(&out.Registry) - in.Jobservice.DeepCopyInto(&out.Jobservice) - in.Trivy.DeepCopyInto(&out.Trivy) - in.Database.DeepCopyInto(&out.Database) - in.Redis.DeepCopyInto(&out.Redis) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Core) DeepCopyInto(out *Core) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Core. -func (in *Core) DeepCopy() *Core { - if in == nil { - return nil - } - out := new(Core) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Database) DeepCopyInto(out *Database) { - *out = *in - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database. -func (in *Database) DeepCopy() *Database { - if in == nil { - return nil - } - out := new(Database) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Jobservice) DeepCopyInto(out *Jobservice) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Jobservice. -func (in *Jobservice) DeepCopy() *Jobservice { - if in == nil { - return nil - } - out := new(Jobservice) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Redis) DeepCopyInto(out *Redis) { - *out = *in - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Redis. -func (in *Redis) DeepCopy() *Redis { - if in == nil { - return nil - } - out := new(Redis) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Registry) DeepCopyInto(out *Registry) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Registry. -func (in *Registry) DeepCopy() *Registry { - if in == nil { - return nil - } - out := new(Registry) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Trivy) DeepCopyInto(out *Trivy) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Trivy. -func (in *Trivy) DeepCopy() *Trivy { - if in == nil { - return nil - } - out := new(Trivy) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/httpcache/types.go b/api/apps/v1alpha1/httpcache/types.go deleted file mode 100644 index 30bb10ba..00000000 --- a/api/apps/v1alpha1/httpcache/types.go +++ /dev/null @@ -1,72 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package httpcache - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Persistent Volume Claim size available for application data. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // Endpoints configuration, as a list of . - // +kubebuilder:default:={} - Endpoints []string `json:"endpoints,omitempty"` - // HAProxy configuration. - // +kubebuilder:default:={} - Haproxy HAProxy `json:"haproxy"` - // Nginx configuration. - // +kubebuilder:default:={} - Nginx Nginx `json:"nginx"` -} - -type HAProxy struct { - // Number of HAProxy replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` -} - -type Nginx struct { - // Number of Nginx replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go b/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go deleted file mode 100644 index 47da2baa..00000000 --- a/api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go +++ /dev/null @@ -1,123 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package httpcache - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - out.Size = in.Size.DeepCopy() - if in.Endpoints != nil { - in, out := &in.Endpoints, &out.Endpoints - *out = make([]string, len(*in)) - copy(*out, *in) - } - in.Haproxy.DeepCopyInto(&out.Haproxy) - in.Nginx.DeepCopyInto(&out.Nginx) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *HAProxy) DeepCopyInto(out *HAProxy) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HAProxy. -func (in *HAProxy) DeepCopy() *HAProxy { - if in == nil { - return nil - } - out := new(HAProxy) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Nginx) DeepCopyInto(out *Nginx) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Nginx. -func (in *Nginx) DeepCopy() *Nginx { - if in == nil { - return nil - } - out := new(Nginx) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/kafka/types.go b/api/apps/v1alpha1/kafka/types.go deleted file mode 100644 index 485f34ee..00000000 --- a/api/apps/v1alpha1/kafka/types.go +++ /dev/null @@ -1,90 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package kafka - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" - k8sRuntime "k8s.io/apimachinery/pkg/runtime" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // Topics configuration. - // +kubebuilder:default:={} - Topics []Topic `json:"topics,omitempty"` - // Kafka configuration. - // +kubebuilder:default:={} - Kafka Kafka `json:"kafka"` - // ZooKeeper configuration. - // +kubebuilder:default:={} - Zookeeper ZooKeeper `json:"zookeeper"` -} - -type Kafka struct { - // Number of Kafka replicas. - // +kubebuilder:default:=3 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="small" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume size for Kafka. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the Kafka data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type Topic struct { - // Topic configuration. - Config k8sRuntime.RawExtension `json:"config"` - // Topic name. - Name string `json:"name"` - // Number of partitions. - Partitions int `json:"partitions"` - // Number of replicas. - Replicas int `json:"replicas"` -} - -type ZooKeeper struct { - // Number of ZooKeeper replicas. - // +kubebuilder:default:=3 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="small" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume size for ZooKeeper. - // +kubebuilder:default:="5Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the ZooKeeper data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go b/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go deleted file mode 100644 index c2d39077..00000000 --- a/api/apps/v1alpha1/kafka/zz_generated.deepcopy.go +++ /dev/null @@ -1,142 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package kafka - -import ( - "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - if in.Topics != nil { - in, out := &in.Topics, &out.Topics - *out = make([]Topic, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - in.Kafka.DeepCopyInto(&out.Kafka) - in.Zookeeper.DeepCopyInto(&out.Zookeeper) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Kafka) DeepCopyInto(out *Kafka) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Kafka. -func (in *Kafka) DeepCopy() *Kafka { - if in == nil { - return nil - } - out := new(Kafka) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Topic) DeepCopyInto(out *Topic) { - *out = *in - in.Config.DeepCopyInto(&out.Config) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Topic. -func (in *Topic) DeepCopy() *Topic { - if in == nil { - return nil - } - out := new(Topic) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ZooKeeper) DeepCopyInto(out *ZooKeeper) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZooKeeper. -func (in *ZooKeeper) DeepCopy() *ZooKeeper { - if in == nil { - return nil - } - out := new(ZooKeeper) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/kubernetes/types.go b/api/apps/v1alpha1/kubernetes/types.go deleted file mode 100644 index 88a3c97e..00000000 --- a/api/apps/v1alpha1/kubernetes/types.go +++ /dev/null @@ -1,279 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package kubernetes - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" - k8sRuntime "k8s.io/apimachinery/pkg/runtime" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // StorageClass used to store the data. - // +kubebuilder:default:="replicated" - StorageClass string `json:"storageClass"` - // Worker nodes configuration map. - // +kubebuilder:default:={"md0":{"ephemeralStorage":"20Gi","gpus":{},"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":{"ingress-nginx"}}} - NodeGroups map[string]NodeGroup `json:"nodeGroups,omitempty"` - // Kubernetes major.minor version to deploy - // +kubebuilder:default:="v1.35" - Version Version `json:"version"` - // External hostname for Kubernetes cluster. Defaults to `.` if empty. - // +kubebuilder:default:="" - Host string `json:"host"` - // Cluster addons configuration. - // +kubebuilder:default:={} - Addons Addons `json:"addons"` - // Kubernetes control-plane configuration. - // +kubebuilder:default:={} - ControlPlane ControlPlane `json:"controlPlane"` - // Optional image overrides for air-gapped or rate-limited registries. - // +kubebuilder:default:={} - Images Images `json:"images"` -} - -type APIServer struct { - // CPU and memory resources for API Server. - // +kubebuilder:default:={} - Resources Resources `json:"resources"` - // Preset if `resources` omitted. - // +kubebuilder:default:="large" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` -} - -type Addons struct { - // Cert-manager addon. - // +kubebuilder:default:={} - CertManager CertManagerAddon `json:"certManager"` - // Cilium CNI plugin. - // +kubebuilder:default:={} - Cilium CiliumAddon `json:"cilium"` - // CoreDNS addon. - // +kubebuilder:default:={} - Coredns CoreDNSAddon `json:"coredns"` - // FluxCD GitOps operator. - // +kubebuilder:default:={} - Fluxcd FluxCDAddon `json:"fluxcd"` - // Gateway API addon. - // +kubebuilder:default:={} - GatewayAPI GatewayAPIAddon `json:"gatewayAPI"` - // NVIDIA GPU Operator. - // +kubebuilder:default:={} - GpuOperator GPUOperatorAddon `json:"gpuOperator"` - // HAMi GPU virtualization middleware. - // +kubebuilder:default:={} - Hami HAMiAddon `json:"hami"` - // Ingress-NGINX controller. - // +kubebuilder:default:={} - IngressNginx IngressNginxAddon `json:"ingressNginx"` - // Monitoring agents. - // +kubebuilder:default:={} - MonitoringAgents MonitoringAgentsAddon `json:"monitoringAgents"` - // Velero backup/restore addon. - // +kubebuilder:default:={} - Velero VeleroAddon `json:"velero"` - // Vertical Pod Autoscaler. - // +kubebuilder:default:={} - VerticalPodAutoscaler VerticalPodAutoscalerAddon `json:"verticalPodAutoscaler"` -} - -type CertManagerAddon struct { - // Enable cert-manager. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -type CiliumAddon struct { - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -type ControlPlane struct { - // API Server configuration. - // +kubebuilder:default:={} - ApiServer APIServer `json:"apiServer"` - // Controller Manager configuration. - // +kubebuilder:default:={} - ControllerManager ControllerManager `json:"controllerManager"` - // Konnectivity configuration. - // +kubebuilder:default:={} - Konnectivity Konnectivity `json:"konnectivity"` - // Number of control-plane replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Scheduler configuration. - // +kubebuilder:default:={} - Scheduler Scheduler `json:"scheduler"` -} - -type ControllerManager struct { - // CPU and memory resources for Controller Manager. - // +kubebuilder:default:={} - Resources Resources `json:"resources"` - // Preset if `resources` omitted. - // +kubebuilder:default:="micro" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` -} - -type CoreDNSAddon struct { - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -type FluxCDAddon struct { - // Enable FluxCD. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -type GPU struct { - // Name of GPU, such as "nvidia.com/AD102GL_L40S". - Name string `json:"name"` -} - -type GPUOperatorAddon struct { - // Enable GPU Operator. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -type GatewayAPIAddon struct { - // Enable Gateway API. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` -} - -type HAMiAddon struct { - // Enable HAMi (requires GPU Operator). - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -type Images struct { - // Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag. - // +kubebuilder:default:="" - WaitForKubeconfig string `json:"waitForKubeconfig,omitempty"` -} - -type IngressNginxAddon struct { - // Enable the controller (requires nodes labeled `ingress-nginx`). - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`. - // +kubebuilder:default:="Proxied" - ExposeMethod IngressNginxExposeMethod `json:"exposeMethod"` - // Domains routed to this tenant cluster when `exposeMethod` is `Proxied`. - // +kubebuilder:default:={} - Hosts []string `json:"hosts,omitempty"` - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -type Konnectivity struct { - // Konnectivity Server configuration. - // +kubebuilder:default:={} - Server KonnectivityServer `json:"server"` -} - -type KonnectivityServer struct { - // CPU and memory resources for Konnectivity. - // +kubebuilder:default:={} - Resources Resources `json:"resources"` - // Preset if `resources` omitted. - // +kubebuilder:default:="micro" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` -} - -type MonitoringAgentsAddon struct { - // Enable monitoring agents. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -type NodeGroup struct { - // Ephemeral storage size. - // +kubebuilder:default:="20Gi" - EphemeralStorage resource.Quantity `json:"ephemeralStorage"` - // List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM). - Gpus []GPU `json:"gpus,omitempty"` - // Virtual machine instance type. - // +kubebuilder:default:="u1.medium" - InstanceType string `json:"instanceType"` - // Maximum number of replicas. - // +kubebuilder:default:=10 - MaxReplicas int `json:"maxReplicas"` - // Minimum number of replicas. - // +kubebuilder:default:=0 - MinReplicas int `json:"minReplicas"` - // CPU and memory resources for each worker node. - Resources Resources `json:"resources"` - // List of node roles. - Roles []string `json:"roles,omitempty"` -} - -type Resources struct { - // CPU available. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type Scheduler struct { - // CPU and memory resources for Scheduler. - // +kubebuilder:default:={} - Resources Resources `json:"resources"` - // Preset if `resources` omitted. - // +kubebuilder:default:="micro" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` -} - -type VeleroAddon struct { - // Enable Velero. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -type VerticalPodAutoscalerAddon struct { - // Custom Helm values overrides. - // +kubebuilder:default:={} - ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"` -} - -// +kubebuilder:validation:Enum="Proxied";"LoadBalancer" -type IngressNginxExposeMethod string - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string - -// +kubebuilder:validation:Enum="v1.35";"v1.34";"v1.33";"v1.32";"v1.31";"v1.30" -type Version string diff --git a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go deleted file mode 100644 index e021fbaa..00000000 --- a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go +++ /dev/null @@ -1,455 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package kubernetes - -import ( - "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *APIServer) DeepCopyInto(out *APIServer) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIServer. -func (in *APIServer) DeepCopy() *APIServer { - if in == nil { - return nil - } - out := new(APIServer) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Addons) DeepCopyInto(out *Addons) { - *out = *in - in.CertManager.DeepCopyInto(&out.CertManager) - in.Cilium.DeepCopyInto(&out.Cilium) - in.Coredns.DeepCopyInto(&out.Coredns) - in.Fluxcd.DeepCopyInto(&out.Fluxcd) - out.GatewayAPI = in.GatewayAPI - in.GpuOperator.DeepCopyInto(&out.GpuOperator) - in.Hami.DeepCopyInto(&out.Hami) - in.IngressNginx.DeepCopyInto(&out.IngressNginx) - in.MonitoringAgents.DeepCopyInto(&out.MonitoringAgents) - in.Velero.DeepCopyInto(&out.Velero) - in.VerticalPodAutoscaler.DeepCopyInto(&out.VerticalPodAutoscaler) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Addons. -func (in *Addons) DeepCopy() *Addons { - if in == nil { - return nil - } - out := new(Addons) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CertManagerAddon) DeepCopyInto(out *CertManagerAddon) { - *out = *in - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertManagerAddon. -func (in *CertManagerAddon) DeepCopy() *CertManagerAddon { - if in == nil { - return nil - } - out := new(CertManagerAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CiliumAddon) DeepCopyInto(out *CiliumAddon) { - *out = *in - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CiliumAddon. -func (in *CiliumAddon) DeepCopy() *CiliumAddon { - if in == nil { - return nil - } - out := new(CiliumAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - if in.NodeGroups != nil { - in, out := &in.NodeGroups, &out.NodeGroups - *out = make(map[string]NodeGroup, len(*in)) - for key, val := range *in { - (*out)[key] = *val.DeepCopy() - } - } - in.Addons.DeepCopyInto(&out.Addons) - in.ControlPlane.DeepCopyInto(&out.ControlPlane) - out.Images = in.Images -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ControlPlane) DeepCopyInto(out *ControlPlane) { - *out = *in - in.ApiServer.DeepCopyInto(&out.ApiServer) - in.ControllerManager.DeepCopyInto(&out.ControllerManager) - in.Konnectivity.DeepCopyInto(&out.Konnectivity) - in.Scheduler.DeepCopyInto(&out.Scheduler) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControlPlane. -func (in *ControlPlane) DeepCopy() *ControlPlane { - if in == nil { - return nil - } - out := new(ControlPlane) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ControllerManager) DeepCopyInto(out *ControllerManager) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerManager. -func (in *ControllerManager) DeepCopy() *ControllerManager { - if in == nil { - return nil - } - out := new(ControllerManager) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CoreDNSAddon) DeepCopyInto(out *CoreDNSAddon) { - *out = *in - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CoreDNSAddon. -func (in *CoreDNSAddon) DeepCopy() *CoreDNSAddon { - if in == nil { - return nil - } - out := new(CoreDNSAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *FluxCDAddon) DeepCopyInto(out *FluxCDAddon) { - *out = *in - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FluxCDAddon. -func (in *FluxCDAddon) DeepCopy() *FluxCDAddon { - if in == nil { - return nil - } - out := new(FluxCDAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *GPU) DeepCopyInto(out *GPU) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GPU. -func (in *GPU) DeepCopy() *GPU { - if in == nil { - return nil - } - out := new(GPU) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *GPUOperatorAddon) DeepCopyInto(out *GPUOperatorAddon) { - *out = *in - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GPUOperatorAddon. -func (in *GPUOperatorAddon) DeepCopy() *GPUOperatorAddon { - if in == nil { - return nil - } - out := new(GPUOperatorAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *GatewayAPIAddon) DeepCopyInto(out *GatewayAPIAddon) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GatewayAPIAddon. -func (in *GatewayAPIAddon) DeepCopy() *GatewayAPIAddon { - if in == nil { - return nil - } - out := new(GatewayAPIAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *HAMiAddon) DeepCopyInto(out *HAMiAddon) { - *out = *in - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HAMiAddon. -func (in *HAMiAddon) DeepCopy() *HAMiAddon { - if in == nil { - return nil - } - out := new(HAMiAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Images) DeepCopyInto(out *Images) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Images. -func (in *Images) DeepCopy() *Images { - if in == nil { - return nil - } - out := new(Images) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *IngressNginxAddon) DeepCopyInto(out *IngressNginxAddon) { - *out = *in - if in.Hosts != nil { - in, out := &in.Hosts, &out.Hosts - *out = make([]string, len(*in)) - copy(*out, *in) - } - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNginxAddon. -func (in *IngressNginxAddon) DeepCopy() *IngressNginxAddon { - if in == nil { - return nil - } - out := new(IngressNginxAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Konnectivity) DeepCopyInto(out *Konnectivity) { - *out = *in - in.Server.DeepCopyInto(&out.Server) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Konnectivity. -func (in *Konnectivity) DeepCopy() *Konnectivity { - if in == nil { - return nil - } - out := new(Konnectivity) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *KonnectivityServer) DeepCopyInto(out *KonnectivityServer) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KonnectivityServer. -func (in *KonnectivityServer) DeepCopy() *KonnectivityServer { - if in == nil { - return nil - } - out := new(KonnectivityServer) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *MonitoringAgentsAddon) DeepCopyInto(out *MonitoringAgentsAddon) { - *out = *in - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MonitoringAgentsAddon. -func (in *MonitoringAgentsAddon) DeepCopy() *MonitoringAgentsAddon { - if in == nil { - return nil - } - out := new(MonitoringAgentsAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NodeGroup) DeepCopyInto(out *NodeGroup) { - *out = *in - out.EphemeralStorage = in.EphemeralStorage.DeepCopy() - if in.Gpus != nil { - in, out := &in.Gpus, &out.Gpus - *out = make([]GPU, len(*in)) - copy(*out, *in) - } - in.Resources.DeepCopyInto(&out.Resources) - if in.Roles != nil { - in, out := &in.Roles, &out.Roles - *out = make([]string, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeGroup. -func (in *NodeGroup) DeepCopy() *NodeGroup { - if in == nil { - return nil - } - out := new(NodeGroup) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Scheduler) DeepCopyInto(out *Scheduler) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Scheduler. -func (in *Scheduler) DeepCopy() *Scheduler { - if in == nil { - return nil - } - out := new(Scheduler) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *VeleroAddon) DeepCopyInto(out *VeleroAddon) { - *out = *in - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroAddon. -func (in *VeleroAddon) DeepCopy() *VeleroAddon { - if in == nil { - return nil - } - out := new(VeleroAddon) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *VerticalPodAutoscalerAddon) DeepCopyInto(out *VerticalPodAutoscalerAddon) { - *out = *in - in.ValuesOverride.DeepCopyInto(&out.ValuesOverride) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VerticalPodAutoscalerAddon. -func (in *VerticalPodAutoscalerAddon) DeepCopy() *VerticalPodAutoscalerAddon { - if in == nil { - return nil - } - out := new(VerticalPodAutoscalerAddon) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/mariadb/types.go b/api/apps/v1alpha1/mariadb/types.go deleted file mode 100644 index b3b6c414..00000000 --- a/api/apps/v1alpha1/mariadb/types.go +++ /dev/null @@ -1,109 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package mariadb - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of MariaDB replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume Claim size available for application data. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // MariaDB major.minor version to deploy - // +kubebuilder:default:="v11.8" - Version Version `json:"version"` - // Users configuration map. - // +kubebuilder:default:={} - Users map[string]User `json:"users,omitempty"` - // Databases configuration map. - // +kubebuilder:default:={} - Databases map[string]Database `json:"databases,omitempty"` - // Backup configuration. - // +kubebuilder:default:={} - Backup Backup `json:"backup"` -} - -type Backup struct { - // Retention strategy for cleaning up old backups. - // +kubebuilder:default:="--keep-last=3 --keep-daily=3 --keep-within-weekly=1m" - CleanupStrategy string `json:"cleanupStrategy"` - // Enable regular backups (default: false). - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Password for Restic backup encryption. - // +kubebuilder:default:="" - ResticPassword string `json:"resticPassword"` - // Access key for S3 authentication. - // +kubebuilder:default:="" - S3AccessKey string `json:"s3AccessKey"` - // S3 bucket used for storing backups. - // +kubebuilder:default:="s3.example.org/mariadb-backups" - S3Bucket string `json:"s3Bucket"` - // AWS S3 region where backups are stored. - // +kubebuilder:default:="us-east-1" - S3Region string `json:"s3Region"` - // Secret key for S3 authentication. - // +kubebuilder:default:="" - S3SecretKey string `json:"s3SecretKey"` - // Cron schedule for automated backups. - // +kubebuilder:default:="0 2 * * *" - Schedule string `json:"schedule"` -} - -type Database struct { - // Roles assigned to users. - Roles DatabaseRoles `json:"roles,omitempty"` -} - -type DatabaseRoles struct { - // List of users with admin privileges. - Admin []string `json:"admin,omitempty"` - // List of users with read-only privileges. - Readonly []string `json:"readonly,omitempty"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type User struct { - // Maximum number of connections. - MaxUserConnections int `json:"maxUserConnections"` - // Password for the user. - Password string `json:"password"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string - -// +kubebuilder:validation:Enum="v11.8";"v11.4";"v10.11";"v10.6" -type Version string diff --git a/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go b/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go deleted file mode 100644 index 4cc5a94f..00000000 --- a/api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go +++ /dev/null @@ -1,171 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package mariadb - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Backup) DeepCopyInto(out *Backup) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup. -func (in *Backup) DeepCopy() *Backup { - if in == nil { - return nil - } - out := new(Backup) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() - if in.Users != nil { - in, out := &in.Users, &out.Users - *out = make(map[string]User, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - if in.Databases != nil { - in, out := &in.Databases, &out.Databases - *out = make(map[string]Database, len(*in)) - for key, val := range *in { - (*out)[key] = *val.DeepCopy() - } - } - out.Backup = in.Backup -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Database) DeepCopyInto(out *Database) { - *out = *in - in.Roles.DeepCopyInto(&out.Roles) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database. -func (in *Database) DeepCopy() *Database { - if in == nil { - return nil - } - out := new(Database) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) { - *out = *in - if in.Admin != nil { - in, out := &in.Admin, &out.Admin - *out = make([]string, len(*in)) - copy(*out, *in) - } - if in.Readonly != nil { - in, out := &in.Readonly, &out.Readonly - *out = make([]string, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles. -func (in *DatabaseRoles) DeepCopy() *DatabaseRoles { - if in == nil { - return nil - } - out := new(DatabaseRoles) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *User) DeepCopyInto(out *User) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User. -func (in *User) DeepCopy() *User { - if in == nil { - return nil - } - out := new(User) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/mongodb/types.go b/api/apps/v1alpha1/mongodb/types.go deleted file mode 100644 index 886b716c..00000000 --- a/api/apps/v1alpha1/mongodb/types.go +++ /dev/null @@ -1,149 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package mongodb - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of MongoDB replicas in replica set. - // +kubebuilder:default:=3 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each MongoDB replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="small" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume Claim size available for application data. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // MongoDB major version to deploy. - // +kubebuilder:default:="v8" - Version Version `json:"version"` - // Enable sharded cluster mode. When disabled, deploys a replica set. - // +kubebuilder:default:=false - Sharding bool `json:"sharding"` - // Configuration for sharded cluster mode. - // +kubebuilder:default:={} - ShardingConfig ShardingConfig `json:"shardingConfig"` - // Users configuration map. - // +kubebuilder:default:={} - Users map[string]User `json:"users,omitempty"` - // Databases configuration map. - // +kubebuilder:default:={} - Databases map[string]Database `json:"databases,omitempty"` - // Backup configuration. - // +kubebuilder:default:={} - Backup Backup `json:"backup"` - // Bootstrap configuration. - // +kubebuilder:default:={} - Bootstrap Bootstrap `json:"bootstrap"` -} - -type Backup struct { - // Destination path for backups (e.g. s3://bucket/path/). - // +kubebuilder:default:="s3://bucket/path/to/folder/" - DestinationPath string `json:"destinationPath,omitempty"` - // Enable regular backups. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // S3 endpoint URL for uploads. - // +kubebuilder:default:="http://minio-gateway-service:9000" - EndpointURL string `json:"endpointURL,omitempty"` - // Retention policy (e.g. "30d"). - // +kubebuilder:default:="30d" - RetentionPolicy string `json:"retentionPolicy,omitempty"` - // Access key for S3 authentication. - // +kubebuilder:default:="" - S3AccessKey string `json:"s3AccessKey,omitempty"` - // Secret key for S3 authentication. - // +kubebuilder:default:="" - S3SecretKey string `json:"s3SecretKey,omitempty"` - // Cron schedule for automated backups. - // +kubebuilder:default:="0 2 * * *" - Schedule string `json:"schedule,omitempty"` -} - -type Bootstrap struct { - // Name of backup to restore from. - // +kubebuilder:default:="" - BackupName string `json:"backupName"` - // Whether to restore from a backup. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Timestamp for point-in-time recovery; empty means latest. - // +kubebuilder:default:="" - RecoveryTime string `json:"recoveryTime,omitempty"` -} - -type Database struct { - // Roles assigned to users. - Roles DatabaseRoles `json:"roles,omitempty"` -} - -type DatabaseRoles struct { - // List of users with admin privileges (readWrite + dbAdmin). - Admin []string `json:"admin,omitempty"` - // List of users with read-only privileges. - Readonly []string `json:"readonly,omitempty"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type Shard struct { - // Shard name. - Name string `json:"name"` - // Number of replicas in this shard. - Replicas int `json:"replicas"` - // PVC size for this shard. - Size resource.Quantity `json:"size"` -} - -type ShardingConfig struct { - // PVC size for config servers. - // +kubebuilder:default:="3Gi" - ConfigServerSize resource.Quantity `json:"configServerSize"` - // Number of config server replicas. - // +kubebuilder:default:=3 - ConfigServers int `json:"configServers"` - // Number of mongos router replicas. - // +kubebuilder:default:=2 - Mongos int `json:"mongos"` - // List of shard configurations. - // +kubebuilder:default:={{"name":"rs0","replicas":3,"size":"10Gi"}} - Shards []Shard `json:"shards,omitempty"` -} - -type User struct { - // Password for the user (auto-generated if omitted). - Password string `json:"password,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string - -// +kubebuilder:validation:Enum="v8";"v7";"v6" -type Version string diff --git a/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go b/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go deleted file mode 100644 index 694009f4..00000000 --- a/api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go +++ /dev/null @@ -1,227 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package mongodb - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Backup) DeepCopyInto(out *Backup) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup. -func (in *Backup) DeepCopy() *Backup { - if in == nil { - return nil - } - out := new(Backup) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Bootstrap) DeepCopyInto(out *Bootstrap) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Bootstrap. -func (in *Bootstrap) DeepCopy() *Bootstrap { - if in == nil { - return nil - } - out := new(Bootstrap) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() - in.ShardingConfig.DeepCopyInto(&out.ShardingConfig) - if in.Users != nil { - in, out := &in.Users, &out.Users - *out = make(map[string]User, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - if in.Databases != nil { - in, out := &in.Databases, &out.Databases - *out = make(map[string]Database, len(*in)) - for key, val := range *in { - (*out)[key] = *val.DeepCopy() - } - } - out.Backup = in.Backup - out.Bootstrap = in.Bootstrap -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Database) DeepCopyInto(out *Database) { - *out = *in - in.Roles.DeepCopyInto(&out.Roles) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database. -func (in *Database) DeepCopy() *Database { - if in == nil { - return nil - } - out := new(Database) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) { - *out = *in - if in.Admin != nil { - in, out := &in.Admin, &out.Admin - *out = make([]string, len(*in)) - copy(*out, *in) - } - if in.Readonly != nil { - in, out := &in.Readonly, &out.Readonly - *out = make([]string, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles. -func (in *DatabaseRoles) DeepCopy() *DatabaseRoles { - if in == nil { - return nil - } - out := new(DatabaseRoles) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Shard) DeepCopyInto(out *Shard) { - *out = *in - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Shard. -func (in *Shard) DeepCopy() *Shard { - if in == nil { - return nil - } - out := new(Shard) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ShardingConfig) DeepCopyInto(out *ShardingConfig) { - *out = *in - out.ConfigServerSize = in.ConfigServerSize.DeepCopy() - if in.Shards != nil { - in, out := &in.Shards, &out.Shards - *out = make([]Shard, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShardingConfig. -func (in *ShardingConfig) DeepCopy() *ShardingConfig { - if in == nil { - return nil - } - out := new(ShardingConfig) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *User) DeepCopyInto(out *User) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User. -func (in *User) DeepCopy() *User { - if in == nil { - return nil - } - out := new(User) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/nats/types.go b/api/apps/v1alpha1/nats/types.go deleted file mode 100644 index 5437355d..00000000 --- a/api/apps/v1alpha1/nats/types.go +++ /dev/null @@ -1,78 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package nats - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" - k8sRuntime "k8s.io/apimachinery/pkg/runtime" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each NATS replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // Users configuration map. - // +kubebuilder:default:={} - Users map[string]User `json:"users,omitempty"` - // Jetstream configuration. - // +kubebuilder:default:={} - Jetstream Jetstream `json:"jetstream"` - // NATS configuration. - // +kubebuilder:default:={} - Config ValuesConfig `json:"config"` -} - -type ValuesConfig struct { - // Additional configuration to merge into NATS config. - // +kubebuilder:default:={} - Merge *k8sRuntime.RawExtension `json:"merge,omitempty"` - // Additional resolver configuration to merge into NATS config. - // +kubebuilder:default:={} - Resolver *k8sRuntime.RawExtension `json:"resolver,omitempty"` -} - -type Jetstream struct { - // Enable or disable Jetstream for persistent messaging in NATS. - // +kubebuilder:default:=true - Enabled bool `json:"enabled"` - // Jetstream persistent storage size. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type User struct { - // Password for the user. - Password string `json:"password,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/nats/zz_generated.deepcopy.go b/api/apps/v1alpha1/nats/zz_generated.deepcopy.go deleted file mode 100644 index f6c23cb1..00000000 --- a/api/apps/v1alpha1/nats/zz_generated.deepcopy.go +++ /dev/null @@ -1,149 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package nats - -import ( - "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - if in.Users != nil { - in, out := &in.Users, &out.Users - *out = make(map[string]User, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - in.Jetstream.DeepCopyInto(&out.Jetstream) - in.Config.DeepCopyInto(&out.Config) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Jetstream) DeepCopyInto(out *Jetstream) { - *out = *in - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Jetstream. -func (in *Jetstream) DeepCopy() *Jetstream { - if in == nil { - return nil - } - out := new(Jetstream) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *User) DeepCopyInto(out *User) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User. -func (in *User) DeepCopy() *User { - if in == nil { - return nil - } - out := new(User) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ValuesConfig) DeepCopyInto(out *ValuesConfig) { - *out = *in - if in.Merge != nil { - in, out := &in.Merge, &out.Merge - *out = new(runtime.RawExtension) - (*in).DeepCopyInto(*out) - } - if in.Resolver != nil { - in, out := &in.Resolver, &out.Resolver - *out = new(runtime.RawExtension) - (*in).DeepCopyInto(*out) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValuesConfig. -func (in *ValuesConfig) DeepCopy() *ValuesConfig { - if in == nil { - return nil - } - out := new(ValuesConfig) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/openbao/types.go b/api/apps/v1alpha1/openbao/types.go deleted file mode 100644 index bb5d12d9..00000000 --- a/api/apps/v1alpha1/openbao/types.go +++ /dev/null @@ -1,51 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package openbao - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration. - // +kubebuilder:default:=1 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="small" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume Claim size for data storage. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // Enable the OpenBAO web UI. - // +kubebuilder:default:=true - Ui bool `json:"ui"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go b/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go deleted file mode 100644 index baa1258b..00000000 --- a/api/apps/v1alpha1/openbao/zz_generated.deepcopy.go +++ /dev/null @@ -1,85 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package openbao - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/opensearch/types.go b/api/apps/v1alpha1/opensearch/types.go deleted file mode 100644 index b188cdfa..00000000 --- a/api/apps/v1alpha1/opensearch/types.go +++ /dev/null @@ -1,115 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package opensearch - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of OpenSearch nodes in the cluster. - // +kubebuilder:default:=3 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory. - // +kubebuilder:default:="large" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume Claim size available for application data. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // How strictly to enforce pod distribution across nodes and zones. - // +kubebuilder:default:="soft" - TopologySpreadPolicy TopologySpreadPolicy `json:"topologySpreadPolicy"` - // OpenSearch major version to deploy. - // +kubebuilder:default:="v2" - Version Version `json:"version"` - // Container images used by the operator. - // +kubebuilder:default:={} - Images Images `json:"images"` - // Node roles configuration. - // +kubebuilder:default:={} - NodeRoles NodeRoles `json:"nodeRoles"` - // Custom OpenSearch users configuration map. - // +kubebuilder:default:={} - Users map[string]User `json:"users,omitempty"` - // OpenSearch Dashboards configuration. - // +kubebuilder:default:={} - Dashboards Dashboards `json:"dashboards"` -} - -type Dashboards struct { - // Enable OpenSearch Dashboards deployment. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Number of Dashboards replicas. - // +kubebuilder:default:=1 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for Dashboards. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset for Dashboards. - // +kubebuilder:default:="medium" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` -} - -type Images struct { - // OpenSearch image. - // +kubebuilder:default:="" - Opensearch string `json:"opensearch"` -} - -type NodeRoles struct { - // Enable data role. - // +kubebuilder:default:=true - Data bool `json:"data"` - // Enable ingest role. - // +kubebuilder:default:=true - Ingest bool `json:"ingest"` - // Enable cluster_manager role. - // +kubebuilder:default:=true - Master bool `json:"master"` - // Enable machine learning role. - // +kubebuilder:default:=false - Ml bool `json:"ml"` -} - -type Resources struct { - // CPU available to each node. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each node. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type User struct { - // Password for the user (auto-generated if omitted). - Password string `json:"password,omitempty"` - // List of OpenSearch roles. - Roles []string `json:"roles,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string - -// +kubebuilder:validation:Enum="soft";"hard" -type TopologySpreadPolicy string - -// +kubebuilder:validation:Enum="v3";"v2";"v1" -type Version string diff --git a/api/apps/v1alpha1/opensearch/zz_generated.deepcopy.go b/api/apps/v1alpha1/opensearch/zz_generated.deepcopy.go deleted file mode 100644 index f7f2daef..00000000 --- a/api/apps/v1alpha1/opensearch/zz_generated.deepcopy.go +++ /dev/null @@ -1,161 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package opensearch - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() - out.Images = in.Images - out.NodeRoles = in.NodeRoles - if in.Users != nil { - in, out := &in.Users, &out.Users - *out = make(map[string]User, len(*in)) - for key, val := range *in { - (*out)[key] = *val.DeepCopy() - } - } - in.Dashboards.DeepCopyInto(&out.Dashboards) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Dashboards) DeepCopyInto(out *Dashboards) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Dashboards. -func (in *Dashboards) DeepCopy() *Dashboards { - if in == nil { - return nil - } - out := new(Dashboards) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Images) DeepCopyInto(out *Images) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Images. -func (in *Images) DeepCopy() *Images { - if in == nil { - return nil - } - out := new(Images) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NodeRoles) DeepCopyInto(out *NodeRoles) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeRoles. -func (in *NodeRoles) DeepCopy() *NodeRoles { - if in == nil { - return nil - } - out := new(NodeRoles) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *User) DeepCopyInto(out *User) { - *out = *in - if in.Roles != nil { - in, out := &in.Roles, &out.Roles - *out = make([]string, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User. -func (in *User) DeepCopy() *User { - if in == nil { - return nil - } - out := new(User) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/postgresql/types.go b/api/apps/v1alpha1/postgresql/types.go deleted file mode 100644 index a2ff77a8..00000000 --- a/api/apps/v1alpha1/postgresql/types.go +++ /dev/null @@ -1,153 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package postgresql - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of Postgres replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="micro" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume Claim size available for application data. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // PostgreSQL major version to deploy - // +kubebuilder:default:="v18" - Version Version `json:"version"` - // PostgreSQL server configuration. - // +kubebuilder:default:={} - Postgresql PostgreSQL `json:"postgresql"` - // Quorum configuration for synchronous replication. - // +kubebuilder:default:={} - Quorum Quorum `json:"quorum"` - // Users configuration map. - // +kubebuilder:default:={} - Users map[string]User `json:"users,omitempty"` - // Databases configuration map. - // +kubebuilder:default:={} - Databases map[string]Database `json:"databases,omitempty"` - // Backup configuration. - // +kubebuilder:default:={} - Backup Backup `json:"backup"` - // Bootstrap configuration. - // +kubebuilder:default:={} - Bootstrap Bootstrap `json:"bootstrap"` -} - -type Backup struct { - // Destination path for backups (e.g. s3://bucket/path/). - // +kubebuilder:default:="s3://bucket/path/to/folder/" - DestinationPath string `json:"destinationPath,omitempty"` - // Enable regular backups. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // S3 endpoint URL for uploads. - // +kubebuilder:default:="http://minio-gateway-service:9000" - EndpointURL string `json:"endpointURL,omitempty"` - // Retention policy (e.g. "30d"). - // +kubebuilder:default:="30d" - RetentionPolicy string `json:"retentionPolicy,omitempty"` - // Access key for S3 authentication. - // +kubebuilder:default:="" - S3AccessKey string `json:"s3AccessKey,omitempty"` - // Secret key for S3 authentication. - // +kubebuilder:default:="" - S3SecretKey string `json:"s3SecretKey,omitempty"` - // Cron schedule for automated backups. - // +kubebuilder:default:="0 2 * * * *" - Schedule string `json:"schedule,omitempty"` -} - -type Bootstrap struct { - // Whether to restore from a backup. - // +kubebuilder:default:=false - Enabled bool `json:"enabled"` - // Previous cluster name before deletion. - // +kubebuilder:default:="" - OldName string `json:"oldName"` - // Timestamp (RFC3339) for point-in-time recovery; empty means latest. - // +kubebuilder:default:="" - RecoveryTime string `json:"recoveryTime,omitempty"` - // Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name. - // +kubebuilder:default:="" - ServerName string `json:"serverName,omitempty"` -} - -type Database struct { - // List of enabled PostgreSQL extensions. - Extensions []string `json:"extensions,omitempty"` - // Roles assigned to users. - Roles DatabaseRoles `json:"roles,omitempty"` -} - -type DatabaseRoles struct { - // List of users with admin privileges. - Admin []string `json:"admin,omitempty"` - // List of users with read-only privileges. - Readonly []string `json:"readonly,omitempty"` -} - -type PostgreSQL struct { - // PostgreSQL server parameters. - // +kubebuilder:default:={} - Parameters PostgreSQLParameters `json:"parameters,omitempty"` -} - -type PostgreSQLParameters struct { - // Maximum number of concurrent connections to the database server. - // +kubebuilder:default:=100 - MaxConnections int `json:"max_connections,omitempty"` -} - -type Quorum struct { - // Maximum number of synchronous replicas allowed (must be less than total replicas). - // +kubebuilder:default:=0 - MaxSyncReplicas int `json:"maxSyncReplicas"` - // Minimum number of synchronous replicas required for commit. - // +kubebuilder:default:=0 - MinSyncReplicas int `json:"minSyncReplicas"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type User struct { - // Password for the user. - Password string `json:"password,omitempty"` - // Whether the user has replication privileges. - Replication bool `json:"replication,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string - -// +kubebuilder:validation:Enum="v18";"v17";"v16";"v15";"v14";"v13" -type Version string diff --git a/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go b/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go deleted file mode 100644 index 5fba855e..00000000 --- a/api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go +++ /dev/null @@ -1,240 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package postgresql - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Backup) DeepCopyInto(out *Backup) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup. -func (in *Backup) DeepCopy() *Backup { - if in == nil { - return nil - } - out := new(Backup) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Bootstrap) DeepCopyInto(out *Bootstrap) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Bootstrap. -func (in *Bootstrap) DeepCopy() *Bootstrap { - if in == nil { - return nil - } - out := new(Bootstrap) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() - out.Postgresql = in.Postgresql - out.Quorum = in.Quorum - if in.Users != nil { - in, out := &in.Users, &out.Users - *out = make(map[string]User, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - if in.Databases != nil { - in, out := &in.Databases, &out.Databases - *out = make(map[string]Database, len(*in)) - for key, val := range *in { - (*out)[key] = *val.DeepCopy() - } - } - out.Backup = in.Backup - out.Bootstrap = in.Bootstrap -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Database) DeepCopyInto(out *Database) { - *out = *in - if in.Extensions != nil { - in, out := &in.Extensions, &out.Extensions - *out = make([]string, len(*in)) - copy(*out, *in) - } - in.Roles.DeepCopyInto(&out.Roles) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database. -func (in *Database) DeepCopy() *Database { - if in == nil { - return nil - } - out := new(Database) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) { - *out = *in - if in.Admin != nil { - in, out := &in.Admin, &out.Admin - *out = make([]string, len(*in)) - copy(*out, *in) - } - if in.Readonly != nil { - in, out := &in.Readonly, &out.Readonly - *out = make([]string, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles. -func (in *DatabaseRoles) DeepCopy() *DatabaseRoles { - if in == nil { - return nil - } - out := new(DatabaseRoles) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PostgreSQL) DeepCopyInto(out *PostgreSQL) { - *out = *in - out.Parameters = in.Parameters -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgreSQL. -func (in *PostgreSQL) DeepCopy() *PostgreSQL { - if in == nil { - return nil - } - out := new(PostgreSQL) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PostgreSQLParameters) DeepCopyInto(out *PostgreSQLParameters) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgreSQLParameters. -func (in *PostgreSQLParameters) DeepCopy() *PostgreSQLParameters { - if in == nil { - return nil - } - out := new(PostgreSQLParameters) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Quorum) DeepCopyInto(out *Quorum) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Quorum. -func (in *Quorum) DeepCopy() *Quorum { - if in == nil { - return nil - } - out := new(Quorum) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *User) DeepCopyInto(out *User) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User. -func (in *User) DeepCopy() *User { - if in == nil { - return nil - } - out := new(User) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/qdrant/types.go b/api/apps/v1alpha1/qdrant/types.go deleted file mode 100644 index 203e9a97..00000000 --- a/api/apps/v1alpha1/qdrant/types.go +++ /dev/null @@ -1,48 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package qdrant - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of Qdrant replicas. Cluster mode is automatically enabled when replicas > 1. - // +kubebuilder:default:=1 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each Qdrant replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="small" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume Claim size available for vector data storage. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go b/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go deleted file mode 100644 index 2abfd37e..00000000 --- a/api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go +++ /dev/null @@ -1,85 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package qdrant - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/rabbitmq/types.go b/api/apps/v1alpha1/rabbitmq/types.go deleted file mode 100644 index f67c4402..00000000 --- a/api/apps/v1alpha1/rabbitmq/types.go +++ /dev/null @@ -1,77 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package rabbitmq - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of RabbitMQ replicas. - // +kubebuilder:default:=3 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume Claim size available for application data. - // +kubebuilder:default:="10Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // RabbitMQ major.minor version to deploy - // +kubebuilder:default:="v4.2" - Version Version `json:"version"` - // Users configuration map. - // +kubebuilder:default:={} - Users map[string]User `json:"users,omitempty"` - // Virtual hosts configuration map. - // +kubebuilder:default:={} - Vhosts map[string]Vhost `json:"vhosts,omitempty"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type Roles struct { - // List of admin users. - Admin []string `json:"admin,omitempty"` - // List of readonly users. - Readonly []string `json:"readonly,omitempty"` -} - -type User struct { - // Password for the user. - Password string `json:"password,omitempty"` -} - -type Vhost struct { - // Virtual host roles list. - Roles Roles `json:"roles"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string - -// +kubebuilder:validation:Enum="v4.2";"v4.1";"v4.0";"v3.13" -type Version string diff --git a/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go b/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go deleted file mode 100644 index a1d55f89..00000000 --- a/api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go +++ /dev/null @@ -1,155 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package rabbitmq - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() - if in.Users != nil { - in, out := &in.Users, &out.Users - *out = make(map[string]User, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - if in.Vhosts != nil { - in, out := &in.Vhosts, &out.Vhosts - *out = make(map[string]Vhost, len(*in)) - for key, val := range *in { - (*out)[key] = *val.DeepCopy() - } - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Roles) DeepCopyInto(out *Roles) { - *out = *in - if in.Admin != nil { - in, out := &in.Admin, &out.Admin - *out = make([]string, len(*in)) - copy(*out, *in) - } - if in.Readonly != nil { - in, out := &in.Readonly, &out.Readonly - *out = make([]string, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Roles. -func (in *Roles) DeepCopy() *Roles { - if in == nil { - return nil - } - out := new(Roles) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *User) DeepCopyInto(out *User) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User. -func (in *User) DeepCopy() *User { - if in == nil { - return nil - } - out := new(User) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Vhost) DeepCopyInto(out *Vhost) { - *out = *in - in.Roles.DeepCopyInto(&out.Roles) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Vhost. -func (in *Vhost) DeepCopy() *Vhost { - if in == nil { - return nil - } - out := new(Vhost) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/redis/types.go b/api/apps/v1alpha1/redis/types.go deleted file mode 100644 index e9a02c72..00000000 --- a/api/apps/v1alpha1/redis/types.go +++ /dev/null @@ -1,57 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package redis - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of Redis replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each Redis replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Persistent Volume Claim size available for application data. - // +kubebuilder:default:="1Gi" - Size resource.Quantity `json:"size"` - // StorageClass used to store the data. - // +kubebuilder:default:="" - StorageClass string `json:"storageClass"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // Redis major version to deploy - // +kubebuilder:default:="v8" - Version Version `json:"version"` - // Enable password generation. - // +kubebuilder:default:=true - AuthEnabled bool `json:"authEnabled"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string - -// +kubebuilder:validation:Enum="v8";"v7" -type Version string diff --git a/api/apps/v1alpha1/redis/zz_generated.deepcopy.go b/api/apps/v1alpha1/redis/zz_generated.deepcopy.go deleted file mode 100644 index 6390200c..00000000 --- a/api/apps/v1alpha1/redis/zz_generated.deepcopy.go +++ /dev/null @@ -1,85 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package redis - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - out.Size = in.Size.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/tcpbalancer/types.go b/api/apps/v1alpha1/tcpbalancer/types.go deleted file mode 100644 index aa99cd6d..00000000 --- a/api/apps/v1alpha1/tcpbalancer/types.go +++ /dev/null @@ -1,75 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package tcpbalancer - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of HAProxy replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // HTTP and HTTPS configuration. - // +kubebuilder:default:={} - HttpAndHttps HttpAndHttps `json:"httpAndHttps"` - // Secure HTTP by whitelisting client networks (default: false). - // +kubebuilder:default:=false - WhitelistHTTP bool `json:"whitelistHTTP"` - // List of allowed client networks. - // +kubebuilder:default:={} - Whitelist []string `json:"whitelist,omitempty"` -} - -type HttpAndHttps struct { - // Endpoint addresses list. - // +kubebuilder:default:={} - Endpoints []string `json:"endpoints,omitempty"` - // Mode for balancer. - // +kubebuilder:default:="tcp" - Mode Mode `json:"mode"` - // Target ports configuration. - // +kubebuilder:default:={} - TargetPorts TargetPorts `json:"targetPorts"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type TargetPorts struct { - // HTTP port number. - // +kubebuilder:default:=80 - Http int `json:"http"` - // HTTPS port number. - // +kubebuilder:default:=443 - Https int `json:"https"` -} - -// +kubebuilder:validation:Enum="tcp";"tcp-with-proxy" -type Mode string - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go b/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go deleted file mode 100644 index 1c63eafc..00000000 --- a/api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go +++ /dev/null @@ -1,126 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package tcpbalancer - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - in.HttpAndHttps.DeepCopyInto(&out.HttpAndHttps) - if in.Whitelist != nil { - in, out := &in.Whitelist, &out.Whitelist - *out = make([]string, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *HttpAndHttps) DeepCopyInto(out *HttpAndHttps) { - *out = *in - if in.Endpoints != nil { - in, out := &in.Endpoints, &out.Endpoints - *out = make([]string, len(*in)) - copy(*out, *in) - } - out.TargetPorts = in.TargetPorts -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HttpAndHttps. -func (in *HttpAndHttps) DeepCopy() *HttpAndHttps { - if in == nil { - return nil - } - out := new(HttpAndHttps) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *TargetPorts) DeepCopyInto(out *TargetPorts) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TargetPorts. -func (in *TargetPorts) DeepCopy() *TargetPorts { - if in == nil { - return nil - } - out := new(TargetPorts) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/tenant/types.go b/api/apps/v1alpha1/tenant/types.go deleted file mode 100644 index 60f8bb22..00000000 --- a/api/apps/v1alpha1/tenant/types.go +++ /dev/null @@ -1,41 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package tenant - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host). - // +kubebuilder:default:="" - Host string `json:"host,omitempty"` - // Deploy own Etcd cluster. - // +kubebuilder:default:=false - Etcd bool `json:"etcd"` - // Deploy own Monitoring Stack. - // +kubebuilder:default:=false - Monitoring bool `json:"monitoring"` - // Deploy own Ingress Controller. - // +kubebuilder:default:=false - Ingress bool `json:"ingress"` - // Deploy own SeaweedFS. - // +kubebuilder:default:=false - Seaweedfs bool `json:"seaweedfs"` - // The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads. - // +kubebuilder:default:="" - SchedulingClass string `json:"schedulingClass,omitempty"` - // Define resource quotas for the tenant. - // +kubebuilder:default:={} - ResourceQuotas map[string]resource.Quantity `json:"resourceQuotas,omitempty"` -} diff --git a/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go b/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go deleted file mode 100644 index 784a8f25..00000000 --- a/api/apps/v1alpha1/tenant/zz_generated.deepcopy.go +++ /dev/null @@ -1,74 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package tenant - -import ( - "k8s.io/apimachinery/pkg/api/resource" - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - if in.ResourceQuotas != nil { - in, out := &in.ResourceQuotas, &out.ResourceQuotas - *out = make(map[string]resource.Quantity, len(*in)) - for key, val := range *in { - (*out)[key] = val.DeepCopy() - } - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/vmdisk/types.go b/api/apps/v1alpha1/vmdisk/types.go deleted file mode 100644 index c493f49c..00000000 --- a/api/apps/v1alpha1/vmdisk/types.go +++ /dev/null @@ -1,61 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package vmdisk - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // The source image location used to create a disk. - // +kubebuilder:default:={} - Source Source `json:"source"` - // Defines if disk should be considered optical. - // +kubebuilder:default:=false - Optical bool `json:"optical"` - // The size of the disk allocated for the virtual machine. - // +kubebuilder:default:="5Gi" - Storage resource.Quantity `json:"storage"` - // StorageClass used to store the data. - // +kubebuilder:default:="replicated" - StorageClass string `json:"storageClass"` -} - -type Source struct { - // Clone an existing vm-disk. - Disk *SourceDisk `json:"disk,omitempty"` - // Download image from an HTTP source. - Http *SourceHTTP `json:"http,omitempty"` - // Use image by name from default collection. - Image *SourceImage `json:"image,omitempty"` - // Upload local image. - Upload *SourceUpload `json:"upload,omitempty"` -} - -type SourceDisk struct { - // Name of the vm-disk to clone. - Name string `json:"name"` -} - -type SourceHTTP struct { - // URL to download the image. - Url string `json:"url"` -} - -type SourceImage struct { - // Name of the image to use. - Name string `json:"name"` -} - -type SourceUpload struct { -} diff --git a/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go b/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go deleted file mode 100644 index 301bb1d9..00000000 --- a/api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go +++ /dev/null @@ -1,163 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package vmdisk - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Source.DeepCopyInto(&out.Source) - out.Storage = in.Storage.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Source) DeepCopyInto(out *Source) { - *out = *in - if in.Disk != nil { - in, out := &in.Disk, &out.Disk - *out = new(SourceDisk) - **out = **in - } - if in.Http != nil { - in, out := &in.Http, &out.Http - *out = new(SourceHTTP) - **out = **in - } - if in.Image != nil { - in, out := &in.Image, &out.Image - *out = new(SourceImage) - **out = **in - } - if in.Upload != nil { - in, out := &in.Upload, &out.Upload - *out = new(SourceUpload) - **out = **in - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Source. -func (in *Source) DeepCopy() *Source { - if in == nil { - return nil - } - out := new(Source) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *SourceDisk) DeepCopyInto(out *SourceDisk) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceDisk. -func (in *SourceDisk) DeepCopy() *SourceDisk { - if in == nil { - return nil - } - out := new(SourceDisk) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *SourceHTTP) DeepCopyInto(out *SourceHTTP) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceHTTP. -func (in *SourceHTTP) DeepCopy() *SourceHTTP { - if in == nil { - return nil - } - out := new(SourceHTTP) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *SourceImage) DeepCopyInto(out *SourceImage) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceImage. -func (in *SourceImage) DeepCopy() *SourceImage { - if in == nil { - return nil - } - out := new(SourceImage) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *SourceUpload) DeepCopyInto(out *SourceUpload) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceUpload. -func (in *SourceUpload) DeepCopy() *SourceUpload { - if in == nil { - return nil - } - out := new(SourceUpload) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/vminstance/types.go b/api/apps/v1alpha1/vminstance/types.go deleted file mode 100644 index 9c48724a..00000000 --- a/api/apps/v1alpha1/vminstance/types.go +++ /dev/null @@ -1,100 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package vminstance - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // Method to pass through traffic to the VM. - // +kubebuilder:default:="PortList" - ExternalMethod ExternalMethod `json:"externalMethod"` - // Ports to forward from outside the cluster. - // +kubebuilder:default:={22} - ExternalPorts []int `json:"externalPorts,omitempty"` - // Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect. - // +kubebuilder:default:=true - ExternalAllowICMP bool `json:"externalAllowICMP"` - // Requested running state of the VirtualMachineInstance - // +kubebuilder:default:="Always" - RunStrategy RunStrategy `json:"runStrategy"` - // Virtual Machine instance type. - // +kubebuilder:default:="u1.medium" - InstanceType string `json:"instanceType"` - // Virtual Machine preferences profile. - // +kubebuilder:default:="ubuntu" - InstanceProfile string `json:"instanceProfile"` - // List of disks to attach. - // +kubebuilder:default:={} - Disks []Disk `json:"disks,omitempty"` - // Networks to attach the VM to. - // +kubebuilder:default:={} - Networks []Network `json:"networks,omitempty"` - // Deprecated: use networks instead. - // +kubebuilder:default:={} - Subnets []Network `json:"subnets,omitempty"` - // List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM). - // +kubebuilder:default:={} - Gpus []GPU `json:"gpus,omitempty"` - // Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map - // +kubebuilder:default:="" - CpuModel string `json:"cpuModel"` - // Resource configuration for the virtual machine. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // List of SSH public keys for authentication. - // +kubebuilder:default:={} - SshKeys []string `json:"sshKeys,omitempty"` - // Cloud-init user data. - // +kubebuilder:default:="" - CloudInit string `json:"cloudInit"` - // Seed string to generate SMBIOS UUID for the VM. - // +kubebuilder:default:="" - CloudInitSeed string `json:"cloudInitSeed"` -} - -type Disk struct { - // Disk bus type (e.g. "sata"). - Bus string `json:"bus,omitempty"` - // Disk name. - Name string `json:"name"` -} - -type GPU struct { - // The name of the GPU resource to attach. - Name string `json:"name"` -} - -type Network struct { - // Network attachment name. - Name string `json:"name,omitempty"` -} - -type Resources struct { - // Number of CPU cores allocated. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Amount of memory allocated. - Memory resource.Quantity `json:"memory,omitempty"` - // Number of CPU sockets (vCPU topology). - Sockets resource.Quantity `json:"sockets,omitempty"` -} - -// +kubebuilder:validation:Enum="PortList";"WholeIP" -type ExternalMethod string - -// +kubebuilder:validation:Enum="Always";"Halted";"Manual";"RerunOnFailure";"Once" -type RunStrategy string diff --git a/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go b/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go deleted file mode 100644 index 86d5ddfc..00000000 --- a/api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go +++ /dev/null @@ -1,160 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package vminstance - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - if in.ExternalPorts != nil { - in, out := &in.ExternalPorts, &out.ExternalPorts - *out = make([]int, len(*in)) - copy(*out, *in) - } - if in.Disks != nil { - in, out := &in.Disks, &out.Disks - *out = make([]Disk, len(*in)) - copy(*out, *in) - } - if in.Networks != nil { - in, out := &in.Networks, &out.Networks - *out = make([]Network, len(*in)) - copy(*out, *in) - } - if in.Subnets != nil { - in, out := &in.Subnets, &out.Subnets - *out = make([]Network, len(*in)) - copy(*out, *in) - } - if in.Gpus != nil { - in, out := &in.Gpus, &out.Gpus - *out = make([]GPU, len(*in)) - copy(*out, *in) - } - in.Resources.DeepCopyInto(&out.Resources) - if in.SshKeys != nil { - in, out := &in.SshKeys, &out.SshKeys - *out = make([]string, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Disk) DeepCopyInto(out *Disk) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Disk. -func (in *Disk) DeepCopy() *Disk { - if in == nil { - return nil - } - out := new(Disk) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *GPU) DeepCopyInto(out *GPU) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GPU. -func (in *GPU) DeepCopy() *GPU { - if in == nil { - return nil - } - out := new(GPU) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Network) DeepCopyInto(out *Network) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Network. -func (in *Network) DeepCopy() *Network { - if in == nil { - return nil - } - out := new(Network) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() - out.Sockets = in.Sockets.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/vpc/types.go b/api/apps/v1alpha1/vpc/types.go deleted file mode 100644 index fed72f58..00000000 --- a/api/apps/v1alpha1/vpc/types.go +++ /dev/null @@ -1,49 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package vpc - -import ( - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Subnets of a VPC - // +kubebuilder:default:={} - Subnets []Subnet `json:"subnets,omitempty"` - // VPC peering connections (bidirectional declaration required) - // +kubebuilder:default:={} - Peers []Peer `json:"peers,omitempty"` - // Static routes for the VPC - // +kubebuilder:default:={} - Routes []Route `json:"routes,omitempty"` -} - -type Peer struct { - // Namespace of the remote tenant - TenantNamespace string `json:"tenantNamespace"` - // Logical name of the remote VPC (without "virtualprivatecloud-" prefix) - VpcName string `json:"vpcName"` -} - -type Route struct { - // Destination CIDR - Cidr string `json:"cidr"` - // Next hop IP address - NextHopIP string `json:"nextHopIP"` -} - -type Subnet struct { - // IP address range - Cidr string `json:"cidr,omitempty"` - // Subnet name - Name string `json:"name"` -} diff --git a/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go b/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go deleted file mode 100644 index 3cda29c4..00000000 --- a/api/apps/v1alpha1/vpc/zz_generated.deepcopy.go +++ /dev/null @@ -1,126 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package vpc - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - if in.Subnets != nil { - in, out := &in.Subnets, &out.Subnets - *out = make([]Subnet, len(*in)) - copy(*out, *in) - } - if in.Peers != nil { - in, out := &in.Peers, &out.Peers - *out = make([]Peer, len(*in)) - copy(*out, *in) - } - if in.Routes != nil { - in, out := &in.Routes, &out.Routes - *out = make([]Route, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Peer) DeepCopyInto(out *Peer) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Peer. -func (in *Peer) DeepCopy() *Peer { - if in == nil { - return nil - } - out := new(Peer) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Route) DeepCopyInto(out *Route) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Route. -func (in *Route) DeepCopy() *Route { - if in == nil { - return nil - } - out := new(Route) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Subnet) DeepCopyInto(out *Subnet) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Subnet. -func (in *Subnet) DeepCopy() *Subnet { - if in == nil { - return nil - } - out := new(Subnet) - in.DeepCopyInto(out) - return out -} diff --git a/api/apps/v1alpha1/vpn/types.go b/api/apps/v1alpha1/vpn/types.go deleted file mode 100644 index 7ec0b0e3..00000000 --- a/api/apps/v1alpha1/vpn/types.go +++ /dev/null @@ -1,56 +0,0 @@ -// Code generated by values-gen. DO NOT EDIT. -// +kubebuilder:object:generate=true -// +groupName=apps.cozystack.io -// +versionName=v1alpha1 -package vpn - -import ( - resource "k8s.io/apimachinery/pkg/api/resource" - "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// +kubebuilder:object:root=true -type Config struct { - v1.TypeMeta `json:",inline"` - v1.ObjectMeta `json:"metadata,omitempty"` - Spec ConfigSpec `json:"spec,omitempty"` -} - -type ConfigSpec struct { - // Number of VPN server replicas. - // +kubebuilder:default:=2 - Replicas int `json:"replicas"` - // Explicit CPU and memory configuration for each VPN server replica. When omitted, the preset defined in `resourcesPreset` is applied. - // +kubebuilder:default:={} - Resources Resources `json:"resources,omitempty"` - // Default sizing preset used when `resources` is omitted. - // +kubebuilder:default:="nano" - ResourcesPreset ResourcesPreset `json:"resourcesPreset"` - // Enable external access from outside the cluster. - // +kubebuilder:default:=false - External bool `json:"external"` - // Host used to substitute into generated URLs. - // +kubebuilder:default:="" - Host string `json:"host"` - // Users configuration map. - // +kubebuilder:default:={} - Users map[string]User `json:"users,omitempty"` - // List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default. - // +kubebuilder:default:={} - ExternalIPs []string `json:"externalIPs,omitempty"` -} - -type Resources struct { - // CPU available to each replica. - Cpu resource.Quantity `json:"cpu,omitempty"` - // Memory (RAM) available to each replica. - Memory resource.Quantity `json:"memory,omitempty"` -} - -type User struct { - // Password for the user (autogenerated if not provided). - Password string `json:"password,omitempty"` -} - -// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge" -type ResourcesPreset string diff --git a/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go b/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go deleted file mode 100644 index a3595bb0..00000000 --- a/api/apps/v1alpha1/vpn/zz_generated.deepcopy.go +++ /dev/null @@ -1,111 +0,0 @@ -//go:build !ignore_autogenerated - -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by controller-gen. DO NOT EDIT. - -package vpn - -import ( - runtime "k8s.io/apimachinery/pkg/runtime" -) - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Config) DeepCopyInto(out *Config) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config. -func (in *Config) DeepCopy() *Config { - if in == nil { - return nil - } - out := new(Config) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *Config) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) { - *out = *in - in.Resources.DeepCopyInto(&out.Resources) - if in.Users != nil { - in, out := &in.Users, &out.Users - *out = make(map[string]User, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - if in.ExternalIPs != nil { - in, out := &in.ExternalIPs, &out.ExternalIPs - *out = make([]string, len(*in)) - copy(*out, *in) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec. -func (in *ConfigSpec) DeepCopy() *ConfigSpec { - if in == nil { - return nil - } - out := new(ConfigSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *Resources) DeepCopyInto(out *Resources) { - *out = *in - out.Cpu = in.Cpu.DeepCopy() - out.Memory = in.Memory.DeepCopy() -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources. -func (in *Resources) DeepCopy() *Resources { - if in == nil { - return nil - } - out := new(Resources) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *User) DeepCopyInto(out *User) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User. -func (in *User) DeepCopy() *User { - if in == nil { - return nil - } - out := new(User) - in.DeepCopyInto(out) - return out -} diff --git a/api/backups/v1alpha1/backup_types.go b/api/backups/v1alpha1/backup_types.go index e46212f6..9371c27f 100644 --- a/api/backups/v1alpha1/backup_types.go +++ b/api/backups/v1alpha1/backup_types.go @@ -72,15 +72,6 @@ type BackupSpec struct { DriverMetadata map[string]string `json:"driverMetadata,omitempty"` } -// DataVolumeResource describes a dataVolume associated with the backed-up application. -type DataVolumeResource struct { - // DataVolumeName is the name of the dataVolume/PVC (e.g., "vm-disk-ubuntu-source"). - DataVolumeName string `json:"dataVolumeName"` - - // ApplicationName is the cozystack application name for this disk (e.g., "ubuntu-source"). - ApplicationName string `json:"applicationName"` -} - // BackupStatus represents the observed state of a Backup. type BackupStatus struct { // Phase is a simple, high-level summary of the backup's state. @@ -92,15 +83,6 @@ type BackupStatus struct { // +optional Artifact *BackupArtifact `json:"artifact,omitempty"` - // UnderlyingResources holds application-specific resource metadata discovered - // during backup (e.g., VM disks, network configuration). The payload is a - // self-typed JSON object carrying an inlined TypeMeta (kind/apiVersion) so - // the consuming controller can dispatch on the application kind. - // +optional - // +kubebuilder:pruning:PreserveUnknownFields - // +kubebuilder:validation:Type=object - UnderlyingResources *runtime.RawExtension `json:"underlyingResources,omitempty"` - // Conditions represents the latest available observations of a Backup's state. // +optional Conditions []metav1.Condition `json:"conditions,omitempty"` diff --git a/api/backups/v1alpha1/restorejob_types.go b/api/backups/v1alpha1/restorejob_types.go index 9817e8c1..1a2dfa00 100644 --- a/api/backups/v1alpha1/restorejob_types.go +++ b/api/backups/v1alpha1/restorejob_types.go @@ -42,12 +42,6 @@ type RestoreJobSpec struct { // application as referenced by backup.spec.applicationRef. // +optional TargetApplicationRef *corev1.TypedLocalObjectReference `json:"targetApplicationRef,omitempty"` - - // Options is a driver-specific blob of restore options, typed based on - // targetApplicationRef and the current controller implementation. - // +optional - // +kubebuilder:pruning:PreserveUnknownFields - Options *runtime.RawExtension `json:"options,omitempty"` } // RestoreJobStatus represents the observed state of a RestoreJob. diff --git a/api/backups/v1alpha1/zz_generated.deepcopy.go b/api/backups/v1alpha1/zz_generated.deepcopy.go index 61b8f839..b2e4a680 100644 --- a/api/backups/v1alpha1/zz_generated.deepcopy.go +++ b/api/backups/v1alpha1/zz_generated.deepcopy.go @@ -400,11 +400,6 @@ func (in *BackupStatus) DeepCopyInto(out *BackupStatus) { *out = new(BackupArtifact) **out = **in } - if in.UnderlyingResources != nil { - in, out := &in.UnderlyingResources, &out.UnderlyingResources - *out = new(runtime.RawExtension) - (*in).DeepCopyInto(*out) - } if in.Conditions != nil { in, out := &in.Conditions, &out.Conditions *out = make([]metav1.Condition, len(*in)) @@ -424,21 +419,6 @@ func (in *BackupStatus) DeepCopy() *BackupStatus { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *DataVolumeResource) DeepCopyInto(out *DataVolumeResource) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataVolumeResource. -func (in *DataVolumeResource) DeepCopy() *DataVolumeResource { - if in == nil { - return nil - } - out := new(DataVolumeResource) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Plan) DeepCopyInto(out *Plan) { *out = *in @@ -620,11 +600,6 @@ func (in *RestoreJobSpec) DeepCopyInto(out *RestoreJobSpec) { *out = new(v1.TypedLocalObjectReference) (*in).DeepCopyInto(*out) } - if in.Options != nil { - in, out := &in.Options, &out.Options - *out = new(runtime.RawExtension) - (*in).DeepCopyInto(*out) - } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobSpec. diff --git a/api/v1alpha1/packagesource_types.go b/api/v1alpha1/packagesource_types.go index 75bf217b..c0b943e8 100644 --- a/api/v1alpha1/packagesource_types.go +++ b/api/v1alpha1/packagesource_types.go @@ -132,16 +132,6 @@ type ComponentInstall struct { // DependsOn is a list of component names that must be installed before this component // +optional DependsOn []string `json:"dependsOn,omitempty"` - - // UpgradeCRDs controls how CRDs from the chart's crds/ directory are - // handled on HelmRelease upgrades. Maps to HelmRelease.Spec.Upgrade.CRDs. - // Empty string (default) preserves the helm-controller default (Skip). - // Use "CreateReplace" for operators that evolve their CRD set between - // versions. Warning: CreateReplace overwrites CRDs and may cause data - // loss if upstream drops fields from a CRD with live objects. - // +optional - // +kubebuilder:validation:Enum=Skip;Create;CreateReplace - UpgradeCRDs string `json:"upgradeCRDs,omitempty"` } // Component defines a single Helm release component within a package source diff --git a/cmd/backupstrategy-controller/main.go b/cmd/backupstrategy-controller/main.go index 03396979..6c0ee2e6 100644 --- a/cmd/backupstrategy-controller/main.go +++ b/cmd/backupstrategy-controller/main.go @@ -176,15 +176,6 @@ func main() { os.Exit(1) } - if err = (&backupcontroller.BackupReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Recorder: mgr.GetEventRecorderFor("backup-controller"), - }).SetupWithManager(mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "Backup") - os.Exit(1) - } - // +kubebuilder:scaffold:builder if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil { diff --git a/cmd/cozystack-controller/main.go b/cmd/cozystack-controller/main.go index bcaca9c9..77c4f9dc 100644 --- a/cmd/cozystack-controller/main.go +++ b/cmd/cozystack-controller/main.go @@ -42,7 +42,6 @@ import ( "github.com/cozystack/cozystack/internal/telemetry" helmv2 "github.com/fluxcd/helm-controller/api/v2" - cosiv1alpha1 "sigs.k8s.io/container-object-storage-interface-api/apis/objectstorage/v1alpha1" // +kubebuilder:scaffold:imports ) @@ -57,7 +56,6 @@ func init() { utilruntime.Must(cozystackiov1alpha1.AddToScheme(scheme)) utilruntime.Must(dashboard.AddToScheme(scheme)) utilruntime.Must(helmv2.AddToScheme(scheme)) - utilruntime.Must(cosiv1alpha1.AddToScheme(scheme)) // +kubebuilder:scaffold:scheme } diff --git a/cmd/kubeovn-plunger/main.go b/cmd/kubeovn-plunger/main.go index 611d030b..210405ce 100644 --- a/cmd/kubeovn-plunger/main.go +++ b/cmd/kubeovn-plunger/main.go @@ -29,7 +29,6 @@ import ( utilruntime "k8s.io/apimachinery/pkg/util/runtime" clientgoscheme "k8s.io/client-go/kubernetes/scheme" ctrl "sigs.k8s.io/controller-runtime" - "sigs.k8s.io/controller-runtime/pkg/cache" "sigs.k8s.io/controller-runtime/pkg/healthz" "sigs.k8s.io/controller-runtime/pkg/log/zap" "sigs.k8s.io/controller-runtime/pkg/metrics" @@ -132,11 +131,6 @@ func main() { HealthProbeBindAddress: probeAddr, LeaderElection: enableLeaderElection, LeaderElectionID: "29a0338b.cozystack.io", - Cache: cache.Options{ - DefaultNamespaces: map[string]cache.Config{ - kubeOVNNamespace: {}, - }, - }, // LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily // when the Manager ends. This requires the binary to immediately end when the // Manager is stopped, otherwise, this setting is unsafe. Setting this significantly diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json deleted file mode 100644 index 28a24568..00000000 --- a/dashboards/gpu/gpu-efficiency.json +++ /dev/null @@ -1,819 +0,0 @@ -{ - "uid": "gpu-efficiency", - "title": "GPU Efficiency Score", - "description": "Tensor saturation, util/watt and throttling — reveals inefficient GPU workloads", - "tags": [ - "gpu", - "efficiency", - "finops" - ], - "timezone": "browser", - "editable": true, - "graphTooltip": 1, - "time": { - "from": "now-1h", - "to": "now" - }, - "fiscalYearStartMonth": 0, - "schemaVersion": 42, - "panels": [ - { - "type": "row", - "collapsed": false, - "title": "Overall efficiency metrics", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 0 - }, - "id": 1, - "panels": [] - }, - { - "type": "stat", - "id": 2, - "targets": [ - { - "expr": "avg(gpu:tensor_saturation:avg5m) * 100", - "refId": "A" - } - ], - "title": "Avg Tensor Saturation", - "description": "Mean tensor core saturation across all GPUs. \u003c10% means GPUs are used inefficiently (workloads could move to CPU or optimize their code). Cluster-wide — DCGM metrics cannot be attributed to workload namespaces.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 8, - "x": 0, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "area", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "red" - }, - { - "value": 10, - "color": "orange" - }, - { - "value": 30, - "color": "yellow" - }, - { - "value": 60, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 3, - "targets": [ - { - "expr": "avg(gpu:util_per_watt:avg5m)", - "refId": "A" - } - ], - "title": "Avg Utilization per Watt", - "description": "NVML utilization % per watt across all GPUs. Higher value = more efficient workload. Cluster-wide — DCGM metrics cannot be attributed to workload namespaces.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 8, - "x": 8, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "area", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "none", - "decimals": 3, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "red" - }, - { - "value": 0.5, - "color": "yellow" - }, - { - "value": 1, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 4, - "targets": [ - { - "expr": "avg(gpu:power_throttle_fraction:rate5m)", - "refId": "A" - } - ], - "title": "Avg Power Throttling", - "description": "Fraction of time GPUs hit the TDP cap and lose performance. \u003e5% means tenants underutilize billed FLOPS. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 8, - "x": 16, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "area", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "percentunit", - "decimals": 2, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 0.05, - "color": "yellow" - }, - { - "value": 0.2, - "color": "red" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "NVML vs Tensor (mismatch detector)", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 6 - }, - "id": 10, - "panels": [] - }, - { - "type": "timeseries", - "id": 11, - "targets": [ - { - "expr": "DCGM_FI_DEV_GPU_UTIL", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "NVML GPU Utilization", - "description": "Classic utilization metric. Shows activity of any engine (SM, copy, encoder). Cluster-wide — DCGM namespace is the exporter's own namespace, not the workload namespace.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 7 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 12, - "targets": [ - { - "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE * 100", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "Tensor Pipe Active", - "description": "Real tensor core load (HMMA). For AI/LLM inference it should be ≥20%, otherwise the workload is unoptimized. Cluster-wide — DCGM namespace is the exporter's own namespace, not the workload namespace.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 7 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Per-GPU ranking", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 15 - }, - "id": 20, - "panels": [] - }, - { - "type": "table", - "id": 21, - "targets": [ - { - "expr": "topk(20, gpu:tensor_saturation:avg5m * 100)", - "instant": true, - "range": false, - "format": "table", - "refId": "A" - } - ], - "title": "Tensor Saturation per GPU (5m avg)", - "description": "Which GPUs are exercising tensor cores and which are not. Sorted descending. Grouped by Hostname/gpu/UUID — DCGM metrics cannot be attributed to workload namespaces.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 16 - }, - "repeatDirection": "h", - "transformations": [ - { - "id": "organize", - "options": { - "excludeByName": { - "DCGM_FI_DRIVER_VERSION": true, - "Time": true, - "__name__": true, - "cluster": true, - "container": true, - "device": true, - "endpoint": true, - "gpu_driver_version": true, - "instance": true, - "job": true, - "modelName": true, - "namespace": true, - "pci_bus_id": true, - "pod": true, - "prometheus": true, - "service": true, - "tenant": true, - "tier": true, - "uid": true, - "unit": true - }, - "indexByName": { - "Hostname": 0, - "UUID": 2, - "Value": 3, - "gpu": 1 - }, - "renameByName": { - "Hostname": "Node", - "UUID": "UUID", - "Value": "Saturation", - "gpu": "GPU" - } - } - } - ], - "options": { - "frameIndex": 0, - "showHeader": true, - "showTypeIcons": false, - "sortBy": [ - { - "displayName": "Saturation", - "desc": true - } - ], - "footer": { - "show": false, - "reducer": [] - }, - "cellHeight": "sm" - }, - "fieldConfig": { - "defaults": {}, - "overrides": [ - { - "matcher": { - "id": "byName", - "options": "Saturation" - }, - "properties": [ - { - "id": "unit", - "value": "percent" - }, - { - "id": "min", - "value": 0 - }, - { - "id": "max", - "value": 100 - }, - { - "id": "custom.cellOptions", - "value": { - "mode": "gradient", - "type": "gauge" - } - }, - { - "id": "thresholds", - "value": { - "mode": "absolute", - "steps": [ - { - "color": "red" - }, - { - "color": "orange", - "value": 10 - }, - { - "color": "yellow", - "value": 30 - }, - { - "color": "green", - "value": 60 - } - ] - } - } - ] - } - ] - } - }, - { - "type": "table", - "id": 22, - "targets": [ - { - "expr": "topk(20, gpu:util_per_watt:avg5m)", - "instant": true, - "range": false, - "format": "table", - "refId": "A" - } - ], - "title": "Utilization / Watt per GPU (5m avg)", - "description": "How efficiently each GPU spends watts. Low value = poor optimization. Grouped by Hostname/gpu/UUID — DCGM metrics cannot be attributed to workload namespaces.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 16 - }, - "repeatDirection": "h", - "transformations": [ - { - "id": "organize", - "options": { - "excludeByName": { - "DCGM_FI_DRIVER_VERSION": true, - "Time": true, - "__name__": true, - "cluster": true, - "container": true, - "device": true, - "endpoint": true, - "gpu_driver_version": true, - "instance": true, - "job": true, - "modelName": true, - "namespace": true, - "pci_bus_id": true, - "pod": true, - "prometheus": true, - "service": true, - "tenant": true, - "tier": true, - "uid": true, - "unit": true - }, - "indexByName": { - "Hostname": 0, - "UUID": 2, - "Value": 3, - "gpu": 1 - }, - "renameByName": { - "Hostname": "Node", - "UUID": "UUID", - "Value": "Util/Watt", - "gpu": "GPU" - } - } - } - ], - "options": { - "frameIndex": 0, - "showHeader": true, - "showTypeIcons": false, - "sortBy": [ - { - "displayName": "Util/Watt", - "desc": true - } - ], - "footer": { - "show": false, - "reducer": [] - }, - "cellHeight": "sm" - }, - "fieldConfig": { - "defaults": {}, - "overrides": [ - { - "matcher": { - "id": "byName", - "options": "Util/Watt" - }, - "properties": [ - { - "id": "unit", - "value": "none" - }, - { - "id": "decimals", - "value": 3 - }, - { - "id": "min", - "value": 0 - }, - { - "id": "max", - "value": 1.5 - }, - { - "id": "custom.cellOptions", - "value": { - "mode": "gradient", - "type": "gauge" - } - }, - { - "id": "thresholds", - "value": { - "mode": "absolute", - "steps": [ - { - "color": "red" - }, - { - "color": "yellow", - "value": 0.5 - }, - { - "color": "green", - "value": 1 - } - ] - } - } - ] - } - ] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Throttling", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 24 - }, - "id": 30, - "panels": [] - }, - { - "type": "timeseries", - "id": 31, - "targets": [ - { - "expr": "gpu:power_throttle_fraction:rate5m", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "Power throttle fraction per GPU", - "description": "Fraction of time the GPU was power-throttled. 1.0 = always throttled. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 25 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percentunit", - "min": 0, - "max": 1, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 0.05, - "color": "yellow" - }, - { - "value": 0.2, - "color": "red" - } - ] - }, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 25, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 32, - "targets": [ - { - "expr": "gpu:thermal_throttle_fraction:rate5m", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "Thermal throttle fraction per GPU", - "description": "Fraction of time the GPU was thermal-throttled. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 25 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percentunit", - "min": 0, - "max": 1, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 0.05, - "color": "yellow" - }, - { - "value": 0.2, - "color": "red" - } - ] - }, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 25, - "showPoints": "never" - } - }, - "overrides": [] - } - } - ], - "templating": { - "list": [ - { - "type": "datasource", - "name": "ds_prometheus", - "label": "Prometheus", - "skipUrlSync": false, - "query": "prometheus", - "current": { - "selected": false, - "text": "default", - "value": "default" - }, - "multi": false, - "allowCustomValue": true, - "includeAll": false, - "regex": "", - "auto": false, - "auto_min": "10s", - "auto_count": 30 - } - ] - }, - "annotations": {} -} diff --git a/dashboards/gpu/gpu-fleet.json b/dashboards/gpu/gpu-fleet.json deleted file mode 100644 index 60c12bfb..00000000 --- a/dashboards/gpu/gpu-fleet.json +++ /dev/null @@ -1,1157 +0,0 @@ -{ - "uid": "gpu-fleet", - "title": "GPU Fleet Overview", - "description": "Cluster-wide GPU inventory, capacity, utilization and health — admin view across the whole fleet.", - "tags": [ - "gpu", - "fleet", - "admin" - ], - "timezone": "browser", - "editable": true, - "graphTooltip": 1, - "time": { - "from": "now-6h", - "to": "now" - }, - "fiscalYearStartMonth": 0, - "schemaVersion": 42, - "panels": [ - { - "type": "row", - "collapsed": false, - "title": "Cluster snapshot", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 0 - }, - "id": 1, - "panels": [] - }, - { - "type": "stat", - "id": 2, - "targets": [ - { - "expr": "cluster:gpu_count:total", - "refId": "A" - } - ], - "title": "Total GPUs", - "description": "Physical GPUs discovered by DCGM across all nodes.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 0, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 3, - "targets": [ - { - "expr": "cluster:gpu_count:allocated", - "refId": "A" - } - ], - "title": "Allocated", - "description": "Sum of kube GPU requests across all pods. Billable view — includes Pending pods.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 4, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - }, - { - "value": 1, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 4, - "targets": [ - { - "expr": "cluster:gpu_count:free", - "refId": "A" - } - ], - "title": "Free", - "description": "Unallocated capacity available for new tenants.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 8, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "red" - }, - { - "value": 1, - "color": "yellow" - }, - { - "value": 2, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 5, - "targets": [ - { - "expr": "count(count by (Hostname) (DCGM_FI_DEV_GPU_UTIL))", - "refId": "A" - } - ], - "title": "Nodes with GPU", - "description": "Nodes reporting at least one GPU to DCGM. Counted via DCGM_FI_DEV_GPU_UTIL because kube-state-metrics does not expose node labels by default.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 12, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 6, - "targets": [ - { - "expr": "cluster:gpu_util:avg", - "refId": "A" - } - ], - "title": "Average utilization", - "description": "Legacy NVML utilization across all tenant GPUs.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 16, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "area", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - }, - { - "value": 30, - "color": "green" - }, - { - "value": 80, - "color": "orange" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 7, - "targets": [ - { - "expr": "cluster:gpu_power_watts:sum", - "refId": "A" - } - ], - "title": "Total power", - "description": "Live power draw summed across the fleet.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 20, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "area", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "watt", - "decimals": 0, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Per-node GPU activity", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 5 - }, - "id": 10, - "panels": [] - }, - { - "type": "bargauge", - "id": 11, - "targets": [ - { - "expr": "avg by (Hostname) (DCGM_FI_DEV_GPU_UTIL)", - "legendFormat": "{{Hostname}}", - "refId": "A" - } - ], - "title": "GPU utilization per node", - "description": "Average NVML utilization per node — spot idle or saturated hosts at a glance.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 6 - }, - "repeatDirection": "h", - "options": { - "displayMode": "gradient", - "valueMode": "color", - "namePlacement": "auto", - "showUnfilled": true, - "sizing": "auto", - "minVizWidth": 8, - "minVizHeight": 16, - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "maxVizHeight": 300, - "orientation": "horizontal" - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - }, - { - "value": 30, - "color": "green" - }, - { - "value": 80, - "color": "orange" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "bargauge", - "id": 12, - "targets": [ - { - "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE) / clamp_min(sum by (Hostname) (DCGM_FI_DEV_POWER_MGMT_LIMIT), 1) * 100", - "legendFormat": "{{Hostname}}", - "refId": "A" - } - ], - "title": "Power draw per node (% of TDP)", - "description": "GPU power usage as a fraction of the node's combined TDP cap. Works across GPU SKUs without per-model thresholds. Requires DCGM_FI_DEV_POWER_MGMT_LIMIT from custom DCGM CSV (see packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml).", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 6 - }, - "repeatDirection": "h", - "options": { - "displayMode": "gradient", - "valueMode": "color", - "namePlacement": "auto", - "showUnfilled": true, - "sizing": "auto", - "minVizWidth": 8, - "minVizHeight": 16, - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "maxVizHeight": 300, - "orientation": "horizontal" - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 60, - "color": "yellow" - }, - { - "value": 80, - "color": "orange" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Usage trends", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 14 - }, - "id": 20, - "panels": [] - }, - { - "type": "timeseries", - "id": 21, - "targets": [ - { - "expr": "avg by (Hostname) (DCGM_FI_DEV_GPU_UTIL)", - "legendFormat": "{{Hostname}}", - "refId": "A" - } - ], - "title": "GPU utilization per node (trend)", - "description": "Per-node NVML utilization over time — shows shifting workload across hosts.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 15 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 20, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 22, - "targets": [ - { - "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE)", - "legendFormat": "{{Hostname}}", - "refId": "A" - } - ], - "title": "Power draw per node (trend)", - "description": "Per-node GPU power consumption over time.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 15 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "watt", - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 20, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Health", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 23 - }, - "id": 30, - "panels": [] - }, - { - "type": "stat", - "id": 31, - "targets": [ - { - "expr": "count((max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS)) \u003e 0) or vector(0)", - "refId": "A" - } - ], - "title": "GPUs with XID errors", - "description": "Count of GPUs reporting a non-zero XID code. XID = NVIDIA hardware/driver error — any non-zero value needs investigation.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 6, - "x": 0, - "y": 24 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 1, - "color": "red" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 32, - "targets": [ - { - "expr": "avg(gpu:power_throttle_fraction:rate5m)", - "refId": "A" - } - ], - "title": "Power throttling (cluster avg)", - "description": "Fraction of time the fleet spent power-throttled. \u003e5% = billed FLOPS are being underdelivered.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 6, - "x": 6, - "y": 24 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "percentunit", - "decimals": 2, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 0.05, - "color": "yellow" - }, - { - "value": 0.2, - "color": "red" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 33, - "targets": [ - { - "expr": "avg(gpu:thermal_throttle_fraction:rate5m)", - "refId": "A" - } - ], - "title": "Thermal throttling (cluster avg)", - "description": "Fraction of time the fleet spent thermal-throttled. Indicates cooling/datacenter issues.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 6, - "x": 12, - "y": 24 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "percentunit", - "decimals": 2, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 0.05, - "color": "yellow" - }, - { - "value": 0.2, - "color": "red" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 34, - "targets": [ - { - "expr": "max(DCGM_FI_DEV_GPU_TEMP)", - "refId": "A" - } - ], - "title": "Max GPU temperature", - "description": "Hottest GPU in the fleet right now. Adjust thresholds to match your GPU model specifications.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 6, - "x": 18, - "y": 24 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "celsius", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 75, - "color": "yellow" - }, - { - "value": 85, - "color": "red" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 35, - "targets": [ - { - "expr": "DCGM_FI_DEV_GPU_TEMP", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "Temperature per GPU", - "description": "Per-GPU temperature trace. Sustained red zone = cooling issue or aggressive workload.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 29 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "celsius", - "min": 20, - "max": 100, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 75, - "color": "yellow" - }, - { - "value": 85, - "color": "red" - } - ] - }, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 36, - "targets": [ - { - "expr": "gpu:power_throttle_fraction:rate5m", - "legendFormat": "power {{Hostname}}/{{gpu}}", - "refId": "A" - }, - { - "expr": "gpu:thermal_throttle_fraction:rate5m", - "legendFormat": "thermal {{Hostname}}/{{gpu}}", - "refId": "B" - } - ], - "title": "Throttle fraction per GPU", - "description": "Red = power throttle, blue = thermal throttle. Both on same chart to compare causes.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 29 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percentunit", - "min": 0, - "max": 1, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 25, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Hardware inventory", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 37 - }, - "id": 40, - "panels": [] - }, - { - "type": "table", - "id": 41, - "targets": [ - { - "expr": "group by (Hostname, modelName, gpu, UUID) (DCGM_FI_DEV_GPU_UTIL)", - "instant": true, - "range": false, - "format": "table", - "refId": "A" - } - ], - "title": "GPU inventory", - "description": "One row per physical GPU. Model / index / UUID sourced from DCGM labels.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 6, - "w": 24, - "x": 0, - "y": 38 - }, - "repeatDirection": "h", - "transformations": [ - { - "id": "organize", - "options": { - "excludeByName": { - "Time": true, - "Value": true, - "__name__": true, - "cluster": true, - "container": true, - "device": true, - "endpoint": true, - "instance": true, - "job": true, - "pci_bus_id": true, - "prometheus": true, - "service": true, - "tenant": true, - "tier": true, - "uid": true, - "unit": true - }, - "indexByName": { - "Hostname": 0, - "UUID": 3, - "gpu": 2, - "modelName": 1 - }, - "renameByName": { - "Hostname": "Node", - "UUID": "UUID", - "gpu": "Index", - "modelName": "GPU Model" - } - } - } - ], - "options": { - "frameIndex": 0, - "showHeader": true, - "showTypeIcons": false, - "footer": { - "show": false, - "reducer": [] - }, - "cellHeight": "sm" - } - } - ], - "templating": { - "list": [ - { - "type": "datasource", - "name": "ds_prometheus", - "label": "Prometheus", - "skipUrlSync": false, - "query": "prometheus", - "current": { - "selected": false, - "text": "default", - "value": "default" - }, - "multi": false, - "allowCustomValue": true, - "includeAll": false, - "regex": "", - "auto": false, - "auto_min": "10s", - "auto_count": 30 - } - ] - }, - "annotations": {} -} diff --git a/dashboards/gpu/gpu-performance.json b/dashboards/gpu/gpu-performance.json deleted file mode 100644 index aed9c69a..00000000 --- a/dashboards/gpu/gpu-performance.json +++ /dev/null @@ -1,957 +0,0 @@ -{ - "uid": "gpu-performance", - "title": "GPU Performance", - "tags": [ - "gpu", - "dcgm" - ], - "timezone": "browser", - "editable": true, - "graphTooltip": 1, - "time": { - "from": "now-1h", - "to": "now" - }, - "fiscalYearStartMonth": 0, - "schemaVersion": 42, - "panels": [ - { - "type": "row", - "collapsed": false, - "title": "Overview", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 0 - }, - "id": 1, - "panels": [] - }, - { - "type": "stat", - "id": 2, - "targets": [ - { - "expr": "cluster:gpu_count:total", - "refId": "A" - } - ], - "title": "Total GPUs", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 6, - "x": 0, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 3, - "targets": [ - { - "expr": "cluster:gpu_count:allocated", - "refId": "A" - } - ], - "title": "Allocated", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 6, - "x": 6, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 1, - "color": "yellow" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 4, - "targets": [ - { - "expr": "cluster:gpu_util:avg", - "refId": "A" - } - ], - "title": "Average utilization", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 6, - "x": 12, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "area", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - }, - { - "value": 30, - "color": "green" - }, - { - "value": 80, - "color": "orange" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 5, - "targets": [ - { - "expr": "cluster:gpu_power_watts:sum", - "refId": "A" - } - ], - "title": "Power draw", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 6, - "x": 18, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "area", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "watt", - "decimals": 0, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Utilization", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 5 - }, - "id": 10, - "panels": [] - }, - { - "type": "timeseries", - "id": 11, - "targets": [ - { - "expr": "DCGM_FI_DEV_GPU_UTIL{Hostname=~\"$Hostname\"}", - "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}", - "refId": "A" - } - ], - "title": "GPU Utilization (NVML)", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 6 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never", - "spanNulls": false - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 12, - "targets": [ - { - "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{Hostname=~\"$Hostname\"} * 100", - "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}", - "refId": "A" - } - ], - "title": "Tensor Pipe Active (realistic load for LLM/AI)", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 6 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never", - "spanNulls": false - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 13, - "targets": [ - { - "expr": "DCGM_FI_PROF_GR_ENGINE_ACTIVE{Hostname=~\"$Hostname\"} * 100", - "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}", - "refId": "A" - } - ], - "title": "Graphics Engine Active", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 14 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never", - "spanNulls": false - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 14, - "targets": [ - { - "expr": "DCGM_FI_DEV_MEM_COPY_UTIL{Hostname=~\"$Hostname\"}", - "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}", - "refId": "A" - } - ], - "title": "Memory Copy Utilization", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 14 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never", - "spanNulls": false - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Memory", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 22 - }, - "id": 20, - "panels": [] - }, - { - "type": "timeseries", - "id": 21, - "targets": [ - { - "expr": "DCGM_FI_DEV_FB_USED{Hostname=~\"$Hostname\"} * 1048576", - "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}", - "refId": "A" - } - ], - "title": "VRAM Used", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 23 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "bytes", - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 25, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 22, - "targets": [ - { - "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\"} * 1048576", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "VRAM Free", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 23 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "min" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "bytes", - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Power \u0026 Temperature", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 31 - }, - "id": 30, - "panels": [] - }, - { - "type": "timeseries", - "id": 31, - "targets": [ - { - "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\"}", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "Power Usage per GPU", - "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 32 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "watt", - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 32, - "targets": [ - { - "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "GPU Temperature", - "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 32 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "celsius", - "min": 20, - "max": 100, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 75, - "color": "yellow" - }, - { - "value": 85, - "color": "red" - } - ] - }, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Health", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 40 - }, - "id": 40, - "panels": [] - }, - { - "type": "stat", - "id": 41, - "targets": [ - { - "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "XID errors (latest)", - "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 8, - "x": 0, - "y": 41 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value_and_name", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 1, - "color": "red" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 42, - "targets": [ - { - "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "Power Violation (µs/s throttled due to power)", - "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 8, - "x": 8, - "y": 41 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "µs", - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never" - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 43, - "targets": [ - { - "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])", - "legendFormat": "{{Hostname}}/{{gpu}}", - "refId": "A" - } - ], - "title": "Thermal Violation (µs/s throttled due to thermals)", - "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 5, - "w": 8, - "x": 16, - "y": 41 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "µs", - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 10, - "showPoints": "never" - } - }, - "overrides": [] - } - } - ], - "templating": { - "list": [ - { - "type": "datasource", - "name": "ds_prometheus", - "label": "Prometheus", - "skipUrlSync": false, - "query": "prometheus", - "current": { - "selected": false, - "text": "default", - "value": "default" - }, - "multi": false, - "allowCustomValue": true, - "includeAll": false, - "regex": "", - "auto": false, - "auto_min": "10s", - "auto_count": 30 - }, - { - "type": "query", - "name": "Hostname", - "label": "Host", - "skipUrlSync": false, - "query": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)", - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "current": { - "selected": true, - "text": "All", - "value": "$__all" - }, - "multi": true, - "allowCustomValue": true, - "refresh": 2, - "sort": 1, - "includeAll": true, - "auto": false, - "auto_min": "10s", - "auto_count": 30 - } - ] - }, - "annotations": {} -} diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json deleted file mode 100644 index 865fb95c..00000000 --- a/dashboards/gpu/gpu-quotas.json +++ /dev/null @@ -1,637 +0,0 @@ -{ - "uid": "gpu-quotas", - "title": "GPU Quotas \u0026 Allocation", - "tags": [ - "gpu", - "quotas" - ], - "timezone": "browser", - "editable": true, - "graphTooltip": 1, - "time": { - "from": "now-6h", - "to": "now" - }, - "fiscalYearStartMonth": 0, - "schemaVersion": 42, - "panels": [ - { - "type": "row", - "collapsed": false, - "title": "Allocation overview", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 0 - }, - "id": 1, - "panels": [] - }, - { - "type": "stat", - "id": 2, - "targets": [ - { - "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})", - "refId": "A" - } - ], - "title": "GPU allocatable", - "description": "Total GPU capacity the cluster can schedule to pods.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 6, - "x": 0, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 3, - "targets": [ - { - "expr": "cluster:gpu_count:allocated", - "refId": "A" - } - ], - "title": "GPU requested", - "description": "Sum of GPU requests across all pods cluster-wide, including system namespaces.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 6, - "x": 6, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 1, - "color": "yellow" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "gauge", - "id": 4, - "targets": [ - { - "expr": "cluster:gpu_count:allocated / sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"}) * 100", - "refId": "A" - } - ], - "title": "Allocation ratio", - "description": "Percentage of allocatable GPUs currently requested by pods.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 6, - "x": 12, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "showThresholdLabels": false, - "showThresholdMarkers": true, - "sizing": "auto", - "minVizWidth": 75, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "minVizHeight": 75, - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - }, - { - "value": 40, - "color": "green" - }, - { - "value": 80, - "color": "yellow" - }, - { - "value": 95, - "color": "red" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 5, - "targets": [ - { - "expr": "count((sum by (namespace, pod) (kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}) \u003e 0) * on(namespace, pod) group_left() (kube_pod_status_phase{phase=\"Pending\"} == 1)) or vector(0)", - "refId": "A" - } - ], - "title": "Pending pods (GPU)", - "description": "Pods requesting GPUs that are stuck in Pending state — indicates capacity shortage.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 6, - "x": 18, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - }, - { - "value": 1, - "color": "red" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Per namespace", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 5 - }, - "id": 10, - "panels": [] - }, - { - "type": "bargauge", - "id": 11, - "targets": [ - { - "expr": "sum by (namespace) (namespace:gpu_count:allocated{namespace=~\"$namespace\"})", - "legendFormat": "{{namespace}}", - "refId": "A" - } - ], - "title": "GPU requested per namespace", - "description": "GPU allocation breakdown by namespace — spot top consumers at a glance.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 6 - }, - "repeatDirection": "h", - "options": { - "displayMode": "gradient", - "valueMode": "color", - "namePlacement": "auto", - "showUnfilled": true, - "sizing": "auto", - "minVizWidth": 8, - "minVizHeight": 16, - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "maxVizHeight": 300, - "orientation": "horizontal" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "min": 0, - "max": 8, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 12, - "targets": [ - { - "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})", - "legendFormat": "Allocatable (total)", - "refId": "A" - }, - { - "expr": "sum(namespace:gpu_count:allocated{namespace=~\"$namespace\"})", - "legendFormat": "Requested", - "refId": "B" - } - ], - "title": "GPU allocated over time", - "description": "Requested vs allocatable GPUs over time — shows allocation pressure trends.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 6 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "custom": { - "drawStyle": "line", - "lineInterpolation": "stepAfter", - "fillOpacity": 10, - "showPoints": "never" - } - }, - "overrides": [ - { - "matcher": { - "id": "byName", - "options": "Allocatable (total)" - }, - "properties": [ - { - "id": "color", - "value": { - "fixedColor": "blue", - "mode": "fixed" - } - } - ] - } - ] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Pods with GPU", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 14 - }, - "id": 20, - "panels": [] - }, - { - "type": "table", - "id": 21, - "targets": [ - { - "expr": "kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)", - "instant": true, - "range": false, - "format": "table", - "refId": "requested" - }, - { - "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left() (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)", - "instant": true, - "range": false, - "format": "table", - "refId": "limits" - } - ], - "title": "Pods requesting GPU", - "description": "Per-pod GPU requests and limits with scheduling status — Running or Pending.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 10, - "w": 24, - "x": 0, - "y": 15 - }, - "repeatDirection": "h", - "transformations": [ - { - "id": "joinByField", - "options": { - "byField": "pod", - "mode": "outer" - } - }, - { - "id": "organize", - "options": { - "excludeByName": { - "Time": true, - "Time 1": true, - "Time 2": true, - "__name__": true, - "__name__ 1": true, - "__name__ 2": true, - "cluster": true, - "cluster 1": true, - "cluster 2": true, - "container 2": true, - "endpoint": true, - "endpoint 1": true, - "endpoint 2": true, - "instance": true, - "instance 1": true, - "instance 2": true, - "job": true, - "job 1": true, - "job 2": true, - "namespace 2": true, - "node 2": true, - "prometheus": true, - "prometheus 1": true, - "prometheus 2": true, - "resource": true, - "resource 1": true, - "resource 2": true, - "service": true, - "service 1": true, - "service 2": true, - "tenant": true, - "tenant 1": true, - "tenant 2": true, - "tier": true, - "tier 1": true, - "tier 2": true, - "uid": true, - "uid 1": true, - "uid 2": true, - "unit": true, - "unit 1": true, - "unit 2": true - }, - "indexByName": { - "Value #limits": 5, - "Value #requested": 4, - "container 1": 2, - "namespace 1": 0, - "node 1": 3, - "phase": 6, - "pod": 1 - }, - "renameByName": { - "Value #limits": "Limit", - "Value #requested": "Req", - "container 1": "Container", - "namespace 1": "Namespace", - "node 1": "Node", - "phase": "Status" - } - } - } - ], - "options": { - "frameIndex": 0, - "showHeader": true, - "showTypeIcons": false, - "footer": { - "show": false, - "reducer": [] - }, - "cellHeight": "sm" - }, - "fieldConfig": { - "defaults": {}, - "overrides": [ - { - "matcher": { - "id": "byName", - "options": "Status" - }, - "properties": [ - { - "id": "custom.cellOptions", - "value": { - "mode": "basic", - "type": "color-background" - } - }, - { - "id": "mappings", - "value": [ - { - "options": { - "Failed": { - "color": "red", - "index": 2 - }, - "Pending": { - "color": "orange", - "index": 1 - }, - "Running": { - "color": "green", - "index": 0 - } - }, - "type": "value" - } - ] - } - ] - } - ] - } - } - ], - "templating": { - "list": [ - { - "type": "datasource", - "name": "ds_prometheus", - "label": "Prometheus", - "skipUrlSync": false, - "query": "prometheus", - "current": { - "selected": false, - "text": "default", - "value": "default" - }, - "multi": false, - "allowCustomValue": true, - "includeAll": false, - "regex": "", - "auto": false, - "auto_min": "10s", - "auto_count": 30 - }, - { - "type": "query", - "name": "namespace", - "label": "Namespace", - "skipUrlSync": false, - "query": "label_values(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}, namespace)", - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "current": { - "selected": true, - "text": "All", - "value": "$__all" - }, - "multi": true, - "allowCustomValue": true, - "refresh": 2, - "sort": 1, - "includeAll": true, - "auto": false, - "auto_min": "10s", - "auto_count": 30 - } - ] - }, - "annotations": {} -} diff --git a/dashboards/gpu/gpu-tenants.json b/dashboards/gpu/gpu-tenants.json deleted file mode 100644 index 7fef321d..00000000 --- a/dashboards/gpu/gpu-tenants.json +++ /dev/null @@ -1,1098 +0,0 @@ -{ - "uid": "gpu-tenants", - "title": "GPU Tenant Usage", - "description": "Per-tenant GPU consumption: live allocation, utilization, tensor saturation, power, and 24h GPU-hours / kWh — admin view across all namespaces.", - "tags": [ - "gpu", - "tenants", - "admin" - ], - "timezone": "browser", - "editable": true, - "graphTooltip": 1, - "time": { - "from": "now-24h", - "to": "now" - }, - "fiscalYearStartMonth": 0, - "schemaVersion": 42, - "panels": [ - { - "type": "row", - "collapsed": false, - "title": "Tenant fleet snapshot", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 0 - }, - "id": 1, - "panels": [] - }, - { - "type": "stat", - "id": 2, - "targets": [ - { - "expr": "count(namespace:gpu_count:allocated{namespace=~\"$namespace\"} \u003e 0)", - "refId": "A" - } - ], - "title": "Active tenants", - "description": "Namespaces with at least one GPU request (Pending + Running).", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 0, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 3, - "targets": [ - { - "expr": "sum(namespace:gpu_count:allocated{namespace=~\"$namespace\"})", - "refId": "A" - } - ], - "title": "Allocated GPUs", - "description": "Sum of kube GPU requests across tenants. Billable view — includes Pending pods.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 4, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "background", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - }, - { - "value": 1, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 4, - "targets": [ - { - "expr": "cluster:gpu_util:avg", - "refId": "A" - } - ], - "title": "Avg cluster GPU util", - "description": "Average NVML utilization across all GPUs in the cluster. Cluster-wide — DCGM hardware metrics cannot be attributed to workload namespaces.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 8, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "area", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "max": 100, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - }, - { - "value": 30, - "color": "green" - }, - { - "value": 80, - "color": "orange" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 5, - "targets": [ - { - "expr": "cluster:gpu_power_watts:sum", - "refId": "A" - } - ], - "title": "Total GPU power", - "description": "Live power draw summed across all GPUs in the cluster. Cluster-wide — DCGM hardware metrics cannot be attributed to workload namespaces.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 12, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "area", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "watt", - "decimals": 0, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 6, - "targets": [ - { - "expr": "sum(sum_over_time(node:power_watts:sum[24h:1m])) / 60 / 1000", - "refId": "A" - } - ], - "title": "Energy (last 24h)", - "description": "Integrated cluster-wide GPU power draw over 24h. Cluster-wide — DCGM hardware metrics cannot be attributed to workload namespaces.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 16, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "kwatth", - "decimals": 1, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "stat", - "id": 7, - "targets": [ - { - "expr": "sum(sum_over_time(namespace:gpu_count:allocated{namespace=~\"$namespace\"}[24h:1m])) / 60", - "refId": "A" - } - ], - "title": "GPU-hours (last 24h)", - "description": "Sum of (GPU count × time requested) across all tenants over the last 24h. Integrated from kube requests, so Pending pods count.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 4, - "w": 4, - "x": 20, - "y": 1 - }, - "repeatDirection": "h", - "options": { - "graphMode": "none", - "colorMode": "value", - "justifyMode": "auto", - "textMode": "value", - "wideLayout": true, - "showPercentChange": false, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "percentChangeColorMode": "standard", - "orientation": "" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "decimals": 1, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Current allocation", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 5 - }, - "id": 10, - "panels": [] - }, - { - "type": "bargauge", - "id": 11, - "targets": [ - { - "expr": "namespace:gpu_count:allocated{namespace=~\"$namespace\"}", - "legendFormat": "{{namespace}}", - "refId": "A" - } - ], - "title": "GPUs per namespace", - "description": "Kube GPU requests per tenant (billable). Includes Pending pods.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 6 - }, - "repeatDirection": "h", - "options": { - "displayMode": "gradient", - "valueMode": "color", - "namePlacement": "auto", - "showUnfilled": true, - "sizing": "auto", - "minVizWidth": 8, - "minVizHeight": 16, - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "maxVizHeight": 300, - "orientation": "horizontal" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "min": 0, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "bargauge", - "id": 12, - "targets": [ - { - "expr": "node:fb_used_bytes:sum", - "legendFormat": "{{Hostname}}", - "refId": "A" - } - ], - "title": "VRAM used per node", - "description": "FB memory actively used per node. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 6 - }, - "repeatDirection": "h", - "options": { - "displayMode": "gradient", - "valueMode": "color", - "namePlacement": "auto", - "showUnfilled": true, - "sizing": "auto", - "minVizWidth": 8, - "minVizHeight": 16, - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "maxVizHeight": 300, - "orientation": "horizontal" - }, - "fieldConfig": { - "defaults": { - "unit": "bytes", - "min": 0, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Utilization (per-node)", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 14 - }, - "id": 20, - "panels": [] - }, - { - "type": "timeseries", - "id": 21, - "targets": [ - { - "expr": "node:gpu_util:avg", - "legendFormat": "{{Hostname}}", - "refId": "A" - } - ], - "title": "NVML utilization per node", - "description": "Per-node NVML utilization. Stacked to show fleet-wide pressure over time. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 15 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 40, - "showPoints": "never", - "stacking": { - "mode": "normal" - } - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 22, - "targets": [ - { - "expr": "node:tensor_active:avg * 100", - "legendFormat": "{{Hostname}}", - "refId": "A" - } - ], - "title": "Tensor saturation per node", - "description": "Real tensor core load per node. Useful to spot nodes with idle tensor cores. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 15 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "percent", - "min": 0, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 40, - "showPoints": "never", - "stacking": { - "mode": "normal" - } - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Power \u0026 allocation trend", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 23 - }, - "id": 30, - "panels": [] - }, - { - "type": "timeseries", - "id": 31, - "targets": [ - { - "expr": "node:power_watts:sum", - "legendFormat": "{{Hostname}}", - "refId": "A" - } - ], - "title": "Power draw per node", - "description": "Per-node GPU power draw. Stacked to see cluster-wide energy burn over time. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 0, - "y": 24 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "watt", - "min": 0, - "custom": { - "drawStyle": "line", - "lineInterpolation": "linear", - "fillOpacity": 40, - "showPoints": "never", - "stacking": { - "mode": "normal" - } - } - }, - "overrides": [] - } - }, - { - "type": "timeseries", - "id": 32, - "targets": [ - { - "expr": "namespace:gpu_count:allocated{namespace=~\"$namespace\"}", - "legendFormat": "{{namespace}}", - "refId": "A" - } - ], - "title": "Allocated GPUs per namespace", - "description": "Kube-requested GPU count per tenant over time. Step-after interpolation reflects discrete allocation changes.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 8, - "w": 12, - "x": 12, - "y": 24 - }, - "repeatDirection": "h", - "options": { - "legend": { - "displayMode": "table", - "placement": "bottom", - "showLegend": false, - "calcs": [ - "mean", - "max" - ] - }, - "tooltip": { - "mode": "multi", - "sort": "" - } - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "min": 0, - "custom": { - "drawStyle": "line", - "lineInterpolation": "stepAfter", - "fillOpacity": 40, - "showPoints": "never", - "stacking": { - "mode": "normal" - } - } - }, - "overrides": [] - } - }, - { - "type": "row", - "collapsed": false, - "title": "Top consumers (live)", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 32 - }, - "id": 40, - "panels": [] - }, - { - "type": "table", - "id": 41, - "targets": [ - { - "expr": "namespace:gpu_count:allocated{namespace=~\"$namespace\"}", - "instant": true, - "range": false, - "format": "table", - "refId": "gpus" - } - ], - "title": "Top consumers (allocation)", - "description": "Live ranking of tenants by GPU allocation. Hardware metrics (util, tensor, power, VRAM) cannot be attributed to workload namespaces — see Fleet and Performance dashboards for per-node/per-GPU hardware views.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 10, - "w": 24, - "x": 0, - "y": 33 - }, - "repeatDirection": "h", - "transformations": [ - { - "id": "organize", - "options": { - "excludeByName": { - "Time": true, - "Time 1": true, - "Time 2": true, - "Time 3": true, - "Time 4": true, - "Time 5": true, - "__name__": true, - "__name__ 1": true, - "__name__ 2": true, - "__name__ 3": true, - "__name__ 4": true, - "__name__ 5": true, - "cluster": true, - "cluster 1": true, - "cluster 2": true, - "cluster 3": true, - "cluster 4": true, - "cluster 5": true, - "endpoint": true, - "endpoint 1": true, - "endpoint 2": true, - "endpoint 3": true, - "endpoint 4": true, - "endpoint 5": true, - "instance": true, - "instance 1": true, - "instance 2": true, - "instance 3": true, - "instance 4": true, - "instance 5": true, - "job": true, - "job 1": true, - "job 2": true, - "job 3": true, - "job 4": true, - "job 5": true, - "prometheus": true, - "prometheus 1": true, - "prometheus 2": true, - "prometheus 3": true, - "prometheus 4": true, - "prometheus 5": true, - "service": true, - "service 1": true, - "service 2": true, - "service 3": true, - "service 4": true, - "service 5": true, - "tenant": true, - "tenant 1": true, - "tenant 2": true, - "tenant 3": true, - "tenant 4": true, - "tenant 5": true, - "tier": true, - "tier 1": true, - "tier 2": true, - "tier 3": true, - "tier 4": true, - "tier 5": true, - "uid": true, - "uid 1": true, - "uid 2": true, - "uid 3": true, - "uid 4": true, - "uid 5": true, - "unit": true, - "unit 1": true, - "unit 2": true, - "unit 3": true, - "unit 4": true, - "unit 5": true - }, - "indexByName": { - "Value #gpus": 1, - "namespace": 0 - }, - "renameByName": { - "Value #gpus": "GPUs", - "namespace": "Namespace" - } - } - } - ], - "options": { - "frameIndex": 0, - "showHeader": true, - "showTypeIcons": false, - "sortBy": [ - { - "displayName": "GPUs", - "desc": true - } - ], - "footer": { - "show": false, - "reducer": [] - }, - "cellHeight": "sm" - } - }, - { - "type": "row", - "collapsed": false, - "title": "Historical usage (last 24h)", - "gridPos": { - "h": 1, - "w": 24, - "x": 0, - "y": 43 - }, - "id": 50, - "panels": [] - }, - { - "type": "bargauge", - "id": 51, - "targets": [ - { - "expr": "sum_over_time(namespace:gpu_count:allocated{namespace=~\"$namespace\"}[24h:1m]) / 60", - "legendFormat": "{{namespace}}", - "refId": "A" - } - ], - "title": "GPU-hours per namespace (last 24h)", - "description": "Billable GPU-hours per tenant over the last 24h window.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 7, - "w": 12, - "x": 0, - "y": 44 - }, - "repeatDirection": "h", - "options": { - "displayMode": "gradient", - "valueMode": "color", - "namePlacement": "auto", - "showUnfilled": true, - "sizing": "auto", - "minVizWidth": 8, - "minVizHeight": 16, - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "maxVizHeight": 300, - "orientation": "horizontal" - }, - "fieldConfig": { - "defaults": { - "unit": "short", - "decimals": 1, - "min": 0, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "blue" - } - ] - } - }, - "overrides": [] - } - }, - { - "type": "bargauge", - "id": 52, - "targets": [ - { - "expr": "sum_over_time(node:power_watts:sum[24h:1m]) / 60 / 1000", - "legendFormat": "{{Hostname}}", - "refId": "A" - } - ], - "title": "Energy per node (last 24h)", - "description": "kWh consumed per node over the last 24h. Integrated from 1-minute power samples. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.", - "transparent": false, - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "gridPos": { - "h": 7, - "w": 12, - "x": 12, - "y": 44 - }, - "repeatDirection": "h", - "options": { - "displayMode": "gradient", - "valueMode": "color", - "namePlacement": "auto", - "showUnfilled": true, - "sizing": "auto", - "minVizWidth": 8, - "minVizHeight": 16, - "legend": { - "displayMode": "list", - "placement": "bottom", - "showLegend": false, - "calcs": [] - }, - "reduceOptions": { - "calcs": [ - "lastNotNull" - ] - }, - "maxVizHeight": 300, - "orientation": "horizontal" - }, - "fieldConfig": { - "defaults": { - "unit": "kwatth", - "decimals": 2, - "min": 0, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "value": null, - "color": "green" - } - ] - } - }, - "overrides": [] - } - } - ], - "templating": { - "list": [ - { - "type": "datasource", - "name": "ds_prometheus", - "label": "Prometheus", - "skipUrlSync": false, - "query": "prometheus", - "current": { - "selected": false, - "text": "default", - "value": "default" - }, - "multi": false, - "allowCustomValue": true, - "includeAll": false, - "regex": "", - "auto": false, - "auto_min": "10s", - "auto_count": 30 - }, - { - "type": "query", - "name": "namespace", - "label": "Namespace", - "skipUrlSync": false, - "query": "label_values(namespace:gpu_count:allocated, namespace)", - "datasource": { - "type": "prometheus", - "uid": "$ds_prometheus" - }, - "current": { - "selected": true, - "text": "All", - "value": "$__all" - }, - "multi": true, - "allowCustomValue": true, - "refresh": 2, - "sort": 1, - "includeAll": true, - "auto": false, - "auto_min": "10s", - "auto_count": 30 - } - ] - }, - "annotations": {} -} diff --git a/docs/agents/changelog.md b/docs/agents/changelog.md index 2fde1224..feb70597 100644 --- a/docs/agents/changelog.md +++ b/docs/agents/changelog.md @@ -6,20 +6,6 @@ This file contains detailed instructions for AI-powered IDE on how to generate c Follow these instructions when the user explicitly asks to generate a changelog. -## Scope and boundaries - -**Your single deliverable is the file `docs/changelogs/v.md`.** Write the complete, verified changelog to that path. That is the entire task. Exit as soon as the file is written and verified against the checklist in Step 9. - -Unless the caller explicitly instructs otherwise: - -- **In the cozystack working tree**, do not run `git commit`, `git push`, `git checkout` (to switch branches), `git branch`, `git tag`, `git reset`, `git merge`, or `git rebase`. Do not write to local branches, tags, or HEAD. `git fetch` is expected and fine (see the read-only analysis list below). -- **Do not** push to any remote, open pull requests, or issue GitHub API write calls (POST / PATCH / DELETE) for any repository. -- In the cozystack working tree, the **only** file you create or modify is `docs/changelogs/v.md`. Cloning auxiliary repositories under `_repos/` for cross-repo analysis (see Step 6) is fine; local git operations inside those disposable clones (`git checkout`, `git pull`, etc.) are allowed — just never push from them or open PRs against them. - -The caller — a GitHub Actions workflow in CI, or a developer running you interactively — owns branching, committing, pushing, and PR creation. They will perform those actions after you exit. Do not pre-empt them even if the working tree looks ready. - -Read-only analysis is expected and encouraged: `git log`, `git show`, `git fetch`, `git diff`, `gh pr view`, `gh api` GET requests, and reading any file in the repository. - ## Required Tools Before generating changelogs, ensure you have access to `gh` (GitHub CLI) tool, which is used to fetch commit and PR author information. The GitHub CLI is used to correctly identify PR authors from commits and pull requests. @@ -36,7 +22,7 @@ When the user asks to generate a changelog, follow these steps in the specified - [ ] Step 5: Get the list of commits for the release period - [ ] Step 6: Check additional repositories (website is REQUIRED, optional repos if tags exist) - [ ] **MANDATORY**: Check website repository for documentation changes WITH authors and PR links via GitHub CLI - - [ ] **MANDATORY**: Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) for tags during release period + - [ ] **MANDATORY**: Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) for tags during release period - [ ] **MANDATORY**: For ALL commits from additional repos, get GitHub username via CLI, prioritizing PR author over commit author. - [ ] Step 7: Analyze commits (extract PR numbers, authors, user impact) - [ ] **MANDATORY**: For EVERY PR in main repo, get PR author via `gh pr view --json author --jq .author.login` (do NOT skip this step) @@ -162,8 +148,6 @@ Cozystack release may include changes from related repositories. Check and inclu - [https://github.com/cozystack/boot-to-talos](https://github.com/cozystack/boot-to-talos) - [https://github.com/cozystack/cozyhr](https://github.com/cozystack/cozyhr) - [https://github.com/cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -- [https://github.com/cozystack/external-apps-example](https://github.com/cozystack/external-apps-example) -- [https://github.com/cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack) **⚠️ IMPORTANT**: You MUST check ALL optional repositories for tags created during the release period. Do NOT skip this step even if you think there might not be any tags. Use the process below to verify. @@ -211,7 +195,7 @@ Cozystack release may include changes from related repositories. Check and inclu 3. **For optional repositories, check if tags exist during release period:** - **⚠️ MANDATORY: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack). Do NOT skip any repository!** + **⚠️ MANDATORY: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy). Do NOT skip any repository!** **Use the helper script:** ```bash @@ -224,7 +208,7 @@ Cozystack release may include changes from related repositories. Check and inclu ``` The script will: - - Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) + - Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) - Look for tags created during the release period - Get commits between tags (if tags exist) or by date range (if no tags) - Extract PR numbers from commit messages @@ -585,7 +569,7 @@ Create a new changelog file in the format matching previous versions: - [ ] Step 5 completed: **ALL commits included** (including merge commits and backports) - do not skip any commits - [ ] Step 5 completed: **Backports identified and handled correctly** - original PR author used, both original and backport PR numbers included - [ ] Step 6 completed: Website repository checked for documentation changes WITH authors and PR links via GitHub CLI -- [ ] Step 6 completed: **ALL** optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) checked for tags during release period +- [ ] Step 6 completed: **ALL** optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) checked for tags during release period - [ ] Step 6 completed: For ALL commits from additional repos, GitHub username obtained via GitHub CLI (not skipped). For commits with PR numbers, PR author used via `gh pr view` (not commit author) - [ ] Step 7 completed: For EVERY PR in main repo (including backports), PR author obtained via `gh pr view --json author --jq .author.login` (not skipped or assumed). Commit author NOT used - always use PR author - [ ] Step 7 completed: **Backports verified** - for each backport PR, original PR found and original PR author used in changelog @@ -622,8 +606,6 @@ Create a new changelog file in the format matching previous versions: **Save the changelog:** Save the changelog to file `docs/changelogs/v.md` according to the version for which the changelog is being generated. -**Then exit.** Do not commit, push, create a branch, or open a pull request — the caller handles all git and GitHub operations after you return. See the "Scope and boundaries" section at the top of this document. - ### Important notes - **After fetch with --force** local tags are up-to-date, use them for work @@ -646,7 +628,7 @@ Save the changelog to file `docs/changelogs/v.md` according to the vers - **Additional repositories (Step 6) - MANDATORY**: - **⚠️ CRITICAL**: Always check the **website** repository for documentation changes during the release period. This is a required step and MUST NOT be skipped. - - **⚠️ CRITICAL**: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) for tags during the release period. Do NOT skip any repository even if you think there might not be tags. + - **⚠️ CRITICAL**: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) for tags during the release period. Do NOT skip any repository even if you think there might not be tags. - **CRITICAL**: For ALL entries from additional repositories (website and optional), you MUST: - **MANDATORY**: Extract PR number from commit message first - **MANDATORY**: For commits with PR numbers, ALWAYS use `gh pr view --repo cozystack/ --json author --jq .author.login` to get PR author (not commit author) @@ -655,7 +637,7 @@ Save the changelog to file `docs/changelogs/v.md` according to the vers - **MANDATORY**: Do NOT use commit author for PRs - always use PR author - Include PR link or commit hash reference - Format: `* **[repo] Description**: details ([**@username**](https://github.com/username) in cozystack/repo#123)` - - For **optional repositories** (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack), you MUST check ALL of them for tags during the release period. Use the loop provided in Step 6 to check each repository systematically. + - For **optional repositories** (talm, boot-to-talos, cozyhr, cozy-proxy), you MUST check ALL of them for tags during the release period. Use the loop provided in Step 6 to check each repository systematically. - When including changes from additional repositories, use the format: `[repo-name] Description` and link to the repository's PR/issue if available - **Prefer PR numbers over commit hashes**: For commits from additional repositories, extract PR number from commit message using GitHub API. Use PR format (`cozystack/website#123`) instead of commit hash (`cozystack/website@abc1234`) when available - **Never add entries without author and PR/commit reference**: Every entry from additional repositories must have both author and link diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md index 88b062ea..d5a4366e 100644 --- a/docs/agents/contributing.md +++ b/docs/agents/contributing.md @@ -1,140 +1,167 @@ -# Contributing Conventions for AI Agents +# Instructions for AI Agents -Project-side conventions for commits, branches, and pull requests in Cozystack. +Guidelines for AI agents contributing to Cozystack. ## Checklist for Creating a Pull Request -- [ ] Commit message follows Conventional Commits format +- [ ] Changes are made and tested +- [ ] Commit message uses correct `[component]` prefix - [ ] Commit is signed off with `--signoff` - [ ] Branch is rebased on `upstream/main` (no extra commits) - [ ] PR body includes description and release note -- [ ] Ran `make generate` in every package whose `values.yaml`, `values.schema.json`, `Chart.yaml`, or `README.md` was touched, and committed the regenerated files +- [ ] PR is pushed and created with `gh pr create` -## Regenerate Artifacts Before Committing +## How to Commit and Create Pull Requests -Several files in each package are produced by `make generate` from `values.yaml` + `values.schema.json` and must stay in sync with the hand-edited sources: +### 1. Make Your Changes -- `packages/(apps|extra)//README.md` — regenerated by `cozyvalues-gen` (parameter table, formatting). -- `packages/(apps|extra)//values.schema.json` — `cozyvalues-gen` rewrites ordering and derived fields. -- `packages/system/-rd/cozyrds/.yaml` — produced by `hack/update-crd.sh`, which `make generate` invokes. +Edit the necessary files in the codebase. -**Before committing edits to any of those sources**, run `make generate` inside the package and stage the full diff: +### 2. Commit with Proper Format + +Use the `[component]` prefix and `--signoff` flag: ```bash -make -C packages// generate -git add packages/// packages/system/-rd/ +git commit --signoff -m "[component] Brief description of changes" ``` -The repo's pre-commit CI job runs `make generate` in every package and then `git diff --exit-code`. Any unstaged generator output fails the job with exit code 123 and blocks the PR. Also rerun `make generate` after a `git commit --amend` if the amended change touched any of the sources above. - -To locate packages a WIP branch likely needs to be regenerated: - -```bash -git diff --name-only | xargs -n1 dirname | sort -u | grep ^packages/ -``` - -## Commit Format - -Follow [Conventional Commits](https://www.conventionalcommits.org/) with `--signoff`: - -```bash -git commit --signoff -m "type(scope): brief description" -``` - -**Types:** `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore` - -**Scopes** (examples — not an exhaustive list; pick the most specific scope that describes the change, and introduce a new one if a genuinely new area needs its own): - -- System, e.g.: `dashboard`, `platform`, `operator`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api` -- Apps, e.g.: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `virtual-machine`, `kubernetes` -- Other, e.g.: `api`, `hack`, `tests`, `ci`, `docs`, `agents`, `maintenance` - -Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer. +**Component prefixes:** +- System: `[dashboard]`, `[platform]`, `[cilium]`, `[kube-ovn]`, `[linstor]`, `[fluxcd]`, `[cluster-api]` +- Apps: `[postgres]`, `[mariadb]`, `[redis]`, `[kafka]`, `[clickhouse]`, `[virtual-machine]`, `[kubernetes]` +- Other: `[tests]`, `[ci]`, `[docs]`, `[maintenance]` **Examples:** ```bash -git commit --signoff -m "feat(dashboard): add config hash annotations to restart pods on config changes" -git commit --signoff -m "fix(postgres): update operator to version 1.2.3" -git commit --signoff -m "docs(contributing): add installation guide" +git commit --signoff -m "[dashboard] Add config hash annotations to restart pods on config changes" +git commit --signoff -m "[postgres] Update operator to version 1.2.3" +git commit --signoff -m "[docs] Add installation guide" ``` -## PR Title Auto-Labeling +### 3. Rebase on upstream/main (if needed) -`.github/workflows/pr-labeler.yaml` parses the PR title on `opened`, `edited`, `reopened`, and `synchronize` events and applies labels additively (never removes). The title is expected to follow Conventional Commits — same format as commit messages above. - -**Type → `kind/*`:** - -| type | label | -| --------- | ------------------ | -| feat | kind/feature | -| fix | kind/bug | -| docs | kind/documentation | -| chore | kind/cleanup | -| refactor | kind/cleanup | -| style, perf, test, build, ci, revert | (no kind label) | - -**Scope → `area/*`** (full mapping in `.github/workflows/pr-labeler.yaml`): - -| scope (examples) | label | -| --- | --- | -| agents, ai | area/ai | -| api, cozystack-api | area/api | -| build | area/build | -| ci | area/ci | -| dashboard | area/dashboard | -| postgres, mariadb, redis, etcd, kafka, clickhouse, postgres-operator, mariadb-operator | area/database | -| extra | area/extra | -| kubernetes | area/kubernetes | -| monitoring, vlogs, vmstack, grafana, workloadmonitor | area/monitoring | -| ingress, gateway, vpn, metallb, cilium, kube-ovn, cozy-proxy, ... | area/networking | -| platform, bundle, flux, fluxcd, cluster-api, talos, installer, cozyctl, cozystack-engine, cozy-lib | area/platform | -| backport, release | area/release | -| seaweedfs, bucket, linstor, velero, harbor, backups | area/storage | -| tests, e2e | area/testing | -| kubevirt, cdi, vmi, vm-import, virtual-machine, hami, gpu-operator | area/virtualization | - -**Special handling:** - -- `[Backport release-1.x]` prefix is stripped before parsing; `area/release` and `backport` labels are added. -- Composite scope (`feat(platform, system, apps): ...`) — each comma-separated part is mapped independently. -- `!` after type or `BREAKING CHANGE:` footer in the body → `kind/breaking-change`. -- Unmapped scope or non-conventional title → `area/uncategorized` (signals the PR needs manual area selection). -- Bracket-style fallback (`[scope] description`) maps `scope` → `area/*` but cannot infer `kind/*`. - -### AI Agent Attribution - -When an AI agent authors or materially assists with a commit, add an `Assisted-By:` trailer naming the model: - -```text -Assisted-By: Claude -Assisted-By: GPT-5 -Assisted-By: Gemini -``` - -This sits alongside the `Signed-off-by:` trailer produced by `--signoff`. Use one trailer per model if multiple contributed. - -## Rebasing on upstream/main - -If the branch has extra commits, clean it up: +If your branch has extra commits, clean it up: ```bash +# Fetch latest git fetch upstream + +# Create clean branch from upstream/main git checkout -b my-feature upstream/main + +# Cherry-pick only your commit git cherry-pick -git push -f origin my-feature + +# Force push to your branch +git push -f origin my-feature:my-branch-name ``` -## Pull Request Body +### 4. Push Your Branch -Fill in the template at [`.github/PULL_REQUEST_TEMPLATE.md`](../../.github/PULL_REQUEST_TEMPLATE.md). It includes the required `release-note` block. +```bash +git push origin +``` -Create the PR with `gh pr create --title "type(scope): brief description" --body-file `. +### 5. Create Pull Request -## Fetching Unresolved Review Comments +Write the PR body to a temporary file: -Cozystack uses GitHub review threads with resolution status. Only unresolved threads are actionable — resolved threads are already handled. +```bash +cat > /tmp/pr_body.md << 'EOF' +## What this PR does -The REST endpoint `/pulls/{pr}/reviews` returns review summaries, not individual review comments. Use the GraphQL API to access `reviewThreads` with `isResolved` status: +Brief description of the changes. + +Changes: +- Change 1 +- Change 2 + +### Release note + +```release-note +[component] Description for changelog +``` +EOF +``` + +Create the PR: + +```bash +gh pr create --title "[component] Brief description" --body-file /tmp/pr_body.md +``` + +Clean up: + +```bash +rm /tmp/pr_body.md +``` + +## Addressing AI Bot Reviewer Comments + +When the user asks to fix comments from AI bot reviewers (like Qodo, Copilot, etc.): + +### 1. Get PR Comments + +View all comments on the pull request: + +```bash +gh pr view --comments +``` + +Or for the current branch: + +```bash +gh pr view --comments +``` + +### 2. Review Each Comment Carefully + +**Important**: Do NOT blindly apply all suggestions. Each comment should be evaluated: + +- **Consider context** - Does the suggestion make sense for this specific case? +- **Check project conventions** - Does it align with Cozystack patterns? +- **Evaluate impact** - Will this improve code quality or introduce issues? +- **Question validity** - AI bots can be wrong or miss context + +**When to apply:** +- ✅ Legitimate bugs or security issues +- ✅ Clear improvements to code quality +- ✅ Better error handling or edge cases +- ✅ Conformance to project conventions + +**When to skip:** +- ❌ Stylistic preferences that don't match project style +- ❌ Over-engineering simple code +- ❌ Changes that break existing patterns +- ❌ Suggestions that show misunderstanding of the code + +### 3. Apply Valid Fixes + +Make changes addressing the valid comments. Use your judgment. + +### 4. Leave Changes Uncommitted + +**Critical**: Do NOT commit or push the changes automatically. + +Leave the changes in the working directory so the user can: +- Review the fixes +- Decide whether to commit them +- Make additional adjustments if needed + +```bash +# After making changes, show status but DON'T commit +git status +git diff +``` + +The user will commit and push when ready. + +## Code Review Comments + +When asked to fix code review comments, **always work only with unresolved (open) comments**. Resolved comments should be ignored as they have already been addressed. + +### Getting Unresolved Review Comments + +Use GitHub GraphQL API to fetch only unresolved review comments from a pull request: ```bash gh api graphql -F owner=cozystack -F repo=cozystack -F pr= -f query=' @@ -162,7 +189,27 @@ query($owner: String!, $repo: String!, $pr: Int!) { }' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | .comments.nodes[]' ``` -Compact one-line variant: +### Filtering for Unresolved Comments + +The key filter is `select(.isResolved == false)` which ensures only unresolved review threads are processed. Each thread can contain multiple comments, but if the thread is resolved, all its comments should be ignored. + +### Working with Review Comments + +1. **Fetch unresolved comments** using the GraphQL query above +2. **Parse the results** to identify: + - File path (`path`) + - Line number (`line` or `originalLine`) + - Comment text (`bodyText`) + - Author (`author.login`) +3. **Address each unresolved comment** by: + - Locating the relevant code section + - Making the requested changes + - Ensuring the fix addresses the concern raised +4. **Do NOT process resolved comments** - they have already been handled + +### Example: Compact List of Unresolved Comments + +For a quick overview of unresolved comments: ```bash gh api graphql -F owner=cozystack -F repo=cozystack -F pr= -f query=' @@ -186,3 +233,43 @@ query($owner: String!, $repo: String!, $pr: Int!) { } }' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | .comments.nodes[] | "\(.path):\(.line // "N/A") - \(.author.login): \(.bodyText[:150])"' ``` + +### Important Notes + +- **REST API limitation**: The REST endpoint `/pulls/{pr}/reviews` returns review summaries, not individual review comments. Use GraphQL API for accessing `reviewThreads` with `isResolved` status. +- **Thread-based resolution**: Comments are organized in threads. If a thread is resolved (`isResolved: true`), ignore all comments in that thread. +- **Always filter**: Never process comments from resolved threads, even if they appear in the results. + +### Example Workflow + +```bash +# Get PR comments +gh pr view 1234 --comments + +# Review comments and identify valid ones +# Make necessary changes to address valid comments +# ... edit files ... + +# Show what was changed (but don't commit) +git status +git diff + +# Tell the user what was fixed and what was skipped +``` + +## Git Permissions + +Request these permissions when needed: +- `git_write` - For commit, rebase, cherry-pick, branch operations +- `network` - For push, fetch, pull operations + +## Common Issues + +**PR has extra commits?** +→ Rebase on `upstream/main` and cherry-pick only your commits + +**Wrong commit message?** +→ `git commit --amend --signoff -m "[correct] message"` then `git push -f` + +**Need to update PR?** +→ `gh pr edit --body "new description"` diff --git a/docs/agents/overview.md b/docs/agents/overview.md index ae0fd1c4..b6d69e68 100644 --- a/docs/agents/overview.md +++ b/docs/agents/overview.md @@ -78,18 +78,11 @@ packages/// - Add proper error handling and structured logging ### Git Commits -- Follow [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): description` +- Use format: `[component] Description` - Always use `--signoff` flag - Reference PR numbers when available - Keep commits atomic and focused - -### PackageSource CRD upgrade policy - -Each component in a `PackageSource` may set `install.upgradeCRDs` to control how CRDs from the chart's `crds/` directory are handled on `HelmRelease` upgrades. Allowed values: `Skip` (default — helm-controller does not touch CRDs on upgrade), `Create` (create new CRDs only), `CreateReplace` (create new and overwrite existing). - -Set `upgradeCRDs: CreateReplace` for operators whose upstream regularly adds new CRDs between versions (etcd-operator, cnpg, kubevirt, kamaji). Without it, new CRDs from a chart bump do not land on existing clusters — only fresh installs get them. - -Do **not** set `CreateReplace` blindly: it overwrites every CRD in `crds/` and can cause silent data loss if upstream drops a field from a CRD that has live objects. Only enable it for operators whose schema evolution is additive-only. When in doubt, leave it unset and apply new CRDs manually. +- Follow conventional commit format for changelogs ### Documentation diff --git a/docs/changelogs/v1.0.4.md b/docs/changelogs/v1.0.4.md deleted file mode 100644 index 4c55e2f3..00000000 --- a/docs/changelogs/v1.0.4.md +++ /dev/null @@ -1,25 +0,0 @@ - - -## Fixes - -* **[system] Fix Keycloak probe crashloop with management port health endpoints**: Fixed a crashloop where Keycloak 26.x was endlessly restarting because liveness and readiness probes were sending HTTP requests to port 8080. Keycloak 26.x redirects all requests on port 8080 to `KC_HOSTNAME` (HTTPS), and since kubelet does not follow redirects, probes failed, eventually triggering container restarts. The fix switches probes to the dedicated management port 9000 (`/health/live`, `/health/ready`) enabled via `KC_HEALTH_ENABLED=true`, exposes management port 9000, and adds a `startupProbe` with appropriate failure thresholds for better startup tolerance ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162, #2178). - -* **[system] Fix etcd-operator deprecated kube-rbac-proxy image**: Replaced the deprecated `gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0` image with `quay.io/brancz/kube-rbac-proxy:v0.18.1` in the vendored etcd-operator chart. The GCR-hosted image became unavailable after March 18, 2025, causing etcd-operator pods to fail on image pull ([**@kvaps**](https://github.com/kvaps) in #2181, #2183). - -* **[platform] Fix VM MAC address not preserved during virtual-machine to vm-instance migration**: During the `virtual-machine` → `vm-instance` migration (script 29), VM MAC addresses were not preserved. Kube-OVN reads MAC addresses exclusively from the pod annotation `ovn.kubernetes.io/mac_address`, not from `spec.macAddress` of the IP resource. Without this annotation, migrated VMs received a new random MAC address, breaking OS-level network configuration that matches by MAC (e.g., netplan). The fix adds a Helm `lookup` in the vm-instance chart template to read the Kube-OVN IP resource and automatically inject the MAC and IP addresses as pod annotations ([**@sircthulhu**](https://github.com/sircthulhu) in #2169, #2191). - -* **[dashboard] Fix External IPs page showing empty rows**: Fixed the External IPs administration page displaying empty rows instead of service data. The `EnrichedTable` configuration in the `external-ips` factory was using incorrect property names — replaced `clusterNamePartOfUrl` with `cluster` and changed `pathToItems` from array format to dot-path string format, matching the convention used by all other `EnrichedTable` instances ([**@IvanHunters**](https://github.com/IvanHunters) in #2175, #2192). - -* **[dashboard] Fix disabled/hidden state reset on MarketplacePanel reconciliation**: Fixed a bug where the dashboard controller was hardcoding `disabled=false` and `hidden=false` on every reconcile loop, overwriting changes made through the dashboard UI. Services disabled or hidden via the marketplace panel now correctly retain their state after controller reconciliation ([**@IvanHunters**](https://github.com/IvanHunters) in #2176, #2202). - -* **[dashboard] Fix hidden MarketplacePanel resources appearing in sidebar menu**: Fixed the sidebar navigation showing all resources regardless of their MarketplacePanel `hidden` state. The controller now fetches MarketplacePanels during sidebar reconciliation and filters out resources where `hidden=true`, ensuring that hiding a resource from the marketplace also removes it from the sidebar navigation. Listing failures are non-fatal — if the configuration fetch fails, no hiding is applied and the dashboard remains functional ([**@IvanHunters**](https://github.com/IvanHunters) in #2177, #2204). - -## Documentation - -* **[website] Add OIDC self-signed certificates configuration guide**: Added a comprehensive guide for configuring OIDC authentication with Keycloak when using self-signed certificates (the default in Cozystack). Covers Talos machine configuration with certificate mounting and host entries, kubelogin setup instructions, and a troubleshooting section. The guide is available for both v0 and v1 versioned documentation paths ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#443). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.3...v1.0.4 diff --git a/docs/changelogs/v1.0.5.md b/docs/changelogs/v1.0.5.md deleted file mode 100644 index 51f01143..00000000 --- a/docs/changelogs/v1.0.5.md +++ /dev/null @@ -1,29 +0,0 @@ - - -## Fixes - -* **[api] Fix spurious OpenAPI post-processing errors for non-apps group versions**: The API server no longer logs false errors while generating OpenAPI specs for core and other non-`apps.cozystack.io` group versions. The post-processor now exits early when the base `Application` schemas are absent, reducing noisy startup logs without affecting application schema generation ([**@kvaps**](https://github.com/kvaps) in #2212, #2216). - -## Documentation - -* **[website] Add `DependenciesNotReady` troubleshooting and correct packages management build target**: Added a troubleshooting guide for packages stuck in `DependenciesNotReady`, including how to inspect operator logs and identify missing dependencies, and fixed the outdated `make image-cozystack` command to `make image-packages` in the packages management guide ([**@kvaps**](https://github.com/kvaps) in cozystack/website#450). - -* **[website] Clarify operator-first installation order**: Reordered the platform installation guide and tutorial so users install the Cozystack operator before preparing and applying the Platform Package, matching the rest of the installation docs and reducing setup confusion during fresh installs ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#449). - -* **[website] Add automated installation guide for Ansible**: Added end-to-end documentation for deploying Cozystack with the `cozystack.installer` Ansible collection, including inventory examples, distro-specific playbooks, configuration reference, verification steps, and explicit version pinning guidance to help operators automate installs safely ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#442). - -* **[website] Expand CA rotation operations guide**: Completed the CA rotation documentation with separate Talos and Kubernetes certificate rotation procedures, dry-run preview steps, and post-rotation guidance for fetching updated `talosconfig` and `kubeconfig` files after certificate changes ([**@kvaps**](https://github.com/kvaps) in cozystack/website#406). - -* **[website] Improve backup operations documentation**: Enhanced the operator backup and recovery guide with clearer Velero enablement steps, concrete provider and bucket examples, and more useful commands for inspecting backups, schedules, restores, CRD status, and logs ([**@androndo**](https://github.com/androndo) in cozystack/website#440). - -* **[website] Add custom metrics collection guide**: Added a monitoring guide showing how tenants can expose their own Prometheus exporters through `VMServiceScrape` and `VMPodScrape`, including namespace labeling requirements, example manifests, verification steps, and troubleshooting advice ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#444). - -* **[website] Document PackageSource and Package architecture**: Added a Key Concepts reference covering `PackageSource` and `Package` reconciliation flow, dependency handling, update propagation, rollback behavior, FluxPlunger recovery, and the `cozypkg` CLI for package management ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#445). - -* **[website] Refresh v1 application and platform documentation**: Fixed the documentation auto-update flow and published a broad v1 documentation refresh covering newly documented applications, updated naming and navigation, virtualization and platform content updates, and reorganized versioned docs pages ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#439). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.4...v1.0.5 diff --git a/docs/changelogs/v1.0.6.md b/docs/changelogs/v1.0.6.md deleted file mode 100644 index c65c5fd5..00000000 --- a/docs/changelogs/v1.0.6.md +++ /dev/null @@ -1,21 +0,0 @@ - - -## Fixes - -* **[kubernetes] Fix CiliumNetworkPolicy endpointSelector for multi-node RWX volumes**: When an NFS-backed RWX volume is published to multiple VMs, the network policy's `endpointSelector` was only capturing the first VM. Subsequent volume publications added owner references but never broadened the selector, causing Cilium to block NFS egress and making mounts hang on all nodes except the first. The fix switches from `matchLabels` to `matchExpressions` (`operator: In`) so the selector lists all VM names and is rebuilt whenever owner references change ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2227, #2228). - -* **[dashboard] Fix dashboard authentication failures after secret recreation**: Added a `secret-hash` annotation containing the SHA256 hash of the client secret to the dashboard `KeycloakClient` resource. Without this annotation, if the `dashboard-client` Secret was recreated (e.g. after an upgrade or reinstall), the `KeycloakClient` spec stayed unchanged, the EDP Keycloak operator skipped reconciliation, and Keycloak kept the stale secret — causing dashboard authentication failures. Now any secret value change updates the annotation hash, triggering operator reconciliation and syncing the new secret to Keycloak ([**@sircthulhu**](https://github.com/sircthulhu) in #2231, #2240). - -* **[etcd] Fix defrag CronJob accumulating pods during cluster upgrades**: Added protective limits to the etcd defragmentation CronJob to prevent job pile-up when etcd is temporarily unavailable during upgrades. Without `concurrencyPolicy: Forbid`, new jobs kept being created hourly while previous ones were still failing, accumulating hundreds of running/failed pods across tenants. The fix adds `concurrencyPolicy: Forbid`, a `startingDeadlineSeconds: 300` guard against missed schedules, a 30-minute job timeout, and limits retries to 2 ([**@sircthulhu**](https://github.com/sircthulhu) in #2233, #2235). - -## Documentation - -* **[website] Document `keycloakInternalUrl` platform value**: Added documentation for the `authentication.oidc.keycloakInternalUrl` platform value to the Platform Package Reference, Self-Signed Certificates guide, and Enable OIDC Server pages. This value routes dashboard backend OIDC requests through the internal Keycloak service, which is useful in environments with self-signed certificates ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#452). - -* **[website] Publish Cozystack v1.0 release announcement**: Added the official Cozystack v1.0 release announcement blog post and supporting images, celebrating the first stable release of the platform ([**@tym83**](https://github.com/tym83) in cozystack/website#453, cozystack/website#454). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.5...v1.0.6 diff --git a/docs/changelogs/v1.0.7.md b/docs/changelogs/v1.0.7.md deleted file mode 100644 index 942115bf..00000000 --- a/docs/changelogs/v1.0.7.md +++ /dev/null @@ -1,27 +0,0 @@ - - -## Fixes - -* **[platform] Fix tenant admins unable to create FoundationDB, Harbor, MongoDB, OpenBAO, OpenSearch, Qdrant, and VPN applications**: The `cozy:tenant:admin:base` ClusterRole was missing RBAC entries for `foundationdbs`, `harbors`, `mongodbs`, `openbaos`, `opensearches`, `qdrants`, and `vpns` resources from `apps.cozystack.io`. Without these permissions, tenant admins could not create these applications — the "Add" button was inactive in the dashboard. The fix adds all seven missing resource verbs ([**@sircthulhu**](https://github.com/sircthulhu) in #2268, #2271). - -* **[system] Fix 403 error on Service details page for tenant users**: The `cozy:tenant:base` and `cozy:tenant:view:base` ClusterRoles were missing read permissions for `discovery.k8s.io/endpointslices`. The dashboard requests EndpointSlices to display the "Pod serving" section on the Service details page, and without this permission tenant users received a 403 error. The fix adds `get`, `list`, and `watch` verbs for endpointslices to both tenant roles ([**@sircthulhu**](https://github.com/sircthulhu) in #2257, #2284). - -* **[dashboard] Fix "Pod serving" table showing "Raw:" prefixes and "Invalid Date" on Service details page**: The EndpointSlice table on the service details page displayed raw data and broken timestamps because the `EnrichedTable` component referenced the `factory-kube-service-details-endpointslice` customization ID which had no corresponding `CustomColumnsOverride`. The fix adds column definitions for Pod (`.targetRef.name`), Addresses (`.addresses`), Ready (`.conditions.ready`), and Node (`.nodeName`) ([**@sircthulhu**](https://github.com/sircthulhu) in #2266, #2282). - -* **[dashboard] Fix broken backup menu links missing cluster context**: Backup resources (plans, backupjobs, backups) are not `ApplicationDefinitions`, so `ensureNavigation()` never created their `baseFactoriesMapping` entries. Without these mappings, the OpenUI frontend could not resolve the `{cluster}` context for backup pages, producing broken sidebar links with an empty cluster segment (e.g. `/openapi-ui//tenant-root/...` instead of `/openapi-ui/default/tenant-root/...`). The fix adds the three missing static entries to the Navigation resource ([**@sircthulhu**](https://github.com/sircthulhu) in #2232, #2270). - -* **[linstor] Fix swapped VMPodScrape job labels causing incorrect alerts**: The `job` labels in the `cozy-linstor` VictoriaMetrics `VMPodScrape` templates were swapped: `linstor-satellite` metrics were relabeled as `job=linstor-controller` and vice versa. This caused `linstorControllerOffline` alerts to fire against satellite endpoints (`:9942`) while reporting the controller as unreachable. The fix ensures `linstor-satellite` metrics keep `job=linstor-satellite` and `linstor-controller` metrics keep `job=linstor-controller`, restoring consistent alerting and dashboard semantics ([**@sasha-sup**](https://github.com/sasha-sup) in #2264, #2288). - -* **[piraeus-operator] Fix LINSTOR satellite alert annotations and reduce false-positive alerts**: Two issues in the LINSTOR alerts shipped by `cozy-piraeus-operator` were fixed. First, `linstorSatelliteErrorRate` used a non-existent `name` label in annotations, resulting in `Satellite ""` in alert notifications — corrected to use `{{ $labels.hostname }}`. Second, `linstorSatelliteErrorRate` produced false positives when the `linstor-controller` scrape flapped and historical `linstor_error_reports_count` counters reappeared inside the alert window — fixed by requiring stable `up{job="linstor-controller"}` for the full 15-minute window. Additionally, the controller availability alert was split to add a dedicated warning for metrics scrape failures with a 10-minute hold time to reduce transient noise ([**@sasha-sup**](https://github.com/sasha-sup) in #2265, #2287). - -## Documentation - -* **[website] Add Backup and Recovery guide for VMInstance and VMDisk**: Replaced the generic Kubernetes Backup and Recovery guide with a virtualization-focused Backup and Recovery doc covering VMInstance and VMDisk one-off and scheduled backups, restores, status checks, and troubleshooting (including Velero-related notes) ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#456). - -* **[website] Update developer guide with operator-driven architecture and OCIRepository/migration flow**: Rewrote the development guide to describe the operator-driven in-cluster architecture, bootstrap flow, operator responsibilities, and platform install/update sequence. Added documentation for OCIRepositories and the migration flow with migration hook examples and sequencing rules for pre-upgrade/install migrations. Also updated the concepts guide with the two-repository update model, dependency ordering rules, namespace creation behavior, and cluster-wide values injection ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#458). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.6...v1.0.7 diff --git a/docs/changelogs/v1.1.0.md b/docs/changelogs/v1.1.0.md deleted file mode 100644 index ad61c1a6..00000000 --- a/docs/changelogs/v1.1.0.md +++ /dev/null @@ -1,126 +0,0 @@ - - -# Cozystack v1.1.0 - -Cozystack v1.1.0 delivers a major expansion of the managed application catalog with **OpenBAO** (open-source HashiCorp Vault fork) for secrets management, comprehensive **tiered object storage** with SeaweedFS storage pools, a new bucket **user model** with per-user credentials and S3 login support, **RabbitMQ version selection**, and **MongoDB Grafana dashboards**. The dashboard gains storageClass dropdowns for all stateful apps. This release also incorporates all fixes from the v1.0.x patch series. - -## Feature Highlights - -### OpenBAO: Managed Secrets Management Service - -Cozystack now ships **OpenBAO** as a fully managed PaaS application — an open-source fork of HashiCorp Vault providing enterprise-grade secrets management. Users can deploy OpenBAO instances in standalone mode (single replica with file storage) or in high-availability Raft mode (multiple replicas with integrated Raft consensus), with the mode switching automatically based on the `replicas` field. - -Each OpenBAO instance gets TLS enabled by default via cert-manager self-signed certificates, with DNS SANs covering all service endpoints and pod addresses. The Vault injector and CSI provider are intentionally disabled (they are cluster-scoped components not safe for per-tenant use). OpenBAO requires manual initialization and unsealing by design — no auto-unseal is configured. - -A full end-to-end E2E test covers the complete lifecycle: deploy, wait for certificate and API readiness, init, unseal, verify, and cleanup. OpenBAO is available in the application catalog for tenant namespaces. - -### SeaweedFS Tiered Storage Pools - -SeaweedFS now supports **tiered storage pools** — operators can define separate storage pools per disk type (SSD, HDD, NVMe) in the `volume.pools` field (Simple topology) or `volume.zones[name].pools` (MultiZone topology). Each pool creates an additional Volume StatefulSet alongside the default one, with SeaweedFS distinguishing storage via the `-disk=` flag on volume servers. - -Each pool automatically generates its own set of COSI resources: a standard `BucketClass`, a `-lock` BucketClass (COMPLIANCE mode, 365-day retention), a read-write `BucketAccessClass`, and a `-readonly` BucketAccessClass. This allows applications to place data on specific storage tiers and request appropriate access policies per pool. - -In MultiZone topology, pools are defined per zone and each zone × pool combination creates a dedicated StatefulSet (e.g., `us-east-ssd`, `us-west-hdd`), with nodes selected via `topology.kubernetes.io/zone` labels. Existing deployments with no pools defined produce output identical to previous versions — no migration is required. - -### Bucket User Model with S3 Login - -The bucket application introduces a new **user model** for access management. Instead of a single implicit BucketAccess resource, operators now define a `users` map where each entry creates a dedicated `BucketAccess` with its own credentials secret and an optional `readonly` flag. The S3 Manager UI has been updated with a login screen that uses per-session credentials from the user's own secret, replacing the previous basic-auth approach. - -Two new bucket parameters are available: `locking` provisions from the `-lock` BucketClass (COMPLIANCE mode, 365-day object lock retention) for write-once-read-many use cases, and `storagePool` selects a specific pool's BucketClass for tiered storage placement. The COSI driver has been updated to v0.3.0 to support the new `diskType` parameter. - -**⚠️ Breaking change**: The implicit default BucketAccess resource is no longer created. Existing buckets that relied on the single auto-generated BucketAccess will need to explicitly define users in the `users` map after upgrading. - -### RabbitMQ Version Selection - -RabbitMQ instances now support a configurable **version selector** (`version` field with values: `v4.2`, `v4.1`, `v4.0`, `v3.13`; default `v4.2`). The chart validates the selection at deploy time and uses it to pin the runtime image, giving operators control over the RabbitMQ release channel per instance. An automatic migration backfills the `version` field on all existing RabbitMQ resources to `v4.2`. - -## Major Features and Improvements - -* **[apps] Add OpenBAO as a managed secrets management service**: Deployed as a PaaS application with standalone (file storage) and HA Raft modes, TLS enabled by default via cert-manager, injector and CSI provider disabled for tenant safety, and a full E2E lifecycle test ([**@lexfrei**](https://github.com/lexfrei) in #2059). - -* **[seaweedfs] Add storage pools support for tiered storage**: Added `volume.pools` (Simple) and `volume.zones[name].pools` (MultiZone) for per-disk-type StatefulSets, zone overrides (`nodeSelector`, `storageClass`, `dataCenter`), per-pool COSI BucketClass and BucketAccessClass resources, and bumped seaweedfs-cosi-driver to v0.3.0 ([**@sircthulhu**](https://github.com/sircthulhu) in #2097). - -* **[apps][system] Add bucket user model with locking and storage pool selection**: Replaced implicit BucketAccess with per-user `users` map, added `locking` and `storagePool` parameters, renamed COSI BucketClass suffix from `-worm` to `-lock`, added `-readonly` BucketAccessClass for all topologies, and updated S3 Manager with login screen using per-user credentials ([**@IvanHunters**](https://github.com/IvanHunters) in #2119). - -* **[rabbitmq] Add version selection for RabbitMQ instances**: Added `version` field (`v4.2`, `v4.1`, `v4.0`, `v3.13`) with chart-level validation, default `v4.2`, and an automatic migration to backfill the field on existing instances ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2092). - -* **[system] Add MongoDB Overview and InMemory Details Grafana dashboards**: Added two comprehensive Grafana dashboards for MongoDB monitoring — Overview (command operations, connections, cursors, query efficiency, write time) and InMemory Details (WiredTiger cache, transactions, concurrency, eviction). Dashboards are registered in `dashboards.list` for automatic GrafanaDashboard CRD generation ([**@IvanHunters**](https://github.com/IvanHunters) in #2158). - -* **[dashboard] Add storageClass dropdown for all stateful apps**: Replaced the free-text `storageClass` input with an API-backed dropdown listing available StorageClasses from the cluster. Affects ClickHouse, Harbor, HTTPCache, Kubernetes, MariaDB, MongoDB, NATS, OpenBAO, Postgres, Qdrant, RabbitMQ, Redis, VMDisk (top-level `storageClass`), FoundationDB (`storage.storageClass`), and Kafka (`kafka.storageClass`, `zookeeper.storageClass`) ([**@sircthulhu**](https://github.com/sircthulhu) in #2131). - -* **[bucket] Add readonly S3 access credentials**: Added a readonly `BucketAccessClass` to the SeaweedFS COSI chart and updated the bucket application to automatically provision two sets of S3 credentials per bucket: read-write (for UI) and readonly ([**@IvanHunters**](https://github.com/IvanHunters) in #2105). - -* **[dashboard] Hide sidebar on cluster-level pages when no tenant selected**: Fixed broken URLs with double `//` on the main cluster page (before tenant selection) by clearing `CUSTOMIZATION_SIDEBAR_FALLBACK_ID` so no sidebar renders when no namespace is selected ([**@sircthulhu**](https://github.com/sircthulhu) in #2106). - -* **[cert-manager] Update cert-manager to v1.19.3**: Upgraded cert-manager with new CRDs moved into a dedicated CRD package, added global `nodeSelector` and `hostUsers` (pod user-namespace isolation), and renamed `ServiceMonitor` targetPort default to `http-metrics` ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2070). - -* **[dashboard] Add backupClasses dropdown to Plan/BackupJob forms**: Replaced free-text input for `backupClass` field with an API-backed dropdown populated with available BackupClass resources, making it easier to select the correct backup target ([**@androndo**](https://github.com/androndo) in #2104). - -## Fixes - -* **[platform] Fix package name conversion in migration script**: Fixed the `migrate-to-version-1.0.sh` script to correctly prepend the `cozystack.` prefix when converting `BUNDLE_DISABLE` and `BUNDLE_ENABLE` package name lists, ensuring packages are properly identified during the v0.41→v1.0 upgrade ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2144, #2148). - -* **[backups] Fix RBAC for backup controllers**: Updated RBAC permissions for the backup strategy controller to support enhanced backup and restore capabilities, including Velero integration and status management ([**@androndo**](https://github.com/androndo) in #2145). - -* **[kubernetes] Set explicit MTU for Cilium in tenant clusters**: Set explicit MTU 1350 for Cilium in KubeVirt-based tenant Kubernetes clusters to prevent packet drops caused by VXLAN encapsulation overhead. Cilium's auto-detection does not account for VXLAN overhead (50 bytes) when the VM interface inherits MTU 1400 from the parent OVN/Geneve overlay, causing intermittent connectivity issues and HTTP 499 errors under load ([**@IvanHunters**](https://github.com/IvanHunters) in #2147). - -* **[platform] Prevent cozystack-version ConfigMap from deletion**: Added resource protection annotations to prevent the `cozystack-version` ConfigMap from being accidentally deleted, improving platform stability ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2112, #2114). - -* **[installer] Add keep annotation to Namespace and update migration script**: Added `helm.sh/resource-policy: keep` annotation to the `cozy-system` Namespace in the installer Helm chart to prevent Helm from deleting the namespace and all HelmReleases within it when the installer release is removed. The v1.0 migration script is also updated to annotate the namespace and `cozystack-version` ConfigMap before migration ([**@kvaps**](https://github.com/kvaps) in #2122, #2123). - -* **[dashboard] Add FlowSchema to exempt BFF from API throttling**: Added a `cozy-dashboard-exempt` FlowSchema to exempt the dashboard Back-End-for-Frontend service account from Kubernetes API Priority and Fairness throttling, preventing 429 errors under load ([**@kvaps**](https://github.com/kvaps) in #2121, #2124). - -* **[platform] Suspend cozy-proxy if it conflicts with installer release during migration**: Added a check in the v0.41→v1.0 migration script to detect and suspend the `cozy-proxy` HelmRelease when its `releaseName` is set to `cozystack`, which conflicts with the installer release and would cause `cozystack-operator` deletion during the upgrade ([**@kvaps**](https://github.com/kvaps) in #2128, #2130). - -* **[platform] Fix off-by-one error in run-migrations script**: Fixed a bug in the migration runner where the first required migration was always skipped due to an off-by-one error in the migration range calculation ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2126, #2132). - -* **[system] Fix Keycloak proxy configuration for v26.x**: Replaced the deprecated `KC_PROXY=edge` environment variable with `KC_PROXY_HEADERS=xforwarded` and `KC_HTTP_ENABLED=true` in the Keycloak StatefulSet. `KC_PROXY` was removed in Keycloak 26.x, previously causing "Non-secure context detected" warnings and broken cookie handling behind a reverse proxy with TLS termination ([**@sircthulhu**](https://github.com/sircthulhu) in #2125, #2134). - -* **[dashboard] Allow clearing instanceType field and preserve newlines in secret copy**: Added `allowEmpty: true` to the `instanceType` field in the VMInstance form so users can explicitly clear it to use custom KubeVirt resources without a named instance type. Also fixed newline preservation when copying secrets with CMD+C ([**@sircthulhu**](https://github.com/sircthulhu) in #2135, #2137). - -* **[dashboard] Restore stock-instance sidebars for namespace-level pages**: Restored `stock-instance-api-form`, `stock-instance-api-table`, `stock-instance-builtin-form`, and `stock-instance-builtin-table` sidebar resources that were inadvertently removed in #2106. Without these sidebars, namespace-level pages such as Backup Plans rendered as empty pages ([**@sircthulhu**](https://github.com/sircthulhu) in #2136, #2138). - -## System Configuration - -* **[platform] Disable private key rotation in CA certs**: Set `rotationPolicy: Never` for all CA/root certificates used by system components (ingress-nginx, linstor, linstor-scheduler, seaweedfs, victoria-metrics-operator, kubeovn-webhook, lineage-controller-webhook, cozystack-api, etcd, linstor API/internal) to prevent trust chain problems when CA certificates are reissued ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2113). - -## Development, Testing, and CI/CD - -* **[ci] Add debug improvements for CI tests**: Added extra debug commands for Kubernetes startup diagnostics and improved error output in CI test runs ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2111). - -## Documentation - -* **[website] Add object storage guide (pools, buckets, users)**: Added a comprehensive guide covering SeaweedFS object storage configuration including storage pools for tiered storage, bucket creation with access classes, per-user credential management, and credential rotation procedures ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#438). - -* **[website] Add Build Your Own Platform (BYOP) guide**: Added a new "Build Your Own Platform" guide and split the installation documentation into platform installation and BYOP sub-pages, with cross-references throughout the documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#437). - -* **[website] Add white labeling guide**: Added a comprehensive guide for configuring white labeling (branding) in Cozystack v1, covering Dashboard fields (`titleText`, `footerText`, `tenantText`, `logoText`, `logoSvg`, `iconSvg`) and Keycloak fields (`brandName`, `brandHtmlName`). Includes SVG preparation workflow with theme-aware template variables and portable base64 encoding ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#441). - -* **[website] Actualize backup and recovery documentation**: Reworked the backup and recovery docs to be user-focused, separating operator and tenant workflows. Added tenant-facing documentation for `BackupJob` and `Plan` resources and a new Velero administration guide for operators ([**@androndo**](https://github.com/androndo) in cozystack/website#434). - -* **[website] Add step to protect namespace before upgrading**: Updated the cluster upgrade guide and v0.41→v1.0 migration guide with a required step to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with `helm.sh/resource-policy=keep` before running `helm upgrade` ([**@kvaps**](https://github.com/kvaps) in cozystack/website#435). - -* **[website] Replace bundles documentation with variants**: Renamed the "Bundles" documentation section to "Variants" to match current Cozystack terminology. Removed deprecated variants and added new ones: `default` and `isp-full-generic` ([**@kvaps**](https://github.com/kvaps) in cozystack/website#433). - -* **[website] Fix component values override instructions**: Corrected the component values override documentation to reflect current configuration patterns ([**@kvaps**](https://github.com/kvaps) in cozystack/website#436). - -## Breaking Changes & Upgrade Notes - -* **[bucket] Bucket user model now requires explicit user definitions**: The implicit default `BucketAccess` resource is no longer created automatically. Existing buckets that relied on a single auto-generated credential secret will need to define users explicitly in the `users` map after upgrading. Each user entry creates its own `BucketAccess` resource and credential secret (optionally with `readonly: true`). The COSI BucketClass suffix has also been renamed from `-worm` to `-lock` ([**@IvanHunters**](https://github.com/IvanHunters) in #2119). - -## Contributors - -We'd like to thank all contributors who made this release possible: - -* [**@androndo**](https://github.com/androndo) -* [**@IvanHunters**](https://github.com/IvanHunters) -* [**@kvaps**](https://github.com/kvaps) -* [**@lexfrei**](https://github.com/lexfrei) -* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) -* [**@sircthulhu**](https://github.com/sircthulhu) - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0...v1.1.0 diff --git a/docs/changelogs/v1.1.1.md b/docs/changelogs/v1.1.1.md deleted file mode 100644 index 18bb6814..00000000 --- a/docs/changelogs/v1.1.1.md +++ /dev/null @@ -1,23 +0,0 @@ - - -## Fixes - -* **[dashboard] Fix hidden MarketplacePanel resources appearing in sidebar menu**: The sidebar was generated independently from MarketplacePanels, always showing all resources regardless of their `hidden` state. Fixed by fetching MarketplacePanels during sidebar reconciliation and skipping resources where `hidden=true`, so hiding a resource from the marketplace also removes it from the sidebar navigation ([**@IvanHunters**](https://github.com/IvanHunters) in #2177, #2203). - -* **[dashboard] Fix disabled/hidden state overwritten on every MarketplacePanel reconciliation**: The controller was hardcoding `disabled=false` and `hidden=false` on every reconciliation, silently overwriting any user changes made through the dashboard UI. Fixed by reading and preserving the current `disabled`/`hidden` values from the existing resource before updating ([**@IvanHunters**](https://github.com/IvanHunters) in #2176, #2201). - -* **[dashboard] Fix External IPs factory EnrichedTable rendering**: The external-IPs table displayed empty rows because the factory used incorrect `EnrichedTable` properties. Replaced `clusterNamePartOfUrl` with `cluster` and changed `pathToItems` from array to dot-path string format, consistent with all other working `EnrichedTable` instances ([**@IvanHunters**](https://github.com/IvanHunters) in #2175, #2193). - -* **[platform] Fix VM MAC address not preserved during virtual-machine to vm-instance migration**: Kube-OVN reads MAC address exclusively from the pod annotation `ovn.kubernetes.io/mac_address`, not from the IP resource `spec.macAddress`. Without the annotation, migrated VMs received a new random MAC, breaking OS-level network configurations that match by MAC (e.g. netplan). Added a Helm `lookup` for the Kube-OVN IP resource in the vm-instance chart so that MAC and IP addresses are automatically injected as pod annotations when the resource exists ([**@sircthulhu**](https://github.com/sircthulhu) in #2169, #2190). - -* **[etcd-operator] Replace deprecated kube-rbac-proxy image**: The `gcr.io/kubebuilder/kube-rbac-proxy` image became unavailable after Google Container Registry was deprecated. Replaced it with `quay.io/brancz/kube-rbac-proxy` from the original upstream author, restoring etcd-operator functionality ([**@kvaps**](https://github.com/kvaps) in #2181, #2182). - -* **[migrations] Handle missing RabbitMQ CRD in migration 34**: Migration 34 failed with an error when the `rabbitmqs.apps.cozystack.io` CRD did not exist — which occurs on clusters where RabbitMQ was never installed. Added a CRD presence check before attempting to list resources so that migration 34 completes cleanly on such clusters ([**@IvanHunters**](https://github.com/IvanHunters) in #2168, #2180). - -* **[keycloak] Fix Keycloak crashloop due to misconfigured health probes**: Keycloak 26.x redirects all HTTP requests on port 8080 to the configured HTTPS hostname; since kubelet does not follow redirects, liveness and readiness probes failed causing a crashloop. Fixed by enabling `KC_HEALTH_ENABLED=true`, exposing management port 9000, and switching all probes to `/health/live` and `/health/ready` on port 9000. Also added a `startupProbe` for improved startup tolerance ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162, #2179). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.0...v1.1.1 diff --git a/docs/changelogs/v1.1.2.md b/docs/changelogs/v1.1.2.md deleted file mode 100644 index 29dba321..00000000 --- a/docs/changelogs/v1.1.2.md +++ /dev/null @@ -1,25 +0,0 @@ - - -## Fixes - -* **[bucket] Fix S3 Manager endpoint mismatch with COSI credentials**: The S3 Manager UI previously constructed an `s3..` endpoint even though COSI-issued bucket credentials point to the root-level S3 endpoint. This caused login failures with "invalid credentials" despite valid secrets. The deployment now uses the actual endpoint from `BucketInfo`, with the old namespace-based endpoint kept only as a fallback before `BucketAccess` secrets exist ([**@IvanHunters**](https://github.com/IvanHunters) in #2211, #2215). - -* **[platform] Fix spurious OpenAPI post-processing errors on cozystack-api startup**: The OpenAPI post-processor was being invoked for non-`apps.cozystack.io` group versions where the base `Application*` schemas do not exist, producing noisy startup errors on every API server launch. It now skips those non-apps group versions gracefully instead of returning an error ([**@kvaps**](https://github.com/kvaps) in #2212, #2217). - -## Documentation - -* **[website] Add troubleshooting for packages stuck in `DependenciesNotReady`**: Added an operations guide that explains how to diagnose missing package dependencies in operator logs and corrected the packages management development docs to use the current `make image-packages` target ([**@kvaps**](https://github.com/kvaps) in cozystack/website#450). - -* **[website] Reorder installation docs to install the operator before the platform package**: Updated the platform installation guide and tutorial so the setup sequence consistently installs the Cozystack operator first, then prepares and applies the Platform Package, matching the rest of the documentation set ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#449). - -* **[website] Add automated installation guide for the Ansible collection**: Added a full guide for deploying Cozystack with the `cozystack.installer` collection, including inventory examples, distro-specific playbooks, configuration reference, and explicit version pinning guidance ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#442). - -* **[website] Expand monitoring and platform architecture reference docs**: Added a tenant custom metrics collection guide for `VMServiceScrape` and `VMPodScrape`, and documented `PackageSource`/`Package` architecture, reconciliation flow, rollback behavior, and the `cozypkg` workflow in Key Concepts ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#444, cozystack/website#445). - -* **[website] Improve operations guides for CA rotation and Velero backups**: Completed the CA rotation documentation with dry-run and post-rotation credential retrieval steps, and expanded the backup configuration guide with concrete examples, verification commands, and clearer operator procedures ([**@kvaps**](https://github.com/kvaps) in cozystack/website#406; [**@androndo**](https://github.com/androndo) in cozystack/website#440). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.1...v1.1.2 diff --git a/docs/changelogs/v1.1.3.md b/docs/changelogs/v1.1.3.md deleted file mode 100644 index f589476e..00000000 --- a/docs/changelogs/v1.1.3.md +++ /dev/null @@ -1,19 +0,0 @@ - - -## Fixes - -* **[kubernetes] Fix CiliumNetworkPolicy endpointSelector not updated for multi-node RWX volumes**: When an NFS-backed RWX volume was published to multiple VMs, the `CiliumNetworkPolicy` `endpointSelector.matchLabels` was set only for the first VM and never broadened on subsequent `ControllerPublishVolume` calls. This caused Cilium to block NFS egress so that mounts hung on all nodes except the first. The selector now uses `matchExpressions` with `operator: In` and is rebuilt whenever owner references are added or removed ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2227, #2229). - -* **[dashboard] Fix dashboard-client secret desynchronization with Keycloak after upgrades**: When the `dashboard-client` Kubernetes Secret was recreated with a new value after an upgrade or reinstall, the `KeycloakClient` spec remained unchanged and the EDP Keycloak operator skipped reconciliation, leaving Keycloak with the stale secret and causing authentication failures for the dashboard. A `secret-hash` annotation containing the SHA256 hash of the client secret is now added to the `KeycloakClient` resource; any secret rotation updates the hash in metadata, triggering operator reconciliation and syncing the new secret to Keycloak ([**@sircthulhu**](https://github.com/sircthulhu) in #2231, #2241). - -* **[etcd] Fix defrag CronJob accumulating hundreds of pods during cluster upgrades**: After upgrading CozyStack, the etcd defrag CronJob could accumulate hundreds of running and failed pods when etcd was temporarily unavailable during the upgrade, because no concurrency or retry limits were configured. Added `concurrencyPolicy: Forbid` to prevent parallel jobs, `startingDeadlineSeconds: 300` to discard missed schedules older than 5 minutes, `failedJobsHistoryLimit: 1` to limit failure retention, `activeDeadlineSeconds: 1800` for a 30-minute per-job timeout, and `backoffLimit: 2` to cap retries ([**@sircthulhu**](https://github.com/sircthulhu) in #2233, #2234). - -## Documentation - -* **[website] Document `keycloakInternalUrl` platform value**: Added reference documentation for the `authentication.oidc.keycloakInternalUrl` platform value to the Platform Package Reference, Self-Signed Certificates guide, and Enable OIDC Server guide, explaining how to route dashboard backend OIDC requests through the internal Keycloak service URL ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#452). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.2...v1.1.3 diff --git a/docs/changelogs/v1.1.4.md b/docs/changelogs/v1.1.4.md deleted file mode 100644 index f1e4ede9..00000000 --- a/docs/changelogs/v1.1.4.md +++ /dev/null @@ -1,41 +0,0 @@ - - -## Features and Improvements - -* **[boot-to-talos] Add support for ISO, RAW, and HTTP image sources**: The `boot-to-talos` tool can now use ISO files, raw disk images, and HTTP URLs as Talos image sources in addition to container registry images. This allows bootstrapping nodes in air-gapped environments or from locally stored images without requiring a container registry ([**@lexfrei**](https://github.com/lexfrei) in cozystack/boot-to-talos#13). - -* **[boot-to-talos] Use permanent MAC address for predictable network interface names**: Interface name detection now reads the permanent MAC address directly from sysfs instead of relying on udev data, providing a stable hardware MAC that is unaffected by user modifications to the active MAC address. This makes network interface naming more reliable across reboots and hardware changes ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/boot-to-talos#14). - -## Fixes - -* **[dashboard] Fix broken backup menu links missing cluster context**: Backup resources (plans, backupjobs, backups) are not `ApplicationDefinition`s, so `ensureNavigation()` never created their `baseFactoriesMapping` entries. Without these entries the OpenUI frontend could not resolve the `{cluster}` context for backup pages, producing broken sidebar links with an empty cluster segment (e.g. `/openapi-ui//tenant-root/...`). The missing `baseFactoriesMapping` entries for all backup resource types are now added to the static `Navigation` resource ([**@sircthulhu**](https://github.com/sircthulhu) in #2232, #2269). - -* **[platform] Fix tenant admins unable to create FoundationDB, Harbor, MongoDB, OpenBAO, OpenSearch, Qdrant, and VPN applications**: The `cozy:tenant:admin:base` `ClusterRole` was missing seven application resources from `apps.cozystack.io` (`foundationdbs`, `harbors`, `mongodbs`, `openbaos`, `opensearches`, `qdrants`, `vpns`). Without these permissions, tenant admins could not create these applications — the "Add" button was inactive in the dashboard. The missing resources have been added to the ClusterRole ([**@sircthulhu**](https://github.com/sircthulhu) in #2268, #2272). - -* **[dashboard] Fix StorageClass dropdown showing "Error" in application forms**: The dashboard UI fetches `StorageClass` resources to populate dropdowns (e.g. in the Postgres form), but the `cozystack-dashboard-readonly` `ClusterRole` did not include `storage.k8s.io/storageclasses`. This caused authenticated users to see "Error" instead of the StorageClass name. `get`/`list`/`watch` permissions for `storageclasses` have been added to the dashboard readonly role ([**@sircthulhu**](https://github.com/sircthulhu) in #2267, #2274). - -* **[system] Fix 403 error on Service details page by granting tenants read access to EndpointSlices**: The dashboard requested `EndpointSlices` from the `discovery.k8s.io` API group to display the "Pod serving" section on the Service details page, but `cozy:tenant:base` and `cozy:tenant:view:base` `ClusterRole`s lacked permissions for this resource. Tenant users received a 403 error when opening the Service details page. `get`/`list`/`watch` permissions for `endpointslices` have been added to both tenant ClusterRoles ([**@sircthulhu**](https://github.com/sircthulhu) in #2257, #2285). - -* **[dashboard] Fix "Pod serving" table displaying "Raw:" and "Invalid Date" on Service details page**: The Service details page `EndpointSlice` table showed "Raw:" prefixes and "Invalid Date" values because the `EnrichedTable` referenced `customizationId` `factory-kube-service-details-endpointslice` which had no corresponding `CustomColumnsOverride`. Column definitions for Pod (`.targetRef.name`), Addresses (`.addresses`), Ready (`.conditions.ready`), and Node (`.nodeName`) have been added ([**@sircthulhu**](https://github.com/sircthulhu) in #2266, #2283). - -* **[piraeus-operator] Fix LINSTOR satellite alert labels, reduce scrape-flap false positives, and improve controller alerting**: Three alerting issues in `cozy-piraeus-operator` have been addressed: (1) `linstorSatelliteErrorRate` used a non-existent `name` label in annotations, resulting in `Satellite ""` in alert notifications — corrected to `{{ $labels.hostname }}`; (2) `linstorSatelliteErrorRate` could produce false positives when the `linstor-controller` scrape flapped and historical `linstor_error_reports_count` counters reappeared inside the alert window — fixed by adding a minimum scrape-count guard; (3) The `LinstorControllerOffline` alert has been split into separate availability and metrics-availability alerts with configurable hold time to reduce noise during brief connectivity interruptions ([**@sasha-sup**](https://github.com/sasha-sup) in #2265, #2286). - -* **[linstor] Fix swapped VMPodScrape job labels causing incorrect controller offline alerts**: The `cozy-linstor` VictoriaMetrics `VMPodScrape` templates had the `job` relabeling rules swapped: `linstor-satellite` metrics were labeled as `job=linstor-controller` and vice versa. This caused `linstorControllerOffline` alerts to fire for satellite endpoints (`:9942`) while reporting that the controller was unreachable. The `job` labels are now correctly assigned to their respective targets ([**@sasha-sup**](https://github.com/sasha-sup) in #2264, #2289). - -* **[boot-to-talos] Fix triple-fault on hosts with 5-level paging (LA57) enabled**: On hosts with `CONFIG_X86_5LEVEL=y` in the kernel, kexec into Talos caused a triple-fault because the Talos kernel does not support 5-level page tables. `boot-to-talos` now detects LA57 before kexec and automatically patches GRUB with `no5lvl`, runs `update-grub`, and reboots. After reboot with 5-level paging disabled, `boot-to-talos` proceeds normally ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/boot-to-talos#15). - -* **[boot-to-talos] Fix EFI boot entry creation when using loop device images**: Talos installer skips EFI variable creation when running on loop devices. `boot-to-talos` now creates a proper UEFI boot entry with an `HD()` device path pointing to the real target disk's ESP by reading the GPT partition table from the target disk after image copy, instead of relying on the Talos installer ([**@kvaps**](https://github.com/kvaps) in cozystack/boot-to-talos#16). - -* **[talm] Fix silent empty output when no template files are specified**: Running `talm template` without `--file` or `--template` flags previously produced minimal or empty output without any error. Validation has been added to `engine.Render` to return a clear error message when no template files are specified, making misconfigured invocations immediately apparent ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#112). - -## Documentation - -* **[website] Add documentation for VMInstance and VMDisk backups**: Added a new virtualization-focused Backup and Recovery guide covering one-off and scheduled backups for `VMInstance` and `VMDisk` resources, restore procedures, status verification commands, and troubleshooting notes including Velero-related issues ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#456). - -* **[website] Update developer guide with operator-driven architecture and OCIRepository migration flow**: Rewrote the development guide to describe the operator-driven in-cluster architecture, bootstrap flow, operator responsibilities, and the platform install/update sequence. Added an "OCIRepositories and Migration Flow" section with migration hook examples and sequencing rules for pre-upgrade hooks ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#458). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.3...v1.1.4 diff --git a/docs/changelogs/v1.1.5.md b/docs/changelogs/v1.1.5.md deleted file mode 100644 index e756bdd9..00000000 --- a/docs/changelogs/v1.1.5.md +++ /dev/null @@ -1,13 +0,0 @@ - - -## Fixes - -* **[platform] Prevent installed packages deletion**: Added the `helm.sh/resource-policy: keep` annotation to all platform packages. Previously, moving a package to `disabledPackages` or removing it from `enabledPackages` caused Helm to automatically delete it, contradicting the documented behavior that requires the platform administrator to manually delete packages when needed ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2273, #2298). - -* **[linstor] Fix TCP port mismatches after toggle-disk operations causing DRBD resources to enter StandAlone state**: During toggle-disk operations, `removeLayerData()` freed TCP ports from the number pool and `ensureStackDataExists()` could then allocate different ports. If a satellite missed the resulting update (e.g. due to a controller restart), it retained the old ports while peers received the new ones, causing DRBD connections to fail with StandAlone state. The fix introduces `copyDrbdTcpPortsIfExists()`, which preserves existing TCP ports in the `LayerPayload` before `removeLayerData()` releases them ([**@kvaps**](https://github.com/kvaps) in #2292, #2300). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.4...v1.1.5 diff --git a/docs/changelogs/v1.1.6.md b/docs/changelogs/v1.1.6.md deleted file mode 100644 index 77c49475..00000000 --- a/docs/changelogs/v1.1.6.md +++ /dev/null @@ -1,19 +0,0 @@ - - -## Fixes - -* **[build] Filter git describe to match only v* tags**: Adds `--match 'v*'` to all `git describe` calls in `hack/common-envs.mk`. The `api/apps/v1alpha1/*` subtags share the same commit as release tags, causing `git describe --exact-match` to pick `api/apps/v1alpha1/vX.Y.Z` instead of `vX.Y.Z`, producing invalid Docker image tags ([**@kvaps**](https://github.com/kvaps) in #2386, #2388). - -## Development, Testing, and CI/CD - -* **[ci] Replace cozystack-bot PAT with cozystack-ci GitHub App**: Replaces the long-lived `cozystack-bot` personal access token with short-lived, scoped tokens from the `cozystack-ci` GitHub App across all release workflows. Improves security and auditability of CI operations ([**@tym83**](https://github.com/tym83) in #2351). - -* **[ci] Replace GH_PAT with cozystack-ci GitHub App token in pull-requests workflow**: Switches the pull-requests release workflow to use the cozystack-ci GitHub App token instead of the personal access token ([**@kvaps**](https://github.com/kvaps) in #2383). - -* **[ci] Use cozystack org noreply email for bot commits**: Updates CI workflows to use the cozystack organization noreply email for bot commits ([**@kvaps**](https://github.com/kvaps) in #2392). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.5...v1.1.6 diff --git a/docs/changelogs/v1.2.0.md b/docs/changelogs/v1.2.0.md deleted file mode 100644 index 7c5b5e24..00000000 --- a/docs/changelogs/v1.2.0.md +++ /dev/null @@ -1,204 +0,0 @@ - - -# Cozystack v1.2.0 - -> **⚠️ WARNING: Do not use this release.** This version includes CloudNativePG operator, which updates the default PostgreSQL image to version 18. CNPG is unable to perform the migration from the previous major version automatically, which will cause PostgreSQL clusters to fail to start after the upgrade. Please use [v1.2.1](https://github.com/cozystack/cozystack/releases/tag/v1.2.1) instead. - -Cozystack v1.2.0 delivers significant platform enhancements: a fully managed **OpenSearch** service joining the application catalog, **VPC peering** for secure inter-tenant networking, tenant workload placement control via the new **SchedulingClass** system, a highly-available **VictoriaLogs cluster** replacing the single-node setup, and **Linstor volume relocation** for optimized clone and snapshot restore placement. Additional highlights include external-dns as a standalone extra package, multi-node RWX volume fixes, and a wave of dashboard and monitoring improvements. - -## Feature Highlights - -### OpenSearch: Managed Search and Analytics Service - -Cozystack now ships **OpenSearch** as a fully managed PaaS application — supporting OpenSearch v1, v2, and v3 in a multi-role topology with dedicated master, data, ingest, coordinating, and ML nodes. TLS is enabled by default, HTTP Basic auth is provided out of the box, and custom user definitions allow per-application credentials. The optional **OpenSearch Dashboards** UI can be enabled alongside the engine. External access, topology spread policies, and a comprehensive JSON schema are all included. - -A companion `opensearch-operator` system package wraps the upstream Opster OpenSearch Operator v2.8.0 and adds a sysctl DaemonSet to configure the required `vm.max_map_count` kernel parameter on every node automatically. An ApplicationDefinition package ties everything into the Cozystack platform dashboard with schema validation and resource management. - -### SchedulingClass: Tenant Workload Placement - -Cozystack now supports a **SchedulingClass** CRD that allows platform operators to define cluster-wide scheduling constraints — pinning tenant workloads to specific data centers, hardware generations, or node groups without requiring tenants to manage scheduler configuration themselves. Tenants declare a `schedulingClass` in their Tenant spec; the platform injects the appropriate `schedulerName` into all workloads in that namespace. - -The `lineage-controller-webhook` has been extended to verify the referenced SchedulingClass CR before injection, and child tenants inherit their parent's scheduling constraints (children cannot override). A **SchedulingClass dropdown** in the Tenant creation form in the dashboard makes the feature fully self-service. The underlying `cozystack-scheduler` — a custom kube-scheduler extension with SchedulingClass-aware affinity plugins — is now installed and enabled by default as part of the platform. - -### VPC Peering for Multi-Tenant Environments - -The `vpc` application gains bilateral **VPC peering** using Kube-OVN's native `vpcPeerings` mechanism, allowing tenants to securely interconnect their private networks without routing traffic through public endpoints. Peering link-local IPs (`169.254.0.0/16`) are allocated deterministically from a hash of the sorted VPC pair names, ensuring stable addresses across reconciliations. Static route support (`staticRoutes`) enables fine-grained inter-VPC routing policies. A `cozy-lib` helper (`hexToInt`) performs the deterministic IP allocation, and a JSON Schema validation enforces the `^tenant-` namespace pattern for peered VPCs. - -### VictoriaLogs: Clustered Mode for High Availability - -The platform's log storage has been upgraded from the deprecated single-node `VLogs` CR to a **VLCluster** deployment with separate vlinsert, vlselect, and vlstorage components, each running with 2 replicas by default — consistent with the existing VMCluster setup. This brings horizontal scalability and resilience to the logging tier. VPA autoscaling is enabled for all VLCluster components, and the victoria-metrics-operator has been upgraded from v0.55.0 to v0.68.1 to add VLCluster CRD support. - -### Linstor CSI: Volume Relocation After Clone and Restore - -The Linstor CSI driver now carries upstream patches enabling **automatic replica relocation** after PVC clone and snapshot restore operations. Two new parameters control the behavior: `linstor.csi.linbit.com/relocateAfterClone` on StorageClasses moves replicas to optimal nodes after a clone, and `snap.linstor.csi.linbit.com/relocate-after-restore` on VolumeSnapshotClasses does the same after a restore. VolumeSnapshotClasses for Velero and Kasten use cases are pre-configured. This enables full PVC-level backup and restore workflows with automatic data rebalancing, a key prerequisite for production Velero/Kasten integrations. - -## Major Features and Improvements - -* **[apps] Add managed OpenSearch service**: Deployed as a PaaS application supporting OpenSearch v1/v2/v3 with multi-role node topology, TLS, HTTP Basic auth, custom users, optional OpenSearch Dashboards UI, external access, and topology spread policies; backed by the opster OpenSearch Operator v2.8.0 and a sysctl DaemonSet for `vm.max_map_count` ([**@matthieu-robin**](https://github.com/matthieu-robin) in #1953). - -* **[vpc] Add VPC peering support for multi-tenant environments**: Bilateral VPC peering via Kube-OVN's `vpcPeerings`, deterministic link-local IP allocation from sorted VPC pair hash, static routes support, ConfigMap peer discovery enrichment, and JSON Schema validation enforcing `^tenant-` namespace pattern ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2152). - -* **[monitoring] Migrate VictoriaLogs from VLogs to VLCluster**: Replaced deprecated single-node `VLogs` CR with clustered `VLCluster` (vlinsert/vlselect/vlstorage, 2 replicas each), added VPA for all components, upgraded victoria-metrics-operator to v0.68.1 ([**@sircthulhu**](https://github.com/sircthulhu) in #2153). - -* **[scheduler] Integrate SchedulingClass support for tenant workloads**: Added `schedulingClass` Tenant parameter with inheritance enforcement, `scheduling.cozystack.io/class` namespace label, lineage-webhook extension to verify and inject `schedulerName`, SchedulingClass dropdown in Tenant dashboard form ([**@sircthulhu**](https://github.com/sircthulhu) in #2223). - -* **[cozystack-scheduler] Add custom scheduler as an optional system package**: Vendored `cozystack-scheduler` from github.com/cozystack/cozystack-scheduler — a kube-scheduler extension with SchedulingClass-aware affinity plugins, including Helm chart with RBAC, ConfigMap, Deployment, and CRD ([**@lllamnyp**](https://github.com/lllamnyp) in #2205). - -* **[platform] Enable cozystack-scheduler by default**: The cozystack-scheduler and SchedulingClass CRD are now installed as default system packages; the backup tool has been moved to optional packages ([**@lllamnyp**](https://github.com/lllamnyp) in #2253). - -* **[extra] Add external-dns as a standalone extra package**: Packaged external-dns as an installable extra (tenant-level) component for automatic DNS record management from Kubernetes Service and Ingress resources ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1988). - -* **[linstor] Add linstor-csi patches for clone/snapshot relocation**: New patch enabling `relocateAfterClone` StorageClass parameter and `relocate-after-restore` VolumeSnapshotClass parameter; pre-configured VolumeSnapshotClasses for Velero and relocation workflows; CDI switched to csi-clone strategy ([**@kvaps**](https://github.com/kvaps) in #2133). - -* **[monitoring] Add inlineScrapeConfig support to tenant vmagent**: Tenants can now define inline scrape configurations directly in their VMAgent spec, enabling custom metrics collection from services that are not discoverable via standard Kubernetes service discovery ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2200). - -* **[monitoring] Add Slack dashboard URL, vmagent environment label, and dynamictext Grafana plugin**: Added `SLACK_DASHBOARD_URL` and `SLACK_SUMMARY_FMT` environment variables for richer alert notifications, per-vmagent `environment` label for metric source identification, and the `dynamictext-panel` plugin for Grafana dashboards ([**@vnyakas**](https://github.com/vnyakas) in #2210). - -* **[monitoring] Scope infrastructure dashboards to tenant-root only**: Infrastructure-level Grafana dashboards are now scoped to the tenant-root namespace only, preventing them from appearing in tenant sub-namespaces and reducing dashboard noise ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2197). - -* **[tenant] Allow egress to virt-handler for VM metrics scraping**: Extended tenant NetworkPolicy to permit egress to virt-handler pods, enabling Prometheus to scrape VM-level metrics from KubeVirt without additional policy exceptions ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2199). - -* **[dashboard] Add keycloakInternalUrl for backend-to-backend OIDC requests**: Added a `keycloakInternalUrl` platform value for the dashboard backend to perform OIDC token introspection via an internal cluster URL, avoiding external round-trips and improving reliability in air-gapped environments ([**@sircthulhu**](https://github.com/sircthulhu) in #2224). - -* **[dashboard] Add secret-hash annotation to KeycloakClient for secret sync**: Added a `secret-hash` annotation to the KeycloakClient resource so that changes to the client secret trigger automatic reconciliation and propagation to dependent components ([**@sircthulhu**](https://github.com/sircthulhu) in #2231). - -* **[docs] Add OpenAPI and Go types code generation for apps**: Added tooling to generate OpenAPI schemas and Go types from Helm chart values, enabling type-safe programmatic access to managed application configurations and automatic API reference generation ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2214). - -## Improvements (minor) - -* **[cozystack-scheduler] Update to v0.2.0**: Updated the cozystack-scheduler to v0.2.0 with improved SchedulingClass affinity handling ([**@lllamnyp**](https://github.com/lllamnyp) in #2244). - -* **[platform] Ensure cozystack-packages OCIRepository updates reliably**: Added configuration to ensure the `cozystack-packages` OCIRepository resource is consistently reconciled and reflects the latest package versions on upgrade ([**@sircthulhu**](https://github.com/sircthulhu) in #2246). - -* **[etcd] Add protective limits to defrag CronJob**: Added CPU and memory resource limits to the etcd defragmentation CronJob to prevent it from starving other workloads during scheduled defragmentation runs ([**@sircthulhu**](https://github.com/sircthulhu) in #2233). - -* **[platform] Add missing apps to tenant admin RBAC**: Extended the tenant admin ClusterRole to include RBAC permissions for recently added applications that were missing from the role binding ([**@sircthulhu**](https://github.com/sircthulhu) in #2268). - -## Bug Fixes - -* **[keycloak] Fix health probe configuration for Keycloak v26.x+**: Replaced deprecated `KC_PROXY=edge` with `KC_PROXY_HEADERS=xforwarded`/`KC_HTTP_ENABLED=true`; replaced liveness/readiness probes with management port endpoints (`/health/live`, `/health/ready`) and added a `startupProbe` to handle slow Keycloak startup without triggering premature restarts ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162). - -* **[migrations] Handle missing RabbitMQ CRD in migration 34**: Fixed a crash in migration script 34 that occurred when the RabbitMQ CRD was not yet installed, allowing upgrades from environments where RabbitMQ was never deployed ([**@IvanHunters**](https://github.com/IvanHunters) in #2168). - -* **[platform] Fix VM MAC address not preserved during migration**: Fixed the `virtual-machine` to `vm-instance` migration script to correctly carry over the MAC address, preventing network identity changes after upgrading existing VM resources ([**@sircthulhu**](https://github.com/sircthulhu) in #2169). - -* **[dashboard] Fix External IPs factory EnrichedTable rendering**: Corrected the External IPs factory component to use the EnrichedTable renderer, resolving blank/broken rendering of the external IP address list in the dashboard ([**@IvanHunters**](https://github.com/IvanHunters) in #2175). - -* **[dashboard] Preserve disabled/hidden state on MarketplacePanel reconciliation**: Fixed a regression where MarketplacePanel reconciliation would reset the `disabled` and `hidden` flags set by operators, causing hidden applications to reappear in the catalog ([**@IvanHunters**](https://github.com/IvanHunters) in #2176). - -* **[dashboard] Exclude hidden MarketplacePanel resources from sidebar menu**: Fixed the sidebar to omit applications that have been hidden via MarketplacePanel flags, preventing inaccessible menu entries from being displayed to users ([**@IvanHunters**](https://github.com/IvanHunters) in #2177). - -* **[etcd-operator] Replace deprecated kube-rbac-proxy image**: Replaced the unmaintained `gcr.io/kubebuilder/kube-rbac-proxy` sidecar with the actively maintained `quay.io/brancz/kube-rbac-proxy` image to eliminate deprecation warnings and ensure continued security updates ([**@kvaps**](https://github.com/kvaps) in #2181). - -* **[backups] Fix RBAC and backupstrategy-controller location**: Corrected role bindings and the deployment location for the backup strategy controller to restore full backup and restore functionality ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2149). - -* **[api] Skip OpenAPI post-processor for non-apps group versions**: Fixed the API server to bypass OpenAPI schema post-processing for non-`apps` group versions, preventing schema corruption in unrelated API groups ([**@kvaps**](https://github.com/kvaps) in #2212). - -* **[bucket] Fix s3manager endpoint mismatch with COSI credentials**: Corrected the S3 Manager UI to use the actual S3 endpoint from the BucketInfo COSI resource rather than a hardcoded value, resolving connection failures when the S3 endpoint differs from the default ([**@IvanHunters**](https://github.com/IvanHunters) in #2211). - -* **[kubernetes] Fix tenant Kubernetes cluster creation for versions < 1.32**: Resolved a template rendering error that prevented creation of tenant Kubernetes clusters with versions older than 1.32 ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2209). - -* **[kube-ovn] Fix MASTER_NODES detection for multi-master Kubernetes clusters**: Updated kube-ovn configuration to discover control-plane nodes via the standard `node-role.kubernetes.io/control-plane` label rather than relying on static node lists, fixing OVN connectivity issues in multi-master generic Kubernetes deployments ([**@lexfrei**](https://github.com/lexfrei) in #2245). - -* **[kubernetes] Fix CiliumNetworkPolicy endpointSelector for multi-node RWX volumes**: Corrected the CiliumNetworkPolicy endpoint selector for NFS-based ReadWriteMany volumes to properly allow NFS traffic when data is spread across multiple Linstor storage nodes ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2227). - -* **[csi] Hide disk.img and lost+found from RWX NFS mounts**: Fixed the Linstor CSI NFS server to exclude internal files (`disk.img`, `lost+found`) from being visible inside NFS-mounted volumes, preventing application errors caused by unexpected files in volume root directories ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2243). - -* **[dashboard] Fix broken backup menu links missing cluster context**: Restored cluster context in backup-related sidebar navigation links, fixing 404 errors when navigating to BackupJob and Plan pages from the cluster-level dashboard view ([**@kvaps**](https://github.com/kvaps) in #2232). - -* **[dashboard] Fix StorageClass dropdown "Error" state by granting RBAC read access**: Added a ClusterRole/ClusterRoleBinding to grant authenticated users read access to StorageClass resources, resolving the "Error" state displayed in StorageClass dropdowns on application forms ([**@sircthulhu**](https://github.com/sircthulhu) in #2267). - -* **[postgres] Fix database deletion lifecycle management**: Added cleanup stages to delete databases and orphaned roles when removed from `values.databases`, enabling declarative database lifecycle management and preventing stale data retention ([**@sircthulhu**](https://github.com/sircthulhu) in #2247). - -* **[dashboard] Fix JSONPath crash on Tenant details with resourceQuotas**: Restored fallback protection for unresolved flatMap placeholders in the ResourceQuota "Used" column, preventing JSONPath parser crashes on the Tenant details page ([**@sircthulhu**](https://github.com/sircthulhu) in #2249). - -* **[system] Fix tenant RBAC for endpointslices read access**: Added `discovery.k8s.io/endpointslices` read permissions to tenant ClusterRoles, resolving 403 errors on the Service details page when displaying the "Pod serving" section ([**@sircthulhu**](https://github.com/sircthulhu) in #2257). - -* **[linstor] Fix swapped VMPodScrape job labels**: Corrected the `job` label relabeling in LINSTOR VictoriaMetrics PodScrape templates, fixing `linstorControllerOffline` alerts that incorrectly reported satellite endpoints as controller failures ([**@sasha-sup**](https://github.com/sasha-sup) in #2264). - -* **[piraeus-operator] Fix LINSTOR satellite alert labels and scrape flapping false positives**: Fixed non-existent `name` label in `linstorSatelliteErrorRate` alert annotations (changed to `hostname`) and prevented false positives caused by scrape flapping and stale metric counters ([**@sasha-sup**](https://github.com/sasha-sup) in #2265). - -* **[dashboard] Fix EndpointSlice column definitions for Pod serving table**: Added missing `CustomColumnsOverride` for the EndpointSlice table on service details page, replacing "Raw:" prefixes and "Invalid Date" values with proper Pod, Addresses, Ready, and Node columns ([**@sircthulhu**](https://github.com/sircthulhu) in #2266). - -## Dependencies & Version Updates - -* **[cilium] Update Cilium to v1.19.1**: Upgraded the Cilium CNI to v1.19.1 with latest bug fixes and performance improvements ([**@BROngineer**](https://github.com/BROngineer) in #2173). - -* **[keycloak-operator] Update to v1.32.0**: Updated the Keycloak Operator to v1.32.0 (based on epam/edp-keycloak-operator with upstream patches), bumping Keycloak to 26.5.2 ([**@lllamnyp**](https://github.com/lllamnyp) in #2206). - -* **[postgres-operator] Update to v1.27.3**: Upgraded the Postgres Operator (Patroni-based) to v1.27.3 with latest upstream fixes ([**@dmpopoff**](https://github.com/dmpopoff) in #2226). - -* **[objectstorage-controller] Update to v0.2.2, drop upstreamed patches**: Updated the object storage controller to v0.2.2 and removed patches that were accepted upstream, reducing the maintenance delta ([**@lexfrei**](https://github.com/lexfrei) in #2261). - -* **[kilo] Switch from fork to upstream squat/kilo**: Replaced the Cozystack-maintained Kilo fork with the upstream `squat/kilo` image now that required patches (`--internal-cidr`, allowed-location-ips fix, preferred source for WireGuard routes, Cilium IPIP overlay support) have been merged upstream ([**@lexfrei**](https://github.com/lexfrei) in #2259). - -* **[talos] Bump Talos to v1.12.6**: Updated the pinned Talos version to v1.12.6 ([**@kvaps**](https://github.com/kvaps) in #2254). - -* **[talm] Release v0.22.4** (github.com/cozystack/talm): Fixed `--file`/`--template` flag requirement to prevent ambiguous invocations ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#112). - -* **[boot-to-talos] Release v0.7.0** (github.com/cozystack/boot-to-talos): Added support for ISO, RAW, and HTTP image sources ([**@lexfrei**](https://github.com/lexfrei) in cozystack/boot-to-talos#13); permanent MAC addresses for predictable interface names ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/boot-to-talos#14); detection and workaround for 5-level paging (LA57) incompatibility with kexec ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/boot-to-talos#15). - -* **[boot-to-talos] Release v0.7.1** (github.com/cozystack/boot-to-talos): Fixed EFI boot entry creation to use the target disk rather than relying on the installer disk, preventing boot failures on bare-metal systems ([**@kvaps**](https://github.com/kvaps) in cozystack/boot-to-talos#16). - -## Development, Testing, and CI/CD - -* **[tests] Stabilize E2E Kubernetes tests**: Comprehensive improvements to E2E test stability: pre-cleanup of leftover resources, fixes for port-forward race conditions and leaks, improved NFS PVC timeout and debug output, proper EXIT trap handling, and increased CAPI deployment timeouts ([**@lexfrei**](https://github.com/lexfrei) in #2262). - -* **[ci] Fix E2E check blocking docs-only PRs**: Moved path filtering to the job level so that documentation-only pull requests are not blocked by pending E2E CI checks ([**@IvanHunters**](https://github.com/IvanHunters) in #2170). - -* **[ci] Add timeout-minutes to Build and E2E jobs**: Added explicit `timeout-minutes` constraints to Build and E2E workflow jobs to prevent stuck runners from consuming CI resources indefinitely. - -## Documentation - -* **[website] Complete CA rotation documentation**: Added comprehensive CA certificate rotation procedures for all Cozystack system components ([**@kvaps**](https://github.com/kvaps) in cozystack/website#406). - -* **[website] Add Ansible automated installation guide**: Added a step-by-step guide for automated Cozystack installation using Ansible playbooks ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#442). - -* **[website] Add self-signed certificates configuration guide for OIDC**: Added documentation for configuring Cozystack to use self-signed TLS certificates with OIDC providers, covering certificate authority setup and kubeconfig integration ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#443). - -* **[website] Add custom metrics collection guide**: Added a guide explaining how to configure custom Prometheus scrape targets using the new `inlineScrapeConfig` feature of tenant VMAgent ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#444). - -* **[website] Add PackageSource/Package architecture to Key Concepts**: Documented the PackageSource and Package CRD architecture, explaining how operators extend the platform with custom application catalogs ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#445). - -* **[website] Add SchedulingClass operations guide**: Added a guide covering SchedulingClass CRD creation, tenant assignment, and workload placement verification ([**@lllamnyp**](https://github.com/lllamnyp) in cozystack/website#455). - -* **[website] Add VMInstance and VMDisk backups documentation**: Added user-facing documentation for backing up and restoring virtual machine instances and VM disk images using Velero ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#456). - -* **[website] Update developer guide**: Updated the developer guide with current build, test, and contribution workflows including OCIRepository and migration tooling ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#458). - -* **[website] Document keycloakInternalUrl platform value**: Added documentation explaining how to configure `keycloakInternalUrl` for backend-to-backend OIDC token introspection in cluster-internal environments ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#452). - -* **[website] Add DependenciesNotReady troubleshooting guide**: Added a troubleshooting article explaining how to diagnose and resolve the `DependenciesNotReady` package status condition ([**@kvaps**](https://github.com/kvaps) in cozystack/website#450). - -* **[website] Reorder installation steps for operator-before-platform**: Updated the installation guide to install the cozystack-operator before applying the platform package, reflecting the correct dependency order ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#449). - -* **[website] Update managed apps reference**: Updated the automatically generated managed applications reference documentation to reflect new apps and schema changes in this release ([**@app/github-actions**](https://github.com/apps/github-actions) in cozystack/website#448). - -* **[website] Update screenshots for Cozystack v1.1**: Refreshed dashboard screenshots to reflect the updated UI in Cozystack v1.1 ([**@kvaps**](https://github.com/kvaps) in cozystack/website#447). - -* **[website] Enhance operator backups guide**: Improved the backup and recovery guide for operators with additional recovery scenarios and procedures ([**@androndo**](https://github.com/androndo) in cozystack/website#440). - -## Contributors - -We'd like to thank all contributors who made this release possible: - -* [**@androndo**](https://github.com/androndo) -* [**@BROngineer**](https://github.com/BROngineer) -* [**@dmpopoff**](https://github.com/dmpopoff) -* [**@IvanHunters**](https://github.com/IvanHunters) -* [**@kvaps**](https://github.com/kvaps) -* [**@lexfrei**](https://github.com/lexfrei) -* [**@lllamnyp**](https://github.com/lllamnyp) -* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri) -* [**@matthieu-robin**](https://github.com/matthieu-robin) -* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) -* [**@sasha-sup**](https://github.com/sasha-sup) -* [**@sircthulhu**](https://github.com/sircthulhu) -* [**@tym83**](https://github.com/tym83) -* [**@vnyakas**](https://github.com/vnyakas) - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.0...v1.2.0 diff --git a/docs/changelogs/v1.2.1.md b/docs/changelogs/v1.2.1.md deleted file mode 100644 index 29e3fdf6..00000000 --- a/docs/changelogs/v1.2.1.md +++ /dev/null @@ -1,31 +0,0 @@ - - -## Features and Improvements - -* **[postgres] Hardcode PostgreSQL 17 for monitoring databases and add migration**: CloudNativePG operator defaults to PostgreSQL 18.3 when no explicit image is specified, but monitoring queries in Grafana and Alerta rely on PostgreSQL 17 features such as `pg_stat_checkpointer` and the updated `pg_stat_bgwriter`. This mismatch could break monitoring after fresh installs or database recreation. PostgreSQL 17.7 images are now hardcoded for monitoring databases, and migration 37 is added to set version v17 for any existing PostgreSQL resources ([**@IvanHunters**](https://github.com/IvanHunters) in #2304, #2309). - -## Fixes - -* **[platform] Prevent installed packages deletion**: Added the `helm.sh/resource-policy: keep` annotation to all platform packages. Previously, moving a package to `disabledPackages` or removing it from `enabledPackages` caused Helm to automatically delete the corresponding resource, contradicting the documented behavior that requires the platform administrator to manually delete packages when needed ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2273, #2297). - -* **[linstor] Preserve TCP ports during toggle-disk operations**: During toggle-disk operations, `removeLayerData()` freed TCP ports from the number pool and `ensureStackDataExists()` could then allocate different ports. If a satellite missed the resulting update (e.g. due to a controller restart), it retained the old ports while peers received the new ones, causing DRBD connections to fail with StandAlone state. The fix adds `copyDrbdTcpPortsIfExists()` which saves existing TCP ports into the `LayerPayload` before `removeLayerData()` deletes them ([**@kvaps**](https://github.com/kvaps) in #2292, #2299). - -* **[platform] Fix resource allocation ratios not propagated to managed packages**: A regression introduced in the bundle restructure caused `cpuAllocationRatio`, `memoryAllocationRatio`, and `ephemeralStorageAllocationRatio` set in `platform/values.yaml` to become no-ops — they were never written to the `cozystack-values` Secret that cozy-lib reads in child packages. This meant all managed applications silently used the hardcoded defaults (10, 1, 40) regardless of operator-configured values. The fix restores propagation by writing the ratios into the `_cluster` section of the `cozystack-values` Secret and passing `cpuAllocationRatio` to the KubeVirt Package component ([**@sircthulhu**](https://github.com/sircthulhu) in #2296, #2301). - -* **[linstor] Fix DRBD connectivity failures on kernels without `crct10dif` by setting verify-alg to `crc32c`**: LINSTOR's auto-verify algorithm selection defaults to `crct10dif`, but this kernel crypto module is no longer available in newer kernels (e.g. Talos v1.12.6, kernel 6.18.18). When `crct10dif` is unavailable, DRBD peer connections fail with `VERIFYAlgNotAvail: failed to allocate crct10dif for verify`, causing all DRBD resources to enter Diskless state and lose quorum. `DrbdOptions/Net/verify-alg` is now set to `crc32c` at the controller level ([**@kvaps**](https://github.com/kvaps) in #2303, #2312). - -* **[multus] Fix stale sandbox reservations permanently blocking pod creation after CNI ADD failure**: After a node disruption (e.g. DRBD or kube-ovn issues during upgrade), containerd accumulated stale sandbox name reservations. Cleanup failed because multus called delegate plugins for DEL without cached state and they rejected the incomplete config, causing DEL to fail instead of succeeding. Stale entries were never released, permanently blocking new pod creation on the affected node. A custom multus-cni image is now built with a patch that returns success from DEL when CNI ADD never completed ([**@kvaps**](https://github.com/kvaps) in #2313, #2314). - -* **[multus] Pin master CNI to `05-cilium.conflist` to prevent race condition at boot**: During node boot or Talos upgrade, multus auto-detects the master CNI conflist by scanning the CNI config directory. If kube-ovn writes `10-kube-ovn.conflist` before Cilium writes `05-cilium.conflist`, multus selects the wrong file and pods bypass the Cilium chain entirely, have no Cilium endpoint, and their traffic is blocked by cluster-wide network policies. `multusMasterCNI` is now pinned to `05-cilium.conflist` ([**@kvaps**](https://github.com/kvaps) in #2315, #2316). - -## Documentation - -* **[website] Add custom Keycloak themes documentation**: Added documentation for custom Keycloak theme injection to the White Labeling guide, covering the theme image contract (`/themes/` directory structure), configuration via the `cozystack.keycloak` Package resource, `imagePullSecrets` for private registries, and theme activation in the Keycloak admin console ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#463). - -* **[website] Add documentation for Go types usage**: Added a guide for using the generated Go types for Cozystack managed applications as a Go module, including installation instructions, programmatic resource management examples, and deployment approaches ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#465). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.0...v1.2.1 diff --git a/docs/changelogs/v1.2.2.md b/docs/changelogs/v1.2.2.md deleted file mode 100644 index 2b6a1ae5..00000000 --- a/docs/changelogs/v1.2.2.md +++ /dev/null @@ -1,63 +0,0 @@ - - -## Features and Improvements - -* **[linstor] Update piraeus-server to v1.33.2 with selected backports**: Bumps LINSTOR server from v1.33.1 to v1.33.2 and adds backported patches for improved storage reliability: a stale bitmap adjust retry mechanism for automatic recovery after bitmap attach errors, LUKS2 header sizing and optimal I/O size detection improvements for more reliable disk formatting, and the maintainer implementation backport. All patches verified against upstream v1.33.2 with `git apply --check` and `gradlew compileJava` ([**@kvaps**](https://github.com/kvaps) in #2331, #2377). - -## Fixes - -* **[postgres] Fix system PostgreSQL images to 17.7-standard-trixie**: Hardcodes PostgreSQL 17.7-standard-trixie images for system PostgreSQL instances. This ensures system databases use the correct image variant consistent with the monitoring stack requirements introduced in v1.2.1 ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2364, #2369). - -* **[cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers**: On Ubuntu 22.04+, Debian, and other distributions that load the `cri-containerd.apparmor.d` AppArmor profile by default for containerd workloads, the kernel denied `nsenter` namespace entry in cilium-agent init containers (`mount-cgroup`, `apply-sysctl-overwrites`, `clean-cilium-state`), causing the agent to land in `Init:CrashLoopBackOff` and cascading platform failures. Per-container `container.apparmor.security.beta.kubernetes.io` annotations now opt the affected containers out of this profile, applied only on non-Talos cilium variants (`cilium-generic`, `kubeovn-cilium-generic`). The vendored daemonset template is also patched to strip the upstream `semverCompare "<1.30.0"` AppArmor block, preventing duplicate annotation keys. Talos variants are untouched as Talos does not load the AppArmor LSM ([**@lexfrei**](https://github.com/lexfrei) in #2370, #2378). - -* **[virtual-machine] Exclude external VM services from Cilium BPF LB**: Adds the `service.kubernetes.io/service-proxy-name: "cozy-proxy"` label to VM LoadBalancer services when `external: true`, telling Cilium to skip BPF processing entirely for these services. This fixes two issues: inter-tenant connectivity via public LB IPs (Cilium's DNAT caused cross-tenant pod-to-pod flow classification, triggering CiliumClusterwideNetworkPolicy blocks) and WholeIP broken on Cilium 1.19+ (wildcard service drop entries blocked traffic to LB IPs on undeclared ports before it reached netfilter/cozy-proxy). MetalLB L2 advertisement and kube-ovn routing remain unaffected ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2357, #2361). - -* **[monitoring] Fix infra dashboards missing in default variant**: The default platform variant deploys the monitoring chart to the `cozy-monitoring` namespace, but the dashboard rendering condition introduced in #2197 only checked for `tenant-root`. Infrastructure dashboards were not rendered in the default variant. The `cozy-monitoring` namespace is now included in the rendering condition, consistent with the existing pattern in `vmagent.yaml` ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2365, #2367). - -* **[build] Filter git describe to match only v* tags**: Adds `--match 'v*'` to all `git describe` calls in `hack/common-envs.mk`. The `api/apps/v1alpha1/*` subtags share the same commit as release tags, causing `git describe --exact-match` to pick `api/apps/v1alpha1/vX.Y.Z` instead of `vX.Y.Z`, producing invalid Docker image tags ([**@kvaps**](https://github.com/kvaps) in #2386, #2389). - -## Development, Testing, and CI/CD - -* **[ci] Replace cozystack-bot PAT with cozystack-ci GitHub App**: Replaces the long-lived `cozystack-bot` personal access token with short-lived, scoped tokens from the `cozystack-ci` GitHub App across all release workflows (`tags.yaml`, `auto-release.yaml`, `pull-requests-release.yaml`). Improves security and auditability of CI operations ([**@tym83**](https://github.com/tym83) in #2351). - -* **[ci] Use cozystack org noreply email for bot commits**: Updates CI workflows to use the cozystack organization noreply email for bot commits ([**@kvaps**](https://github.com/kvaps) in #2392, #2393). - -* **[ci] Replace GH_PAT with cozystack-ci GitHub App token in pull-requests workflow**: Switches the pull-requests release workflow to use the cozystack-ci GitHub App token instead of the personal access token ([**@kvaps**](https://github.com/kvaps) in #2383, #2384). - -## Documentation - -* **[website] Add ApplicationDefinition naming convention reference**: Added reference documentation on ApplicationDefinition naming conventions and how `cozystack-api` resolves kinds to their backing definitions ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#478). - -* **[website] Document Talos / talosctl / Cozystack version pairing**: Added documentation covering Talos, talosctl, and Cozystack version compatibility matrix for installation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#484). - -* **[website] Fix KubeOVN MASTER_NODES example path and key in troubleshooting**: Corrected the MASTER_NODES example path and key in the KubeOVN troubleshooting guide ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#483). - -* **[website] Prefix bundle package names with cozystack. in v1 examples**: Updated documentation examples to use the correct `cozystack.` prefix for bundle package names in enabled/disabledPackages ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#482). - -* **[website] Finish isolated-field removal and document opt-in policy labels**: Removed the obsolete `isolated` field from tenant documentation and documented the new opt-in policy labels approach ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#481). - -* **[website] Add --take-ownership flag and describe networking.* fields**: Added documentation for the `--take-ownership` flag and described the `networking.*` fields in the installation guide ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#480). - -* **[website] Add bonding (LACP) configuration how-to guide**: Added a guide for configuring network bonding with LACP on Cozystack installations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#459). - -* **[website] Improve registry mirrors for tenant Kubernetes in air-gapped guide**: Improved documentation for configuring registry mirrors in tenant Kubernetes clusters for air-gapped environments ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#461). - -* **[website] Update backup/restore documentation for VMI/VMDisk**: Updated backup documentation with information related to VM instance and VM disk restore improvements ([**@androndo**](https://github.com/androndo) in cozystack/website#466). - -* **[website] Add updated OpenAPI spec**: Updated the OpenAPI specification for managed applications reference ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#469). - -* **[website] Add OSS Health pages and OpenSSF badge**: Added OSS Health section with OpenSSF Scorecard and Best Practices badge to the website footer ([**@tym83**](https://github.com/tym83) in cozystack/website#470). - -* **[website] Add CozySummit Virtual 2026 program announcement**: Published the CozySummit Virtual 2026 program announcement blog post ([**@tym83**](https://github.com/tym83) in cozystack/website#472). - -* **[website] Add missing release announcements for v0.1–v0.41**: Backfilled missing release announcement blog posts for Cozystack versions v0.1 through v0.41 ([**@tym83**](https://github.com/tym83) in cozystack/website#468). - -* **[talm] Render templates online in apply to resolve lookups**: Fixed talm `apply` command to render templates online, resolving template lookup failures when using modeline templates ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/talm#119). - -* **[talm] Update default Talos image to v1.12.6**: Updated the default Talos image version to v1.12.6 in talm ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@03e9b6e). - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.1...v1.2.2 diff --git a/docs/changelogs/v1.2.3.md b/docs/changelogs/v1.2.3.md deleted file mode 100644 index 6d1b3b74..00000000 --- a/docs/changelogs/v1.2.3.md +++ /dev/null @@ -1,58 +0,0 @@ - - -# v1.2.3 (2026-04-20) - -A patch release with bug fixes and documentation updates. - -## Features and Improvements - -_No notable features in this patch release._ - -## Fixes - -* **fix(kubernetes): set explicit ephemeral-storage on virt-launcher pods**: Prevents VM crashes caused by ephemeral-storage eviction by setting explicit `domain.resources` ephemeral-storage on the VirtualMachine spec. Uses sanitized limits and requests so virt-launcher pods do not inherit too-small namespace defaults. ([**@kvaps**](https://github.com/kvaps) in #2317, backport #2423). - -## Documentation - -* **[website] feat: add Telemetry page under OSS Health section**: Add Telemetry page and initial data seeding to OSS Health docs ([**@tym83**](https://github.com/tym83) in cozystack/website#471). -* **[website] Refactor docs versions to major.minor variants**: Move docs to major.minor versioning for v1.x series ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#477). -* **[website] docs(tenants): document namespace layout and parent/child derivation** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#479). -* **[website] docs(tenants): document the checkbox-then-edit-CR customization pattern** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#485). -* **[website] docs: fix 14 broken links and stale talm anchor across v1 docs** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#486). -* **[website] fix(og): update social badge image and title** ([**@tym83**](https://github.com/tym83) in cozystack/website#487). -* **[website] docs(external-apps): rewrite guide for ApplicationDefinition API** ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/website#488). -* **[website] docs: add CLAUDE.md for AI agent guidance** ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#489). -* **[website] fix: update /docs/v1/ redirect to latest v1.2** ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#492). -* **[website] fix(ci): add OpenAPI spec download to GitHub Pages build** ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#494). -* **[website] feat(blog): add managed PostgreSQL with synchronous replication post** ([**@tym83**](https://github.com/tym83) in cozystack/website#497). -* **[website] chore(blog): add images frontmatter for social preview on existing posts** ([**@tym83**](https://github.com/tym83) in cozystack/website#498). -* **[website] feat(blog): taxonomies and client-side filter UI** ([**@tym83**](https://github.com/tym83) in cozystack/website#499). -* **[website] style(oss-health): add breathing room between navbar and hero** ([**@tym83**](https://github.com/tym83) in cozystack/website#500). - -## Other repositories - -* **[talm] feat(config): migrate to Talos v1.12 multi-document config format**: Upgrade Talos config format and modernize configuration handling ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#116). -* **[talm] chore(deps): bump dependencies and modernize codebase** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#124). -* **[external-apps-example] feat: replace MongoDB example with Minecraft apps from cozylex** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/external-apps-example#2). -* **[ansible-cozystack] fix(examples): add v prefix to collection version in requirements.yml** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#23). -* **[ansible-cozystack] fix(plugins): replace ansible.utils.ipaddr with stdlib-based test plugin** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#24). -* **[ansible-cozystack] feat(examples): comprehensive node prerequisites audit (fixes #19)** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#27). -* **[ansible-cozystack] chore(deps): update dependency cozystack.installer to v1.2.3** ([**@app/renovate**](https://github.com/apps/renovate) in cozystack/ansible-cozystack#29). -* **[ansible-cozystack] feat(role): expose publishing.externalIPs and tenant-root ingress via role variables** ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#30). - -## Contributors - -Thanks to everyone who contributed to this patch release: - -* [**@app/github-actions**](https://github.com/apps/github-actions) -* [**@app/renovate**](https://github.com/apps/renovate) -* [**@kitsunoff**](https://github.com/kitsunoff) -* [**@kvaps**](https://github.com/kvaps) -* [**@lexfrei**](https://github.com/lexfrei) -* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) -* [**@tym83**](https://github.com/tym83) - - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.2...v1.2.3 diff --git a/docs/changelogs/v1.3.0-rc.1.md b/docs/changelogs/v1.3.0-rc.1.md deleted file mode 100644 index 9b63c106..00000000 --- a/docs/changelogs/v1.3.0-rc.1.md +++ /dev/null @@ -1,173 +0,0 @@ - - -# Cozystack v1.3.0-rc.1 - -Cozystack v1.3.0-rc.1 is the first release candidate for v1.3.0, bringing **storage-aware scheduling** via the LINSTOR scheduler extender, a managed **LINSTOR GUI** web UI with Keycloak SSO, a **VM Default Images** catalog for out-of-the-box virtual machine provisioning, **WorkloadsReady conditions** with a real-time Events tab in the dashboard, and **cross-namespace VM backup restore** capabilities. Additional highlights include stricter tenant name validation, VM network selector improvements, Keycloak theme injection and SMTP configuration, and a comprehensive host runtime preflight check. - -> **Note:** Fixes marked with *(backported to v1.2.x)* were also included in v1.2.1 or v1.2.2 patch releases. - -## Feature Highlights - -### Storage-Aware Scheduling via LINSTOR Extender - -The `cozystack-scheduler` now calls the **LINSTOR scheduler extender** for storage-locality-aware pod placement. When a pod declares both a `SchedulingClass` and LINSTOR-backed PVCs, the scheduler consults LINSTOR to prefer nodes where volume replicas already exist — reducing cross-node replication traffic and improving I/O latency for storage-heavy workloads ([**@lllamnyp**](https://github.com/lllamnyp) in #2330). - -### LINSTOR GUI: Managed Web UI for Storage Administration - -A new opt-in `linstor-gui` system package deploys **LINBIT's linstor-gui web UI** alongside the LINSTOR controller with mTLS client authentication, non-root security context, and ClusterIP-only service. An optional **Keycloak-protected Ingress** (via oauth2-proxy) can be enabled for SSO-authenticated browser access when OIDC is configured on the platform ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2382, #2390). - -### VM Default Images: Out-of-the-Box VM Provisioning - -The new `vm-default-images` package provides a curated set of **cluster-wide virtual machine images** (Ubuntu, Debian, CentOS Stream, and others) as pre-populated DataVolumes. The package is opt-in via the `iaas` bundle and defaults to replicated storage for high availability. A companion migration (migration 38) renames legacy `vm-image-*` DataVolumes to the new `vm-default-images-*` naming scheme. The `vm-disk` chart also gains a new "disk" source type for cloning from existing vm-disks in the same namespace ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2258). - -### WorkloadsReady Condition and Events Tab - -Applications now expose a **WorkloadsReady** condition on their status by querying associated WorkloadMonitor resources, giving operators a single place to check whether all underlying workloads (Deployments, StatefulSets, DaemonSets) are healthy. The dashboard gains a new **Events tab** showing namespace-scoped Kubernetes events for each application, with fallback to `.firstTimestamp` when `.eventTime` is absent. A bug where WorkloadMonitor's `Operational` status was never persisted is also fixed ([**@lexfrei**](https://github.com/lexfrei) in #2356). - -### Cross-Namespace VM Backup Restore - -The backup system now supports **restoring VMInstance backups into a different namespace** (cross-namespace copy restores), with IP/MAC preservation and safe rename semantics. In-place backup/restores for VMDisk and VMInstance are improved: HelmReleases and DataVolumes are properly handled, and Velero failure messages are propagated to the Application status. The backup status structure has been refactored to store underlying resources as a generic opaque JSON object, enabling arbitrary application-specific metadata ([**@androndo**](https://github.com/androndo) in #2251, #2329, #2319). - -## Major Features and Improvements - -* **[api] Reject tenant names with dashes at Create time**: Enforces alphanumeric-only naming for Tenants at the API level, preventing names with hyphens that would silently fail during Helm reconciliation. A corresponding regex tightening and regression test suite hardens the validation ([**@lexfrei**](https://github.com/lexfrei) in #2380). - -* **[platform] Validate computed tenant namespace length**: Rejects Tenant creation when the computed ancestor-chain namespace would exceed the 63-character Kubernetes namespace limit, preventing opaque HelmRelease reconcile errors downstream ([**@lexfrei**](https://github.com/lexfrei) in #2376). - -* **[vm-instance] Rename subnets to networks and add dropdown selector**: Renames the misleading `subnets` field to `networks` in VMInstance for clarity, adds a dropdown selector for available networks in the dashboard form, and includes a migration to copy existing `subnets` values. The old field remains supported for backward compatibility ([**@sircthulhu**](https://github.com/sircthulhu) in #2263). - -* **[keycloak] Enable injecting themes**: Cozystack administrators can now inject custom Keycloak themes via `initContainers` for UI white-labeling and customization ([**@lllamnyp**](https://github.com/lllamnyp) in #2142). - -* **[keycloak-configure] Add email verification and SMTP configuration**: Adds configurable Keycloak settings for user self-registration, email verification, and SMTP server configuration, enabling automated user onboarding flows ([**@BROngineer**](https://github.com/BROngineer) in #2318). - -* **[postgres] Hardcode PostgreSQL 17 for monitoring databases**: Pins PostgreSQL 17.7 images for system databases (Grafana, Alerta, Harbor, Keycloak, SeaweedFS) and adds migration 37 to backfill `spec.version=v17` for existing PostgreSQL resources, preventing CNPG from defaulting to PostgreSQL 18 *(backported to v1.2.1)* ([**@IvanHunters**](https://github.com/IvanHunters) in #2304). - -* **[hack] Add host runtime preflight check**: New `check-host-runtime.sh` script and `make preflight` target that warns operators when a standalone containerd or docker runtime is running alongside the embedded k3s runtime, helping diagnose container runtime conflicts ([**@lexfrei**](https://github.com/lexfrei) in #2371). - -* **[hack] Add check-readiness.sh diagnostic script**: A new diagnostic script for tracking platform reconciliation by checking readiness of Packages, ArtifactGenerators, ExternalArtifacts, and HelmReleases, with support for watch mode and continuous monitoring ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2294). - -* **[mariadb] Always enable replication for consistent service naming**: MariaDB now always enables replication, creating `-primary`/`-secondary` services even for single-replica instances. This fixes dashboard visibility and backup functionality for single-replica setups ([**@sircthulhu**](https://github.com/sircthulhu) in #2279). - -* **[platform] Prevent installed packages deletion**: Adds `helm.sh/resource-policy: keep` annotation to packages, preventing automatic deletion when packages are disabled and restoring documented behavior *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2273). - -## Bug Fixes - -* **[cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers**: Opts cilium-agent init containers out of the `cri-containerd.apparmor.d` AppArmor profile on non-Talos variants, fixing `Init:CrashLoopBackOff` on Ubuntu 22.04+ and Debian *(backported to v1.2.2)* ([**@lexfrei**](https://github.com/lexfrei) in #2370). - -* **[virtual-machine] Exclude external VM services from Cilium BPF LB**: Adds `service-proxy-name: cozy-proxy` label to VM LoadBalancer services, telling Cilium to skip BPF processing. Fixes inter-tenant connectivity via public LB IPs and WholeIP functionality on Cilium 1.19+ *(backported to v1.2.2)* ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2357). - -* **[monitoring] Fix infra dashboards missing in default variant**: Includes `cozy-monitoring` namespace in the dashboard rendering condition, fixing infrastructure Grafana dashboards not rendering in the default platform variant *(backported to v1.2.2)* ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2365). - -* **[postgres] Fix system PostgreSQL images to 17.7-standard-trixie**: Normalizes system PostgreSQL image tags to use `17.7-standard-trixie` variant with migration logic for existing CNPG clusters *(backported to v1.2.2)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2364). - -* **[build] Filter git describe to match only v\* tags**: Adds `--match 'v*'` to `git describe` calls, preventing API subtags from being picked up instead of release tags and producing invalid Docker image tags *(backported to v1.2.2)* ([**@kvaps**](https://github.com/kvaps) in #2386). - -* **[platform] Fix resource allocation ratios not propagated to packages**: Restores propagation of CPU, memory, and ephemeral-storage allocation ratios to managed applications and KubeVirt, which were silently ignored since the bundle restructure *(backported to v1.2.1)* ([**@sircthulhu**](https://github.com/sircthulhu) in #2296). - -* **[kubernetes] Set explicit ephemeral-storage on virt-launcher pods**: Sets explicit `domain.resources` with ephemeral-storage on VirtualMachine spec to prevent virt-launcher pods from being evicted due to LimitRange defaults being too low for actual emptyDisk capacity ([**@kvaps**](https://github.com/kvaps) in #2317). - -* **[multus] Pin master CNI to 05-cilium.conflist**: Prevents a boot-time race condition where multus could auto-detect kube-ovn's conflist instead of Cilium's *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2315). - -* **[multus] Build custom image with DEL cache fix**: Fixes sandbox cleanup deadlock when CNI ADD never completes, preventing stale sandbox name reservations from permanently blocking pod creation *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2313). - -* **[linstor] Set verify-alg to crc32c**: Prevents DRBD connection failures on kernels where `crct10dif` is unavailable (e.g., Talos v1.12.6 with kernel 6.18.18) *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2303). - -* **[linstor] Preserve TCP ports during toggle-disk operations**: Fixes TCP port mismatches after toggle-disk operations that could cause DRBD resources to enter StandAlone state *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2292). - -## Dependencies & Version Updates - -* **[linstor] Update piraeus-server to v1.33.2 with selected backports**: Bumps LINSTOR server from v1.33.1 to v1.33.2 with backported patches for stale bitmap adjust retry, LUKS2 header sizing, and optimal I/O size detection *(backported to v1.2.2)* ([**@kvaps**](https://github.com/kvaps) in #2331). - -* **[kamaji] Update to 26.3.5-edge, drop upstreamed patches**: Updates Kamaji from edge-26.2.4 to 26.3.5-edge and removes two patches accepted upstream. Adds configurable probe tuning and DataStore readiness conditions ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2260). - -* **[talm] Release v0.23.0, v0.23.1, v0.24.0** (github.com/cozystack/talm): Migrates to the Talos v1.12 multi-document machine config format ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#116); fixes template rendering in `apply` command to resolve lookups ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/talm#119); bumps dependencies and modernizes codebase ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#124). - -* **[ansible-cozystack] Release v1.2.1, v1.2.2** (github.com/cozystack/ansible-cozystack): Exposes `publishing.externalIPs` and tenant-root ingress via role variables ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#30); adds comprehensive node prerequisites audit ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#27); replaces `ansible.utils.ipaddr` with a stdlib-based test plugin ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#24). - -## Security - -* **docs: add SECURITY.md**: Adds vulnerability reporting procedures, disclosure expectations, and supported release lines ([**@kvaps**](https://github.com/kvaps) in #2230). - -* **docs: add OpenSSF Best Practices badge to README**: Adds the OpenSSF Best Practices passing badge to the project README ([**@lexfrei**](https://github.com/lexfrei) in #2320). - -## Development, Testing, and CI/CD - -* **[ci] Replace cozystack-bot PAT with cozystack-ci GitHub App**: Replaces the long-lived cozystack-bot personal access token with short-lived, scoped tokens from the cozystack-ci GitHub App across all CI release workflows ([**@tym83**](https://github.com/tym83) in #2351; [**@kvaps**](https://github.com/kvaps) in #2383, #2392). - -* **[ci] Add Gemini Code Assist and CodeRabbit configuration**: Adds repository-level configuration for AI code reviewers with ignore patterns for vendored/generated code and incremental review settings ([**@lexfrei**](https://github.com/lexfrei) in #2385). - -* **[ci] Make tags workflow idempotent on re-runs**: Fixes CI to force-update API subtags and handle re-runs gracefully ([**@kvaps**](https://github.com/kvaps)). - -* **[tests] Fix Kafka E2E test timeout and retry race condition**: Increases Kafka E2E test timeout from 60s to 300s and fixes a retry race condition where `kubectl apply` could hit a still-deleting resource ([**@lexfrei**](https://github.com/lexfrei) in #2358). - -* **docs: adopt Conventional Commits for commit and PR titles**: Standardizes commit and PR title format to `type(scope): description` across all contributing docs and the PR template ([**@lexfrei**](https://github.com/lexfrei) in #2395). - -* **docs(ci): require screenshots for UI changes in PR template**: Adds a mandatory screenshots section to the PR template for UI-related changes ([**@kitsunoff**](https://github.com/kitsunoff) in #2407). - -## Documentation - -* **[website] Add ApplicationDefinition naming convention reference**: Documents how `cozystack-api` resolves kinds to their backing definitions ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#478). - -* **[website] Document Talos / talosctl / Cozystack version pairing**: Adds version compatibility matrix for installation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#484). - -* **[website] Document namespace layout and parent/child derivation**: Explains tenant namespace hierarchy and parent/child namespace derivation rules ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#479). - -* **[website] Document the checkbox-then-edit-CR customization pattern for tenants**: Describes the workflow for customizing tenant settings via the CR after initial checkbox-based creation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#485). - -* **[website] Add custom Keycloak themes documentation**: Covers the theme image contract, configuration, `imagePullSecrets`, and theme activation in the Keycloak admin console ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#463). - -* **[website] Add bonding (LACP) configuration how-to guide**: Covers network bonding configuration for Cozystack installations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#459). - -* **[website] Improve registry mirrors for tenant Kubernetes in air-gapped guide**: Improved documentation for configuring registry mirrors in air-gapped environments ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#461). - -* **[website] Rewrite guide for ApplicationDefinition API (external-apps)**: Comprehensive rewrite of the external apps guide using the ApplicationDefinition API ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/website#488). - -* **[website] Add documentation for Go types usage**: Guide for using generated Go types for Cozystack managed applications as a Go module ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#465). - -* **[website] Update backup/restore documentation for VMI/VMDisk**: Updated backup documentation with VM instance and VM disk restore improvements ([**@androndo**](https://github.com/androndo) in cozystack/website#466). - -* **[website] Add OSS Health pages and OpenSSF badge**: Added OSS Health section with OpenSSF Scorecard and Best Practices badge to the website ([**@tym83**](https://github.com/tym83) in cozystack/website#470). - -* **[website] Add CozySummit Virtual 2026 program announcement**: Published the CozySummit Virtual 2026 program announcement blog post ([**@tym83**](https://github.com/tym83) in cozystack/website#472). - -* **[website] Add missing release announcements for v0.1–v0.41**: Backfilled missing release announcement blog posts for historical Cozystack versions ([**@tym83**](https://github.com/tym83) in cozystack/website#468). - -* **[website] Fix broken links and stale anchors across v1 docs**: Fixes 14 broken links and stale talm anchors ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#486). - -* **[website] Prefix bundle package names with cozystack. in v1 examples**: Corrects package naming in documentation examples ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#482). - -* **[website] Finish isolated-field removal and document opt-in policy labels**: Removes obsolete `isolated` field from tenant documentation and documents the new approach ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#481). - -* **[website] Add --take-ownership flag and describe networking.* fields**: Documents the `--take-ownership` flag and `networking.*` fields in the installation guide ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#480). - -* **[website] Fix KubeOVN MASTER_NODES example path and key in troubleshooting**: Corrects the MASTER_NODES example path ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#483). - -* **[external-apps-example] Replace MongoDB example with Minecraft apps**: Refactors the external apps example to use ApplicationDefinition API with Minecraft server applications ([**@lexfrei**](https://github.com/lexfrei) in cozystack/external-apps-example#2). - -## Governance - -* **Add Mattia Eleuteri ([@mattia-eleuteri](https://github.com/mattia-eleuteri)) as Maintainer**: CSI, Storage, Networking & Security ([**@tym83**](https://github.com/tym83) in #2345). - -* **Add Matthieu Robin ([@matthieu-robin](https://github.com/matthieu-robin)) as Maintainer**: Managed applications, platform quality, and benchmarking ([**@tym83**](https://github.com/tym83) in #2346). - -## Contributors - -We'd like to thank all contributors who made this release possible: - -* [**@androndo**](https://github.com/androndo) -* [**@BROngineer**](https://github.com/BROngineer) -* [**@IvanHunters**](https://github.com/IvanHunters) -* [**@kitsunoff**](https://github.com/kitsunoff) -* [**@kvaps**](https://github.com/kvaps) -* [**@lexfrei**](https://github.com/lexfrei) -* [**@lllamnyp**](https://github.com/lllamnyp) -* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri) -* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) -* [**@sircthulhu**](https://github.com/sircthulhu) -* [**@tym83**](https://github.com/tym83) - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.0...v1.3.0-rc.1 diff --git a/docs/changelogs/v1.3.0.md b/docs/changelogs/v1.3.0.md deleted file mode 100644 index 60c800a8..00000000 --- a/docs/changelogs/v1.3.0.md +++ /dev/null @@ -1,238 +0,0 @@ - - -# Cozystack v1.3.0 - -Cozystack v1.3.0 brings **storage-aware pod scheduling** via a LINSTOR scheduler extender, a managed **LINSTOR GUI** web console with Keycloak SSO, a curated **VM Default Images** catalog for out-of-the-box virtual-machine provisioning, a new **WorkloadsReady / Events** observability surface with S3 bucket metering, and **cross-namespace VMInstance backup restore** with a full **RestoreJob dashboard** flow. The release also ships stricter tenant-name validation, VMInstance network-selector improvements, Keycloak theme injection and SMTP configuration, a host-runtime preflight check, and rolls up every fix from the v1.2.1 → v1.2.4 patch line. - -> **Note:** Items marked *(backported to v1.2.x)* were also shipped in v1.2.1, v1.2.2, v1.2.3, or v1.2.4 patch releases. - -## Feature Highlights - -### Storage-Aware Scheduling via the LINSTOR Extender - -The `cozystack-scheduler` now calls a **LINSTOR scheduler extender** for storage-locality-aware pod placement. When a pod declares both a `SchedulingClass` and LINSTOR-backed PVCs, the scheduler consults LINSTOR to prefer nodes where volume replicas already exist — reducing cross-node replication traffic and improving I/O latency for storage-heavy workloads such as databases, object stores, and VMs. - -The integration builds on the existing `SchedulingClass` tenant workload placement system introduced in v1.2.0 and requires no tenant-side configuration — workloads simply benefit once a SchedulingClass is assigned. Administrators can mix storage locality with the existing data-center / hardware-generation constraints defined on SchedulingClass CRs ([**@lllamnyp**](https://github.com/lllamnyp) in #2330). - -### LINSTOR GUI: Managed Web Console for Storage Administration - -A new opt-in `linstor-gui` system package deploys **LINBIT's linstor-gui web UI** alongside the LINSTOR controller with mTLS client authentication, non-root security context, and a ClusterIP-only service by default. When OIDC is configured on the platform, an optional **Keycloak-protected Ingress** (via oauth2-proxy) exposes the UI for browser access. Access is restricted to members of the `cozystack-cluster-admin` Keycloak group, consistent with host-cluster admin RBAC, and the gatekeeper blocks in-app LINSTOR authentication setup at the nginx proxy layer so the managed configuration cannot be subverted through the UI. - -Operators who prefer CLI access keep the existing `linstor` command; the GUI is strictly additive and stays disabled by default ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2382, #2390, #2415, #2419). - -### VM Default Images: Out-of-the-Box VM Provisioning - -The new `vm-default-images` package provides a curated set of **cluster-wide virtual-machine images** (Ubuntu, Debian, CentOS Stream, and others) as pre-populated DataVolumes, so tenants can provision VMs against well-known base images without first having to upload them. The package is opt-in via the `iaas` bundle and defaults to replicated storage for high availability. Migration 38 renames legacy `vm-image-*` DataVolumes to the new `vm-default-images-*` naming scheme, and the `vm-disk` chart gains a new "disk" source type for cloning from existing vm-disks in the same namespace ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2258). - -### Application Observability: WorkloadsReady, Events, and S3 Bucket Metering - -Applications now expose a **WorkloadsReady** condition on their status by querying associated WorkloadMonitor resources, giving operators a single place to check whether all underlying workloads (Deployments, StatefulSets, DaemonSets, PVCs) are healthy. The dashboard gains a new **Events tab** showing namespace-scoped Kubernetes events per application, with fallback to `.firstTimestamp` when `.eventTime` is absent. A long-standing bug where WorkloadMonitor's `Operational` status was never persisted is fixed in the same change ([**@lexfrei**](https://github.com/lexfrei) in #2356). - -The WorkloadMonitor reconciler is extended to track **COSI BucketClaim** objects as first-class Workloads, and the bucket controller now queries SeaweedFS logical and physical bucket-size metrics from VictoriaMetrics via a namespace-scoped monitoring endpoint, enabling S3 billing integration on par with Pods and PVCs ([**@kitsunoff**](https://github.com/kitsunoff) in #2391). Workloads are also enriched with `workloads.cozystack.io/resource-preset` and source-object labels so downstream billing pipelines can correlate monitors with the tenant preset that produced them ([**@androndo**](https://github.com/androndo) in #2416). - -### Cross-Namespace VM Backup Restore and RestoreJob Dashboard - -The backup system now supports **restoring VMInstance backups into a different namespace** (cross-namespace copy restores) with IP/MAC preservation and safe rename semantics. In-place backup and restore flows for VMDisk and VMInstance are improved: HelmReleases and DataVolumes are properly handled, and Velero failure messages are propagated to the Application status. The backup status structure has been refactored to store underlying resources as a generic opaque JSON object, enabling arbitrary application-specific metadata without status-schema churn ([**@androndo**](https://github.com/androndo) in #2251, #2319, #2329). - -The dashboard now ships a complete **RestoreJob experience**: list view, details page, create form, and sidebar entry, with a "Same as backup" fallback rendering when `spec.targetApplicationRef` is omitted. Non-CRD-backed sidebar factories (`kube-*`, `plan`, `backupjob`, `backup`, `restorejob`) are marked static so they pick up consistent managed-by labels across reconciles ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2437). - -## Major Features and Improvements - -* **[api] Reject tenant names with dashes at Create time**: Enforces alphanumeric-only naming for Tenants at the API level, preventing names with hyphens that would silently fail during Helm reconciliation. A corresponding regex tightening and regression test suite hardens the validation ([**@lexfrei**](https://github.com/lexfrei) in #2380). - -* **[platform] Validate computed tenant namespace length**: Rejects Tenant creation when the computed ancestor-chain namespace would exceed the 63-character Kubernetes namespace limit, preventing opaque HelmRelease reconcile errors downstream ([**@lexfrei**](https://github.com/lexfrei) in #2376). - -* **[vm-instance] Rename subnets to networks and add dropdown selector**: Renames the misleading `subnets` field to `networks` in VMInstance for clarity, adds a dropdown selector for available networks in the dashboard form, and includes migration 36 to copy existing `subnets` values. The old field remains supported for backward compatibility ([**@sircthulhu**](https://github.com/sircthulhu) in #2263). - -* **[keycloak] Enable injecting themes**: Cozystack administrators can now inject custom Keycloak themes via `initContainers` for UI white-labeling and customization ([**@lllamnyp**](https://github.com/lllamnyp) in #2142). - -* **[keycloak-configure] Add email verification and SMTP configuration**: Adds configurable Keycloak settings for user self-registration, email verification, and SMTP server configuration, enabling automated user onboarding flows ([**@BROngineer**](https://github.com/BROngineer) in #2318). - -* **[postgres] Pin system PostgreSQL to 17.7-standard-trixie**: Pins the PostgreSQL image for system databases (Grafana, Alerta, Harbor, Keycloak, SeaweedFS) to `17.7-standard-trixie` across chart templates and `values.yaml`, and ships migration 37 to patch existing CNPG Cluster `imageName` fields to the same variant (handling unset, any PG 17 tag, and bare-version tags). This prevents CNPG from defaulting to PostgreSQL 18 and locks system databases to the trixie variant consistent with the monitoring stack requirements *(related backports shipped in v1.2.1 via #2309 and v1.2.2 via #2364)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2369). - -* **[platform] Prevent installed packages deletion**: Adds the `helm.sh/resource-policy: keep` annotation to platform packages so disabling a package no longer triggers automatic Helm deletion, restoring the documented behavior where operators must explicitly delete a package *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2273). - -* **[mariadb] Always enable replication for consistent service naming**: MariaDB now always enables replication, creating `-primary`/`-secondary` services even for single-replica instances. This fixes dashboard visibility and backup functionality for single-replica setups ([**@sircthulhu**](https://github.com/sircthulhu) in #2279). - -* **[hack] Add host runtime preflight check**: New `check-host-runtime.sh` script and `make preflight` target that warns operators when a standalone containerd or docker runtime is running alongside the embedded k3s runtime, helping diagnose container-runtime conflicts early in an installation ([**@lexfrei**](https://github.com/lexfrei) in #2371). - -* **[hack] Add check-readiness.sh diagnostic script**: A new diagnostic script for tracking platform reconciliation by checking readiness of Packages, ArtifactGenerators, ExternalArtifacts, and HelmReleases, with support for watch mode and continuous monitoring ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2294). - -* **[platform] Add resourcePreset labels to WorkloadMonitor labels**: WorkloadMonitor labels with the `workloads.cozystack.io/` prefix are now propagated onto created Workloads; created Workloads always include the reserved `workloads.cozystack.io/monitor` label, and Helm app charts add `workloads.cozystack.io/resource-preset` metadata to WorkloadMonitor manifests, enabling downstream billing pipelines to correlate monitors with the tenant preset that produced them ([**@androndo**](https://github.com/androndo) in #2416). - -## Bug Fixes - -* **[platform] Migrate ACME HTTP-01 to ingressClassName API**: Switches ACME HTTP-01 issuance from the deprecated `acme.cert-manager.io/http01-ingress-class` annotation to the modern `ingressClassName` field on `ClusterIssuer` and solver pods. Previously, ClusterIssuers referenced a non-existent `nginx` class while each Ingress individually overrode it via annotation — producing `ingressClassName and class cannot be set at the same time` errors when tenants attempted to migrate to the modern field. The migration is atomic: both the ClusterIssuer and consuming Ingresses are updated together *(backported to v1.2.4)* ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2436). - -* **[harbor] Remove incorrect tenant module flags**: Harbor is a PaaS service, not a tenant module. Incorrect `spec.dashboard.module: true` and `internal.cozystack.io/tenantmodule` flags caused Harbor to appear in the sidebar "Modules" section and be misclassified by controllers handling tenant modules. The flags are now removed so Harbor is displayed in its proper PaaS category and is no longer treated as a tenant-scoped HelmRelease ([**@kvaps**](https://github.com/kvaps) in #2444). - -* **[kube-ovn] Resolve kubeovn-plunger RBAC forbidden on deployments**: Grants `kube-ovn-plunger` the RBAC needed to list Deployments so it can reconcile `ovn-central`, fixing `deployments.apps is forbidden` errors in `cozy-kubeovn` ([**@kvaps**](https://github.com/kvaps) in #2441). - -* **[cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers**: Opts cilium-agent init containers out of the `cri-containerd.apparmor.d` AppArmor profile on non-Talos variants (`cilium-generic`, `kubeovn-cilium-generic`), fixing `Init:CrashLoopBackOff` on Ubuntu 22.04+ and Debian where the profile denies `nsenter` namespace entry. Talos variants are untouched as Talos does not load the AppArmor LSM *(backported to v1.2.2)* ([**@lexfrei**](https://github.com/lexfrei) in #2370). - -* **[virtual-machine] Exclude external VM services from Cilium BPF LB**: Adds the `service.kubernetes.io/service-proxy-name: cozy-proxy` label to VM LoadBalancer services with `external: true`, telling Cilium to skip BPF processing entirely. Fixes inter-tenant connectivity via public LB IPs (Cilium's DNAT caused cross-tenant pod-to-pod flow classification, triggering CiliumClusterwideNetworkPolicy blocks) and restores WholeIP behavior on Cilium 1.19+ where wildcard service drop entries previously blocked traffic to LB IPs on undeclared ports *(backported to v1.2.2)* ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2357). - -* **[monitoring] Fix infra dashboards missing in default variant**: Includes the `cozy-monitoring` namespace in the dashboard rendering condition, fixing infrastructure Grafana dashboards not rendering in the default platform variant (only the `tenant-root` namespace was previously checked) *(backported to v1.2.2)* ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2365). - -* **[build] Filter git describe to match only v* tags**: Adds `--match 'v*'` to all `git describe` calls in `hack/common-envs.mk`, preventing the `api/apps/v1alpha1/vX.Y.Z` subtag from being picked up instead of the release tag and producing invalid Docker image tags *(backported to v1.2.2)* ([**@kvaps**](https://github.com/kvaps) in #2386). - -* **[platform] Fix resource allocation ratios not propagated to packages**: Restores propagation of `cpuAllocationRatio`, `memoryAllocationRatio`, and `ephemeralStorageAllocationRatio` from `platform/values.yaml` to the `cozystack-values` Secret that managed applications and KubeVirt read, fixing a regression introduced in the bundle restructure that silently ignored operator-configured ratios *(backported to v1.2.1)* ([**@sircthulhu**](https://github.com/sircthulhu) in #2296). - -* **[kubernetes] Set explicit ephemeral-storage on virt-launcher pods**: Sets explicit `domain.resources` ephemeral-storage on the VirtualMachine spec to prevent virt-launcher pods from being evicted because LimitRange defaults were too small for the actual emptyDisk capacity *(backported to v1.2.3)* ([**@kvaps**](https://github.com/kvaps) in #2317). - -* **[multus] Pin master CNI to 05-cilium.conflist**: Prevents a boot-time race where multus could auto-detect kube-ovn's conflist instead of Cilium's, which would cause pods to bypass the Cilium chain entirely and lose their endpoint *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2315). - -* **[multus] Build custom image with DEL cache fix**: Fixes sandbox cleanup deadlock when CNI ADD never completes, preventing stale sandbox name reservations from permanently blocking pod creation after a node disruption *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2313). - -* **[linstor] Set verify-alg to crc32c**: Prevents DRBD connection failures on kernels where `crct10dif` is unavailable (e.g., Talos v1.12.6 with kernel 6.18.18) by setting the LINSTOR verify-alg controller default to `crc32c` *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2303). - -* **[linstor] Preserve TCP ports during toggle-disk operations**: Saves existing TCP ports into the `LayerPayload` before `removeLayerData()` deletes them, preventing DRBD resources from entering StandAlone state when a satellite misses the resulting update *(backported to v1.2.1)* ([**@kvaps**](https://github.com/kvaps) in #2292). - -* **[linstor] Increase satellite startup probe failure threshold**: Raises the LINSTOR satellite `startupProbe` `failureThreshold` from 3 to 30 (30s → 300s) in the `LinstorSatelliteConfiguration` pod template, giving satellites with slow storage initialization enough time to come up without being killed and restarted ([**@Arsolitt**](https://github.com/Arsolitt) in #2425). - -## Security - -* **docs: add SECURITY.md**: Adds vulnerability reporting procedures, disclosure expectations, and supported release lines ([**@kvaps**](https://github.com/kvaps) in #2230). - -* **docs: add OpenSSF Best Practices badge to README**: Adds the OpenSSF Best Practices passing badge to the project README ([**@lexfrei**](https://github.com/lexfrei) in #2320). - -## Dependencies & Version Updates - -* **[kube-ovn] Bump kube-ovn to v1.15.10 with port-group regression fix**: Updates `packages/system/kubeovn` to upstream v1.15.10 (from v1.15.3) and carries a patch for `pkg/controller/pod.go` that preserves a VM LSP's port-group memberships when Kubernetes GCs a completed virt-launcher pod while another virt-launcher pod of the same VM is still running. Without the patch, the destination pod of a successful live migration lost its security groups, network policies, and node-scoped routing until `kube-ovn-controller` was restarted ([**@kvaps**](https://github.com/kvaps) in #2443). - -* **[monitoring] Upgrade victoria-metrics-operator to v0.68.4**: Bumps the vendored `victoria-metrics-operator` Helm chart from 0.59.1 to 0.61.0 (operator appVersion v0.68.1 → v0.68.4), picking up upstream fixes for `VMPodScrape` port routing on VMAgent/VLAgent and `StatefulSet` pod deletion (not eviction) when `maxUnavailable=100%` ([**@lexfrei**](https://github.com/lexfrei) in #2426). - -* **[linstor] Update piraeus-server to v1.33.2 with selected backports**: Bumps LINSTOR server from v1.33.1 to v1.33.2 with backported patches for stale bitmap adjust retry, LUKS2 header sizing, optimal I/O size detection, and the maintainer implementation. All patches verified against upstream v1.33.2 with `git apply --check` and `gradlew compileJava` *(backported to v1.2.2)* ([**@kvaps**](https://github.com/kvaps) in #2331). - -* **[kamaji] Update to 26.3.5-edge, drop upstreamed patches**: Updates Kamaji from edge-26.2.4 to 26.3.5-edge and removes two patches accepted upstream. Adds configurable probe tuning and DataStore readiness conditions ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2260). - -* **[talm] Release v0.23.0, v0.23.1, v0.24.0** (github.com/cozystack/talm): Migrates to the Talos v1.12 multi-document machine config format ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#116); renders templates online in `apply` to resolve lookups ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/talm#119); bumps dependencies and modernizes the codebase ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#124). - -* **[ansible-cozystack] Release v1.2.1, v1.2.2, v1.2.4** (github.com/cozystack/ansible-cozystack): Exposes `publishing.externalIPs` and tenant-root ingress via role variables ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#30); adds a comprehensive node prerequisites audit ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#27); replaces `ansible.utils.ipaddr` with a stdlib-based test plugin ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#24); adds `v` prefix to collection version in requirements.yml examples ([**@lexfrei**](https://github.com/lexfrei) in cozystack/ansible-cozystack#23); tracks installer releases v1.2.1 through v1.2.4 ([**@app/renovate**](https://github.com/apps/renovate) in cozystack/ansible-cozystack#20, #22, #29, #31, #32). - -## Development, Testing, and CI/CD - -* **[ci] Replace cozystack-bot PAT with cozystack-ci GitHub App**: Replaces the long-lived `cozystack-bot` personal access token with short-lived, scoped tokens from the `cozystack-ci` GitHub App across all release workflows (`tags.yaml`, `auto-release.yaml`, `pull-requests-release.yaml`), improving security and auditability of CI operations ([**@tym83**](https://github.com/tym83) in #2351; [**@kvaps**](https://github.com/kvaps) in #2383, #2392). - -* **[ci] Add Gemini Code Assist and CodeRabbit configuration**: Adds repository-level configuration for AI code reviewers with ignore patterns for vendored/generated code and incremental review settings ([**@lexfrei**](https://github.com/lexfrei) in #2385). - -* **[ci] Promote next/ trunk on new minor/major releases**: Updates `update-website-docs` in `tags.yaml` to match the new docs-versioning contract — the website repo replaces the old "pre-create `vX.Y/` draft directory" scheme with a permanent `content/en/docs/next/` trunk, and released version directories are promoted explicitly by the release workflow ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2433). - -* **[tests] Fix Kafka E2E test timeout and retry race condition**: Increases Kafka E2E test timeout from 60s to 300s and fixes a retry race where `kubectl apply` could hit a still-deleting resource ([**@lexfrei**](https://github.com/lexfrei) in #2358). - -* **docs: adopt Conventional Commits for commit and PR titles**: Standardizes commit and PR title format to `type(scope): description` across all contributing docs and the PR template ([**@lexfrei**](https://github.com/lexfrei) in #2395). - -* **docs(ci): require screenshots for UI changes in PR template**: Adds a mandatory screenshots section to the PR template for UI-related changes ([**@kitsunoff**](https://github.com/kitsunoff) in #2407). - -* **chore(maintenance): add @myasnikovdaniil to CODEOWNERS**: Adds @myasnikovdaniil to the default owners in `.github/CODEOWNERS` for automatic review requests ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2434). - -## Documentation - -* **[website] Add ApplicationDefinition naming convention reference**: Documents how `cozystack-api` resolves kinds to their backing definitions ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#478). - -* **[website] Document Talos / talosctl / Cozystack version pairing**: Adds a version compatibility matrix for installation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#484). - -* **[website] Document namespace layout and parent/child derivation**: Explains tenant namespace hierarchy and parent/child namespace derivation rules ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#479). - -* **[website] Document the checkbox-then-edit-CR customization pattern for tenants**: Describes the workflow for customizing tenant settings via the CR after initial checkbox-based creation ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#485). - -* **[website] Add custom Keycloak themes documentation**: Covers the theme image contract, configuration, `imagePullSecrets`, and theme activation in the Keycloak admin console ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#463). - -* **[website] Add bonding (LACP) configuration how-to guide**: Covers network bonding configuration for Cozystack installations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#459). - -* **[website] Improve registry mirrors for tenant Kubernetes in air-gapped guide**: Improves documentation for configuring registry mirrors in air-gapped environments ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#461). - -* **[website] Rewrite guide for ApplicationDefinition API (external-apps)**: Comprehensive rewrite of the external apps guide using the ApplicationDefinition API with Minecraft server examples ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/website#488). - -* **[website] Add documentation for Go types usage**: Guide for using generated Go types for Cozystack managed applications as a Go module ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#465). - -* **[website] Update backup/restore documentation for VMI/VMDisk**: Updates backup documentation with VM instance and VM disk restore improvements ([**@androndo**](https://github.com/androndo) in cozystack/website#466). - -* **[website] Refactor docs versions to major.minor variants**: Moves docs to major.minor versioning for the v1.x series ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#477). - -* **[website] Trunk-based versioning with permanent next/ directory**: Replaces the old "pre-create `vX.Y/` draft directory" scheme with a permanent `content/en/docs/next/` trunk; released version directories are promoted explicitly by `hack/release_next.sh` on new minor/major releases, and routing between `next/` and `vX.Y/` is Makefile-driven ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#495). - -* **[website] Add updated OpenAPI spec**: Updates the OpenAPI specification for managed applications reference ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#469). - -* **[website] Add OpenAPI spec download to GitHub Pages build**: Fixes the GitHub Pages build to include the OpenAPI spec download ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#494). - -* **[website] Add OSS Health pages and OpenSSF badge**: Adds OSS Health section with OpenSSF Scorecard and Best Practices badges to the website ([**@tym83**](https://github.com/tym83) in cozystack/website#470). - -* **[website] Add Telemetry page under OSS Health section**: Adds the Telemetry page with initial data seeding to the OSS Health docs ([**@tym83**](https://github.com/tym83) in cozystack/website#471, cozystack/website#504). - -* **[website] Blog: OSS Health section launch announcement**: Publishes the announcement blog post for the OSS Health section ([**@tym83**](https://github.com/tym83) in cozystack/website#474). - -* **[website] Fix OpenSSF canonical status URL**: Changes the OpenSSF canonical status URL from pt-BR to en ([**@tym83**](https://github.com/tym83) in cozystack/website#475). - -* **[website] Add CozySummit Virtual 2026 program announcement**: Publishes the CozySummit Virtual 2026 program announcement blog post ([**@tym83**](https://github.com/tym83) in cozystack/website#472). - -* **[website] Add missing release announcements for v0.1–v0.41**: Backfills missing release announcement blog posts for historical Cozystack versions ([**@tym83**](https://github.com/tym83) in cozystack/website#468). - -* **[website] Blog: managed PostgreSQL with synchronous replication**: Adds a post covering the managed PostgreSQL synchronous-replication feature ([**@tym83**](https://github.com/tym83) in cozystack/website#497). - -* **[website] Blog taxonomies and client-side filter UI**: Registers article-type and topic taxonomies and adds a client-side filter on the blog list page ([**@tym83**](https://github.com/tym83) in cozystack/website#499). - -* **[website] Add images frontmatter for social preview on existing posts**: Adds images frontmatter for social preview on existing blog posts ([**@tym83**](https://github.com/tym83) in cozystack/website#498). - -* **[website] Fix broken links and stale anchors across v1 docs**: Fixes 14 broken links and stale talm anchors ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#486). - -* **[website] Prefix bundle package names with cozystack. in v1 examples**: Corrects package naming in documentation examples ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#482). - -* **[website] Finish isolated-field removal and document opt-in policy labels**: Removes the obsolete `isolated` field from tenant documentation and documents the new opt-in policy labels approach ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#481). - -* **[website] Add --take-ownership flag and describe networking.* fields**: Documents the `--take-ownership` flag and `networking.*` fields in the installation guide ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#480). - -* **[website] Fix KubeOVN MASTER_NODES example path and key in troubleshooting**: Corrects the MASTER_NODES example path and key ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#483). - -* **[website] Add CLAUDE.md for AI agent guidance**: Adds a CLAUDE.md file describing the trunk-based docs architecture for AI agent guidance ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#489). - -* **[website] Update /docs/v1/ redirect to latest v1.2**: Updates the `/docs/v1/` redirect target to point to the latest v1.2 docs on GitHub Pages ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#492). - -* **[website] Remove nbykov from CODEOWNERS and CLAUDE.md**: Cleans up CODEOWNERS and CLAUDE.md entries ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#491). - -* **[website] Add Ahrefs Analytics tracker**: Adds the Ahrefs Analytics tracker to the website ([**@tym83**](https://github.com/tym83) in cozystack/website#503). - -* **[website] Add breathing room between navbar and hero on OSS Health**: Minor styling fix for the OSS Health section ([**@tym83**](https://github.com/tym83) in cozystack/website#500). - -* **[website] Fix og social badge image and title**: Updates the social badge image and title ([**@tym83**](https://github.com/tym83) in cozystack/website#487). - -* **[website] Update managed apps reference for v1.2.1**: Automated managed-apps reference update ([**@cozystack-bot**](https://github.com/cozystack-bot) in cozystack/website#464). - -* **[external-apps-example] Replace MongoDB example with Minecraft apps**: Refactors the external apps example to use the ApplicationDefinition API with Minecraft server applications ([**@lexfrei**](https://github.com/lexfrei) in cozystack/external-apps-example#2). - -* **docs: update README introductory description**: Refines the platform positioning and improves clarity on core capabilities in the main README ([**@tym83**](https://github.com/tym83) in #2409). - -## Governance - -* **Add Mattia Eleuteri ([@mattia-eleuteri](https://github.com/mattia-eleuteri)) as Maintainer**: CSI, Storage, Networking & Security ([**@tym83**](https://github.com/tym83) in #2345). - -* **Add Matthieu Robin ([@matthieu-robin](https://github.com/matthieu-robin)) as Maintainer**: Managed applications, platform quality, and benchmarking ([**@tym83**](https://github.com/tym83) in #2346). - -## Contributors - -We'd like to thank all contributors who made this release possible: - -* [**@androndo**](https://github.com/androndo) -* [**@Arsolitt**](https://github.com/Arsolitt) -* [**@BROngineer**](https://github.com/BROngineer) -* [**@IvanHunters**](https://github.com/IvanHunters) -* [**@kitsunoff**](https://github.com/kitsunoff) -* [**@kvaps**](https://github.com/kvaps) -* [**@lexfrei**](https://github.com/lexfrei) -* [**@lllamnyp**](https://github.com/lllamnyp) -* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri) -* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) -* [**@sircthulhu**](https://github.com/sircthulhu) -* [**@tym83**](https://github.com/tym83) - -### New Contributors - -We're excited to welcome our first-time contributors: - -* [**@Arsolitt**](https://github.com/Arsolitt) — First contribution! - ---- - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.2.0...v1.3.0 diff --git a/docs/changelogs/v1.3.1.md b/docs/changelogs/v1.3.1.md deleted file mode 100644 index 0f149d0d..00000000 --- a/docs/changelogs/v1.3.1.md +++ /dev/null @@ -1,37 +0,0 @@ - - -# v1.3.1 (2026-04-28) - -Patch release covering a TenantNamespace IDOR fix in the API, a destructive `post-upgrade` hook removed from the etcd chart, kamaji controller stability, a `linstor-csi` bump that fixes live migration on Protocol-A/B DRBD resources, the missing `linstor-gui` build wiring, and a velero RBAC fix that unblocked installs on bundles without Velero. - -## Security - -* **fix(api): prevent IDOR in TenantNamespace Get and Watch handlers**: Two IDOR (Insecure Direct Object Reference) vulnerabilities allowed authenticated users to read TenantNamespace metadata they had no RoleBinding for. The `Get` and `Watch` handlers now go through a new `hasAccessToNamespace()` helper that lists RoleBindings scoped only to the target namespace (orders of magnitude faster than the previous all-cluster scan), returns `NotFound` instead of leaking existence on unauthorized access, and applies the same check on the `Watch` filter path. Includes regression tests for the unauthorized paths. ([**@IvanHunters**](https://github.com/IvanHunters) in #2471, backport #2524) - -## Features - -* **feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix**: Live migration of KubeVirt VMs on Protocol-A/B (async) DRBD volumes no longer fails with `Protocol C required`. `linstor-csi` v1.10.6 now installs a `Protocol=C` override on the resource-definition during dual-attach and reverts it on detach, so `replicated-async` StorageClasses and other Protocol-A/B resource groups support live migration without manual `drbdadm adjust` intervention. ([**@kvaps**](https://github.com/kvaps) in #2496, backport #2505) - -## Fixes - -* **fix(backups): move velero-configmap Role to velero chart**: The `backupstrategy-controller` (a default package) declared a Role/RoleBinding scoped to the `cozy-velero` namespace for managing `ResourceModifier` ConfigMaps. On bundles where Velero was not enabled, that namespace did not exist and the HelmRelease failed with `namespaces "cozy-velero" not found`, blocking installation. The Role/RoleBinding now lives in the velero chart, so it is created only when velero is actually deployed. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2459, backport #2467) - -* **fix(etcd): remove destructive post-upgrade cert-regeneration hook**: The etcd chart ran a `post-upgrade` Helm hook on every upgrade that deleted etcd TLS Secrets (`etcd-ca-tls`, `etcd-peer-ca-tls`, `etcd-client-tls`, `etcd-peer-tls`, `etcd-server-tls`) and then deleted etcd pods, forcing cert-manager to re-issue the entire etcd CA chain. On clusters with Kamaji-managed tenant control planes this put every tenant `kube-apiserver` into CrashLoopBackOff until each DataStore was manually re-reconciled. The hook was a one-shot `2.6.0 → 2.6.1` migration that became a permanent footgun once chart versioning moved to `0.0.0+` (always `< 2.6.1` per semver) and after the underlying `rotationPolicy: Always` issue was fixed in `47d81f70`. The hook is now removed entirely. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2462, backport #2511) - -* **fix(kamaji): increase memory limits and add startup probe**: The kamaji controller frequently entered CrashLoopBackOff due to OOMKills (exit 137) within ~20–25 seconds of startup, with the readiness probe failing while the controller was still finishing initialization. Memory limit raised from 500Mi to 512Mi, request from 100Mi to 256Mi, and a 60-second startup probe (12 attempts × 5s periods) is added so the controller has room to boot before liveness/readiness probes engage. ([**@IvanHunters**](https://github.com/IvanHunters) in #2421, backport #2491) - -## Build - -* **build(linstor): include linstor-gui in root image build target**: The `linstor-gui` package (added in #2382) was never wired into the root `Makefile`'s `build:` target, so CI never built or published the image. `ghcr.io/cozystack/cozystack/linstor-gui` returned `NAME_UNKNOWN` and `values.yaml` stayed pinned to `tag: 2.3.0` without a digest. The missing build line is added so the next CI run publishes the image and the per-package `Makefile` digest-pins `values.yaml` automatically. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2498, backport #2518) - -## Contributors - -Thanks to everyone who contributed to this patch release: - -* [**@IvanHunters**](https://github.com/IvanHunters) -* [**@kvaps**](https://github.com/kvaps) -* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) - -**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.3.0...v1.3.1 diff --git a/examples/backups/vmi/00-helpers.sh b/examples/backups/vmi/00-helpers.sh deleted file mode 100755 index 38405495..00000000 --- a/examples/backups/vmi/00-helpers.sh +++ /dev/null @@ -1,112 +0,0 @@ -#!/bin/bash -# Helper functions and variables for the VMInstance backup/restore demo -# Source this file in other scripts: source "$(dirname "$0")/00-helpers.sh" - -# ANSI color codes -export RED='\033[0;31m' -export GREEN='\033[0;32m' -export YELLOW='\033[1;33m' -export BLUE='\033[0;34m' -export MAGENTA='\033[0;35m' -export CYAN='\033[0;36m' -export WHITE='\033[1;37m' -export NC='\033[0m' # No Color -export BOLD='\033[1m' - -# Default settings -export NAMESPACE="${NAMESPACE:-tenant-root}" -export BACKUP_STORAGE_LOCATION="${BACKUP_STORAGE_LOCATION:-default}" - -# Logging functions (output to stderr to avoid polluting captured output) -log_info() { - echo -e "${BLUE}ℹ${NC} $*" >&2 -} - -log_success() { - echo -e "${GREEN}✔${NC} $*" >&2 -} - -log_warning() { - echo -e "${YELLOW}⚠${NC} $*" >&2 -} - -log_error() { - echo -e "${RED}✖${NC} $*" >&2 -} - -log_step() { - echo -e "\n${MAGENTA}${BOLD}▶ $*${NC}" >&2 -} - -log_substep() { - echo -e "${CYAN} → $*${NC}" >&2 -} - -log_command() { - echo -e "${WHITE} \$ $*${NC}" >&2 -} - -# Wait for user to press Enter -wait_for_enter() { - echo -e "\n${CYAN}Press Enter to continue...${NC}" >&2 - read -r -} - -# Check if a Kubernetes resource exists -resource_exists() { - local resource_type="$1" - local resource_name="$2" - local namespace="${3:-}" - - if [[ -n "$namespace" ]]; then - kubectl get "$resource_type" "$resource_name" -n "$namespace" &>/dev/null - else - kubectl get "$resource_type" "$resource_name" &>/dev/null - fi -} - -# Wait for a resource field to reach a desired value -wait_for_field() { - local resource_type="$1" - local resource_name="$2" - local jsonpath="$3" - local desired="$4" - local namespace="${5:-}" - local timeout="${6:-300}" - - log_substep "Waiting for $resource_type/$resource_name $jsonpath to become '$desired'..." - - local elapsed=0 - local ns_flag="" - [[ -n "$namespace" ]] && ns_flag="-n $namespace" - - while true; do - local current - # shellcheck disable=SC2086 - current=$(kubectl get "$resource_type" "$resource_name" $ns_flag -o jsonpath="$jsonpath" 2>/dev/null || true) - if [[ "$current" == "$desired" ]]; then - log_success "$resource_type/$resource_name reached '$desired'" - return 0 - fi - if [[ $elapsed -ge $timeout ]]; then - log_error "Timeout waiting for $resource_type/$resource_name (current: '$current', expected: '$desired')" - return 1 - fi - sleep 5 - elapsed=$((elapsed + 5)) - echo -n "." >&2 - done -} - -# Print a separator line -separator() { - echo -e "\n${CYAN}────────────────────────────────────────────────────────────${NC}\n" >&2 -} - -# Print script header -print_header() { - local title="$1" - echo -e "\n${MAGENTA}${BOLD}╔════════════════════════════════════════════════════════════╗${NC}" >&2 - echo -e "${MAGENTA}${BOLD}║${NC} ${WHITE}${BOLD}$title${NC}" >&2 - echo -e "${MAGENTA}${BOLD}╚════════════════════════════════════════════════════════════╝${NC}\n" >&2 -} diff --git a/examples/backups/vmi/01-create-strategies.sh b/examples/backups/vmi/01-create-strategies.sh deleted file mode 100755 index 78aa34d3..00000000 --- a/examples/backups/vmi/01-create-strategies.sh +++ /dev/null @@ -1,145 +0,0 @@ -#!/bin/bash -# Step 01: Create Velero backup/restore strategies for VMInstance and VMDisk -set -euo pipefail - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -source "$SCRIPT_DIR/00-helpers.sh" - -print_header "Step 1: Create Velero Strategies" - -log_step "Creating VMInstance strategy..." -log_command "kubectl apply -f - (Velero strategy: vminstance-strategy)" - -kubectl apply -f - <<'EOF' -apiVersion: strategy.backups.cozystack.io/v1alpha1 -kind: Velero -metadata: - name: vminstance-strategy -spec: - template: - # Symmetric restore filters: kubevirt-velero-plugin requires launcher pods in the backup, - # but restore orLabelSelectors limit what is applied from the tarball (e.g. skip another - # VM's pod that Velero added via PVC item action). VMDisk OR branches are appended by - # the controller from backup.status.underlyingResources or the Velero backup annotation. - restoreSpec: - existingResourcePolicy: update - includedNamespaces: - - '{{ .Application.metadata.namespace }}' - orLabelSelectors: - - matchLabels: - app.kubernetes.io/instance: 'vm-instance-{{ .Application.metadata.name }}' - - matchLabels: - apps.cozystack.io/application.kind: '{{ .Application.kind }}' - apps.cozystack.io/application.name: '{{ .Application.metadata.name }}' - includedResources: - - helmreleases.helm.toolkit.fluxcd.io - - virtualmachines.kubevirt.io - - virtualmachineinstances.kubevirt.io - - pods - - persistentvolumeclaims - - configmaps - - secrets - - controllerrevisions.apps - includeClusterResources: false - excludedResources: - # Required to avoid conflict with restored DV from HR VMDisk - - datavolumes.cdi.kubevirt.io - - spec: # see https://velero.io/docs/v1.17/api-types/backup/ - includedNamespaces: - - '{{ .Application.metadata.namespace }}' - orLabelSelectors: - # VM resources (VirtualMachine, DataVolume, PVC, etc.) - - matchLabels: - app.kubernetes.io/instance: 'vm-instance-{{ .Application.metadata.name }}' - # HelmRelease (the Cozystack app object) - - matchLabels: - apps.cozystack.io/application.kind: '{{ .Application.kind }}' - apps.cozystack.io/application.name: '{{ .Application.metadata.name }}' - includedResources: - - helmreleases.helm.toolkit.fluxcd.io - - virtualmachines.kubevirt.io - - virtualmachineinstances.kubevirt.io - # Required by kubevirt-velero-plugin for running VMs ("launcher pod must be in backup"). - - pods - # Required by kubevirt-velero-plugin requires DV to be in backup of VM, but it excludes in restores - - datavolumes.cdi.kubevirt.io - - persistentvolumeclaims - - configmaps - - secrets - - controllerrevisions.apps - includeClusterResources: false - storageLocation: '{{ .Parameters.backupStorageLocationName }}' - volumeSnapshotLocations: - - '{{ .Parameters.backupStorageLocationName }}' - snapshotVolumes: true - snapshotMoveData: true - ttl: 720h0m0s - itemOperationTimeout: 24h0m0s -EOF - -log_success "VMInstance strategy created" - -separator - -log_step "Creating VMDisk strategy..." -log_command "kubectl apply -f - (Velero strategy: vmdisk-strategy)" - -kubectl apply -f - <<'EOF' -apiVersion: strategy.backups.cozystack.io/v1alpha1 -kind: Velero -metadata: - name: vmdisk-strategy -spec: - template: - restoreSpec: - existingResourcePolicy: update - includedNamespaces: - - '{{ .Application.metadata.namespace }}' - orLabelSelectors: - - matchLabels: - app.kubernetes.io/instance: 'vm-disk-{{ .Application.metadata.name }}' - - matchLabels: - apps.cozystack.io/application.kind: '{{ .Application.kind }}' - apps.cozystack.io/application.name: '{{ .Application.metadata.name }}' - includedResources: - - helmreleases.helm.toolkit.fluxcd.io - - persistentvolumeclaims - - configmaps - includeClusterResources: false - - spec: - includedNamespaces: - - '{{ .Application.metadata.namespace }}' - orLabelSelectors: - - matchLabels: - app.kubernetes.io/instance: 'vm-disk-{{ .Application.metadata.name }}' - - matchLabels: - apps.cozystack.io/application.kind: '{{ .Application.kind }}' - apps.cozystack.io/application.name: '{{ .Application.metadata.name }}' - includedResources: - - helmreleases.helm.toolkit.fluxcd.io - - persistentvolumeclaims - - configmaps - includeClusterResources: false - storageLocation: '{{ .Parameters.backupStorageLocationName }}' - volumeSnapshotLocations: - - '{{ .Parameters.backupStorageLocationName }}' - snapshotVolumes: true - snapshotMoveData: true - ttl: 720h0m0s - itemOperationTimeout: 24h0m0s -EOF - -log_success "VMDisk strategy created" - -separator - -log_step "Verifying strategies..." -log_command "kubectl get velero.strategy.backups.cozystack.io" -kubectl get velero.strategy.backups.cozystack.io - -separator - -log_success "Velero strategies are ready" -echo -e "\n${GREEN}${BOLD}Next step:${NC} ./02-create-backupclass.sh" diff --git a/examples/backups/vmi/02-create-backupclass.sh b/examples/backups/vmi/02-create-backupclass.sh deleted file mode 100755 index 08c29fc1..00000000 --- a/examples/backups/vmi/02-create-backupclass.sh +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/bash -# Step 02: Create BackupClass that binds strategies to application types -set -euo pipefail - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -source "$SCRIPT_DIR/00-helpers.sh" - -print_header "Step 2: Create BackupClass" - -log_step "Creating BackupClass 'velero'..." -log_info "BackupClass maps application kinds (VMInstance, VMDisk) to their Velero strategies" -log_command "kubectl apply -f - (BackupClass: velero)" - -kubectl apply -f - < - external: false - externalMethod: PortList - externalPorts: - - 22 -EOF - -log_success "VMInstance created" - -separator - -log_step "Verifying VMInstance..." -log_command "kubectl get vminstance test -n $NAMESPACE" -kubectl get vminstance test -n "$NAMESPACE" - -separator - -log_success "VMInstance is ready" -echo -e "\n${GREEN}${BOLD}Next step:${NC} ./05-create-backupjob.sh" diff --git a/examples/backups/vmi/05-create-backupjob.sh b/examples/backups/vmi/05-create-backupjob.sh deleted file mode 100755 index 581490a4..00000000 --- a/examples/backups/vmi/05-create-backupjob.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/bash -# Step 05: Create a BackupJob to back up the VMInstance -set -euo pipefail - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -source "$SCRIPT_DIR/00-helpers.sh" - -print_header "Step 5: Create BackupJob" - -log_step "Creating BackupJob 'test-backup' in namespace $NAMESPACE..." -log_info "This triggers a Velero backup of VMInstance 'test' and all its disks" -log_command "kubectl apply -f - (BackupJob: test-backup)" - -kubectl apply -f - <-orig-`, only for in-place restore - keepOriginalIpAndMac: true # restores original IP and MAC address of VMI via OVN annotations -EOF - -log_success "RestoreJob created" - -separator - -log_step "Waiting for RestoreJob to complete..." -wait_for_field restorejob restore-in-place-test '{.status.phase}' Succeeded "$NAMESPACE" 600 - -separator - -log_step "Verifying RestoreJob result..." -log_command "kubectl get restorejob restore-in-place-test -n $NAMESPACE -o yaml" -kubectl get restorejob restore-in-place-test -n "$NAMESPACE" -o wide - -separator - -log_success "In-place restore completed successfully" -echo -e "\n${GREEN}${BOLD}Next step:${NC} ./07-restore-to-copy.sh" diff --git a/examples/backups/vmi/07-restore-to-copy.sh b/examples/backups/vmi/07-restore-to-copy.sh deleted file mode 100755 index 9b84ce55..00000000 --- a/examples/backups/vmi/07-restore-to-copy.sh +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/bash -# Step 07: Restore the VMInstance to a copy in a different namespace -set -euo pipefail - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -source "$SCRIPT_DIR/00-helpers.sh" - -TARGET_NAMESPACE="${TARGET_NAMESPACE:-tenant-root-copy}" - -print_header "Step 7: Restore VMInstance to Copy (Cross-Namespace)" - -log_info "Restoring to the same namespace with a different app name is not supported" -log_info "due to Velero DataUpload limitations. Cross-namespace restore uses Velero's namespaceMapping." - -separator - -log_step "Ensuring target namespace '$TARGET_NAMESPACE' exists..." -kubectl create namespace "$TARGET_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f - -log_success "Namespace '$TARGET_NAMESPACE' is ready" - -separator - -log_step "Creating RestoreJob 'restore-to-copy-test' in namespace $NAMESPACE..." -log_info "The backup will be restored into namespace '$TARGET_NAMESPACE' using Velero namespaceMapping" -log_command "kubectl apply -f - (RestoreJob: restore-to-copy-test)" - -kubectl apply -f - <-orig-`, only for in-place restore - keepOriginalIpAndMac: false # restores original IP and MAC address of VMI via OVN annotations -EOF - -log_success "RestoreJob created" - -separator - -log_step "Waiting for RestoreJob to complete..." -wait_for_field restorejob restore-to-copy-test '{.status.phase}' Succeeded "$NAMESPACE" 600 - -separator - -log_step "Verifying RestoreJob result..." -log_command "kubectl get restorejob restore-to-copy-test -n $NAMESPACE -o yaml" -kubectl get restorejob restore-to-copy-test -n "$NAMESPACE" -o wide - -separator - -log_step "Checking resources in target namespace..." -log_command "kubectl get all -n $TARGET_NAMESPACE" -kubectl get all -n "$TARGET_NAMESPACE" 2>/dev/null || log_warning "No resources found in $TARGET_NAMESPACE" - -separator - -log_success "Cross-namespace restore completed successfully" diff --git a/examples/backups/vmi/cleanup.sh b/examples/backups/vmi/cleanup.sh deleted file mode 100755 index 5965c3f0..00000000 --- a/examples/backups/vmi/cleanup.sh +++ /dev/null @@ -1,70 +0,0 @@ -#!/bin/bash -# Clean up all resources created by the demo -set -euo pipefail - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -source "$SCRIPT_DIR/00-helpers.sh" - -TARGET_NAMESPACE="${TARGET_NAMESPACE:-tenant-root-copy}" - -print_header "Cleanup Demo Resources" - -log_warning "This script will delete all resources created during the demo" -echo -e "\n${YELLOW}The following will be deleted:${NC}" -echo " - RestoreJobs (restore-in-place-test, restore-to-copy-test)" -echo " - BackupJob (test-backup) and associated Backup" -echo " - VMInstance (test)" -echo " - VMDisk (ubuntu-source)" -echo " - BackupClass (velero)" -echo " - Velero strategies (vminstance-strategy, vmdisk-strategy)" -echo " - Target namespace ($TARGET_NAMESPACE)" -echo "" - -read -p "Continue? (y/N): " -n 1 -r -echo -if [[ ! $REPLY =~ ^[Yy]$ ]]; then - log_info "Cancelled" - exit 0 -fi - -separator - -log_step "Deleting RestoreJobs..." -kubectl delete restorejob restore-to-copy-test -n "$NAMESPACE" 2>/dev/null || log_warning "RestoreJob restore-to-copy-test not found" -kubectl delete restorejob restore-in-place-test -n "$NAMESPACE" 2>/dev/null || log_warning "RestoreJob restore-in-place-test not found" - -separator - -log_step "Deleting BackupJob and Backup..." -kubectl delete backupjob test-backup -n "$NAMESPACE" 2>/dev/null || log_warning "BackupJob test-backup not found" -kubectl delete backup test-backup -n "$NAMESPACE" 2>/dev/null || log_warning "Backup test-backup not found" - -separator - -log_step "Deleting VMInstance..." -kubectl delete vminstance test -n "$NAMESPACE" 2>/dev/null || log_warning "VMInstance test not found" - -log_step "Deleting VMDisk..." -kubectl delete vmdisk ubuntu-source -n "$NAMESPACE" 2>/dev/null || log_warning "VMDisk ubuntu-source not found" - -separator - -log_step "Deleting BackupClass..." -kubectl delete backupclass velero 2>/dev/null || log_warning "BackupClass velero not found" - -separator - -log_step "Deleting Velero strategies..." -kubectl delete velero.strategy.backups.cozystack.io vminstance-strategy 2>/dev/null || log_warning "Strategy vminstance-strategy not found" -kubectl delete velero.strategy.backups.cozystack.io vmdisk-strategy 2>/dev/null || log_warning "Strategy vmdisk-strategy not found" - -separator - -log_step "Deleting target namespace..." -kubectl delete namespace "$TARGET_NAMESPACE" 2>/dev/null || log_warning "Namespace $TARGET_NAMESPACE not found" - -separator - -log_success "Cleanup complete" -log_info "All demo resources have been deleted" -echo -e "\n${GREEN}${BOLD}To re-run the demo:${NC} ./01-create-strategies.sh" diff --git a/examples/backups/vmi/run-all.sh b/examples/backups/vmi/run-all.sh deleted file mode 100755 index b58f4b9d..00000000 --- a/examples/backups/vmi/run-all.sh +++ /dev/null @@ -1,62 +0,0 @@ -#!/bin/bash -# Run the full VMInstance backup/restore demo sequentially -set -euo pipefail - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -source "$SCRIPT_DIR/00-helpers.sh" - -print_header "VMInstance Backup & Restore Demo" - -log_info "This script will run all demo steps sequentially" -log_info "There will be a pause between steps for observation" -echo "" - -SCRIPTS=( - "01-create-strategies.sh" - "02-create-backupclass.sh" - "03-create-vmdisk.sh" - "04-create-vminstance.sh" - "05-create-backupjob.sh" - "06-restore-in-place.sh" - "07-restore-to-copy.sh" -) - -echo -e "${CYAN}Demo steps:${NC}" -for i in "${!SCRIPTS[@]}"; do - echo " $((i+1)). ${SCRIPTS[$i]}" -done -echo "" - -read -p "Run demo? (y/N): " -n 1 -r -echo -if [[ ! $REPLY =~ ^[Yy]$ ]]; then - log_info "Cancelled" - exit 0 -fi - -separator - -for script in "${SCRIPTS[@]}"; do - if [[ -x "$SCRIPT_DIR/$script" ]]; then - "$SCRIPT_DIR/$script" - separator - wait_for_enter - else - log_error "Script not found or not executable: $script" - exit 1 - fi -done - -print_header "Demo Complete" - -log_success "All steps completed successfully!" -echo "" -log_info "What was demonstrated:" -echo " 1. Created Velero backup strategies for VMInstance and VMDisk" -echo " 2. Created BackupClass binding strategies to application types" -echo " 3. Provisioned a VMDisk and VMInstance" -echo " 4. Created a backup of the VMInstance via BackupJob" -echo " 5. Restored the VMInstance in-place" -echo " 6. Restored the VMInstance to a copy in a different namespace" -echo "" -log_info "To clean up resources: ./cleanup.sh" diff --git a/examples/backups/vmi/scenario-admin-prepare.md b/examples/backups/vmi/scenario-admin-prepare.md deleted file mode 100644 index edfca5d1..00000000 --- a/examples/backups/vmi/scenario-admin-prepare.md +++ /dev/null @@ -1,73 +0,0 @@ -# Scenario: Cluster Administrator Configures Backups - -This scenario walks through the cluster-level setup required before users can -back up and restore their virtual machines. A cluster administrator creates -Velero strategies and a BackupClass that binds those strategies to Cozystack -application types. - -## Prerequisites - -- A running Cozystack cluster with the backup-controller installed. -- Velero deployed in the `cozy-velero` namespace with a configured - BackupStorageLocation (default: `default`). -- `kubectl` access with cluster-admin privileges. - -## Steps - -### 1. Create Velero Strategies - -```bash -./01-create-strategies.sh -``` - -This creates two cluster-scoped `Velero` strategy objects: - -| Strategy | Purpose | -|---|---| -| `vminstance-strategy` | Defines backup and restore templates for `VMInstance` applications. Includes VirtualMachine, PVCs, HelmReleases, pods (required by kubevirt-velero-plugin), and supporting resources. Uses `snapshotMoveData: true` for portable volume snapshots. | -| `vmdisk-strategy` | Defines backup and restore templates for standalone `VMDisk` applications. Covers HelmReleases, PVCs, and ConfigMaps. | - -Both strategies use Go templates with `{{ .Application.metadata.name }}`, -`{{ .Application.metadata.namespace }}`, and `{{ .Parameters.backupStorageLocationName }}` -so they can be reused across any application instance. - -**Key design details:** - -- `orLabelSelectors` scope backups to only the resources belonging to a - specific application, preventing cross-contamination between VMs in the - same namespace. -- The restore spec excludes `datavolumes.cdi.kubevirt.io` to avoid conflicts - when the HelmRelease of VMDisk recreates DataVolumes after restore. -- `existingResourcePolicy: update` allows restoring over existing resources - during in-place restore. - -### 2. Create BackupClass - -```bash -./02-create-backupclass.sh -``` - -Creates a `BackupClass` named `velero` that maps application types to their -strategies: - -| Application Kind | Strategy | Parameters | -|---|---|---| -| `VMInstance` (`apps.cozystack.io`) | `vminstance-strategy` | `backupStorageLocationName: default` | -| `VMDisk` (`apps.cozystack.io`) | `vmdisk-strategy` | `backupStorageLocationName: default` | - -The `backupStorageLocationName` parameter can be overridden via the -`BACKUP_STORAGE_LOCATION` environment variable if your Velero installation -uses a non-default storage location. - -## Configuration - -| Variable | Default | Description | -|---|---|---| -| `BACKUP_STORAGE_LOCATION` | `default` | Velero BackupStorageLocation name | - -## Result - -After completing these steps the cluster is ready for users to create backups -of their `VMInstance` and `VMDisk` applications by referencing the `velero` -BackupClass. No further admin action is required for individual backup or -restore operations. diff --git a/examples/backups/vmi/scenario-user-backup.md b/examples/backups/vmi/scenario-user-backup.md deleted file mode 100644 index 31241fd9..00000000 --- a/examples/backups/vmi/scenario-user-backup.md +++ /dev/null @@ -1,91 +0,0 @@ -# Scenario: User Creates a VM Backup - -This scenario demonstrates how a tenant user provisions a virtual machine and -creates a backup of it. The backup captures the VM definition, its disks, and -network identity so it can be restored later. - -## Prerequisites - -- Cluster administrator has completed the setup from - [scenario-admin.md](scenario-admin.md) (strategies and BackupClass exist). -- A tenant namespace (default: `tenant-root`). -- `kubectl` access scoped to the tenant namespace. - -## Steps - -### 1. Create a VMDisk - -```bash -./03-create-vmdisk.sh -``` - -Creates a `VMDisk` named `ubuntu-source` that downloads the Ubuntu Noble cloud -image and provisions a 20Gi replicated PVC. The disk serves as the boot volume -for the virtual machine. - -Wait for the image download to complete before proceeding. You can monitor -progress with: - -```bash -kubectl get vmdisk ubuntu-source -n tenant-root -w -``` - -### 2. Create a VMInstance - -```bash -./04-create-vminstance.sh -``` - -Creates a `VMInstance` named `test` that references the `ubuntu-source` disk. -The VM boots with the `ubuntu` instance profile on a `u1.medium` instance type. - -Verify the VM is running: - -```bash -kubectl get vmi -n tenant-root -``` - -### 3. Create a BackupJob - -```bash -./05-create-backupjob.sh -``` - -Creates a `BackupJob` named `test-backup` that triggers a full backup of the -`test` VMInstance. The backup controller: - -1. Resolves the `velero` BackupClass to find the matching `vminstance-strategy`. -2. Discovers underlying resources (DataVolumes, OVN IP/MAC from the VM pod). -3. Creates a Velero Backup in the `cozy-velero` namespace with label selectors - scoped to this specific VM and its disks. -4. Velero snapshots and moves the volume data to the configured storage - location. - -The script waits up to 10 minutes for the BackupJob to reach the `Succeeded` -phase. On completion, a `Backup` object is created in the same namespace -containing: - -- `spec.applicationRef` — reference to the backed-up VMInstance. -- `spec.strategyRef` — reference to the Velero strategy used. -- `spec.driverMetadata` — Velero backup name for later restore. -- `status.underlyingResources` — captured DataVolume names and OVN IP/MAC - addresses. - -You can inspect the resulting Backup: - -```bash -kubectl get backups -n tenant-root -kubectl get backup test-backup -n tenant-root -o yaml -``` - -## Configuration - -| Variable | Default | Description | -|---|---|---| -| `NAMESPACE` | `tenant-root` | Tenant namespace for all resources | - -## Result - -After completing these steps you have a `Backup` artifact that can be used to -restore the VM either in-place or to a different namespace. See -[scenario-user-restore.md](scenario-user-restore.md) for restore options. diff --git a/examples/backups/vmi/scenario-user-restore.md b/examples/backups/vmi/scenario-user-restore.md deleted file mode 100644 index 1d35b22b..00000000 --- a/examples/backups/vmi/scenario-user-restore.md +++ /dev/null @@ -1,101 +0,0 @@ -# Scenario: User Restores a VM - -This scenario demonstrates two restore methods: in-place restore (rollback the -VM to a previous state) and cross-namespace restore (create a copy of the VM in -a different namespace). - -## Prerequisites - -- A completed backup from [scenario-user-backup.md](scenario-user-backup.md) - (the `test-backup` Backup object exists in the tenant namespace). -- `kubectl` access scoped to the tenant namespace. - -## Method 1: In-Place Restore - -```bash -./06-restore-in-place.sh -``` - -Creates a `RestoreJob` that restores the `test` VMInstance back to the state -captured in the `test-backup` Backup. The `targetApplicationRef` points to the -same application as the original backup. - -The backup controller performs the following steps automatically: - -1. **Suspends HelmReleases** — prevents Flux from reconciling the VM and its - disks during restore. -2. **Halts the VirtualMachine** — sets `runStrategy: Halted` and waits for the - VirtualMachineInstance (launcher pod) to terminate. -3. **Renames existing PVCs** — moves each PVC to `-orig-` to - preserve the current disk data as a safety net. -4. **Deletes DataVolumes** — removes DVs so CDI does not recreate PVCs before - Velero restores them. -5. **Creates Velero Restore** — restores resources from the backup with: - - `existingResourcePolicy: update` to overwrite existing objects. - - Resource modifier rules that add `cdi.kubevirt.io/allowClaimAdoption=true` - to restored PVCs so CDI can adopt them. - - OVN IP/MAC annotations to preserve the VM's network identity. - -After the Velero Restore completes, the HelmReleases resume and the VM boots -with the restored disk data while retaining its original IP and MAC addresses. - -## Method 2: Cross-Namespace Restore (Copy) - -```bash -./07-restore-to-copy.sh -``` - -Creates a `RestoreJob` with `spec.options.targetNamespace` set to a different namespace -(default: `tenant-root-copy`). This creates an independent copy of the VM -without affecting the original. - -Key differences from in-place restore: - -| Aspect | In-Place | Cross-Namespace | -|---|---|---| -| Source VM affected | Yes (halted, PVCs renamed) | No (untouched) | -| Velero namespaceMapping | Not used | Maps source NS to target NS | -| OVN IP/MAC | Preserved from backup | Skipped (new IP/MAC assigned) | -| Pre-restore preparation | Full (suspend, halt, rename, delete) | Skipped | - -The script ensures the target namespace exists before creating the RestoreJob. -Velero's `namespaceMapping` redirects all resources from the source namespace to -the target namespace during restore. - -### Important limitation - -Restoring to the **same namespace** with a **different application name** is not -supported. Velero's DataUpload always writes volume data to PVCs with the -original name regardless of resource modifiers, which causes conflicts. If you -attempt this, the RestoreJob will fail with an error message suggesting -cross-namespace restore instead. - -## Configuration - -| Variable | Default | Description | -|---|---|---| -| `NAMESPACE` | `tenant-root` | Source namespace (where the Backup lives) | -| `TARGET_NAMESPACE` | `tenant-root-copy` | Target namespace for cross-namespace restore | - -## Verify - -After either restore method, verify the VM is running: - -```bash -# In-place -kubectl get vmi -n tenant-root - -# Cross-namespace copy -kubectl get vmi -n tenant-root-copy -``` - -## Cleanup - -To remove all resources created by the demo: - -```bash -./cleanup.sh -``` - -This deletes RestoreJobs, BackupJobs, Backups, VMInstance, VMDisk, BackupClass, -strategies, and the target namespace. diff --git a/examples/desired-backup.yaml b/examples/desired-backup.yaml new file mode 100644 index 00000000..c06b8f82 --- /dev/null +++ b/examples/desired-backup.yaml @@ -0,0 +1,20 @@ +apiVersion: backups.cozystack.io/v1alpha1 +kind: BackupJob +metadata: + name: desired-backup + namespace: tenant-root + labels: + backups.cozystack.io/triggered-by: manual +spec: + applicationRef: + apiGroup: apps.cozystack.io + kind: VirtualMachine + name: vm1 + storageRef: + apiGroup: apps.cozystack.io + kind: Bucket + name: test-bucket + strategyRef: + apiGroup: strategy.backups.cozystack.io + kind: Velero + name: velero-strategy-default \ No newline at end of file diff --git a/go.mod b/go.mod index 7b7d5bc4..3ecda336 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,6 @@ module github.com/cozystack/cozystack go 1.25.0 require ( - github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1 github.com/emicklei/dot v1.10.0 github.com/fluxcd/helm-controller/api v1.4.3 github.com/fluxcd/source-controller/api v1.7.4 @@ -29,10 +28,8 @@ require ( k8s.io/klog/v2 v2.130.1 k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d - sigs.k8s.io/container-object-storage-interface-api v0.1.0 sigs.k8s.io/controller-runtime v0.22.4 sigs.k8s.io/structured-merge-diff/v6 v6.3.0 - sigs.k8s.io/yaml v1.6.0 ) require ( @@ -47,6 +44,7 @@ require ( github.com/coreos/go-systemd/v22 v22.5.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/emicklei/go-restful/v3 v3.12.2 // indirect + github.com/evanphx/json-patch v4.12.0+incompatible // indirect github.com/evanphx/json-patch/v5 v5.9.11 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect @@ -127,6 +125,7 @@ require ( sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect + sigs.k8s.io/yaml v1.6.0 // indirect ) // See: issues.k8s.io/135537 diff --git a/go.sum b/go.sum index 81e1779f..0a69ac87 100644 --- a/go.sum +++ b/go.sum @@ -20,8 +20,6 @@ github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c h1:C2wIfH/OzhU9XOK/e6Ik9cg7nZ1z6fN4lf6a3yFdik8= github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw= -github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1 h1:9uLa/8J4lRx3sNuaVH8UZqgZvnskHATPo5GxEKh0iSM= -github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1/go.mod h1:kPeS9YPB4ENbvNINEkkp0SX8FB+gvwoOHGOHMT3Tg9Y= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -321,8 +319,6 @@ k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPG k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw= -sigs.k8s.io/container-object-storage-interface-api v0.1.0 h1:8tB6JFQhbQIC1hwGQ+q4+tmSSNfjKemb7bFI6C0CK/4= -sigs.k8s.io/container-object-storage-interface-api v0.1.0/go.mod h1:YiB+i/UGkzqgODDhRG3u7jkbWkQcoUeLEJ7hwOT/2Qk= sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A= sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= diff --git a/hack/admin-kubeconfig-invariant.bats b/hack/admin-kubeconfig-invariant.bats deleted file mode 100644 index a4b98b00..00000000 --- a/hack/admin-kubeconfig-invariant.bats +++ /dev/null @@ -1,145 +0,0 @@ -#!/usr/bin/env bats -# ----------------------------------------------------------------------------- -# Chart-wide invariant for packages/apps/kubernetes: -# -# Every Deployment in this chart that mounts -admin-kubeconfig as a -# Secret volume MUST: -# - declare that volume optional: true (so kubelet does not FailedMount -# while Kamaji is still provisioning the Secret), AND -# - include the wait-for-kubeconfig init container (so the pod becomes -# Ready only after Kamaji publishes the Secret). -# -# The per-template unittests in packages/apps/kubernetes/tests/ lock in -# today's three Deployments (cluster-autoscaler, kccm, csi controller) by -# name. This invariant is stricter: any future Deployment added to this -# chart that mounts the same Secret but forgets the guard will fail here. -# -# Requires: helm, yq (mikefarah v4+), jq. All three are available on the -# project's CI runners and on the maintainer workstation. -# ----------------------------------------------------------------------------- - -@test "every Deployment mounting admin-kubeconfig has optional:true and wait-for-kubeconfig init" { - values_file="packages/apps/kubernetes/tests/values-ci.yaml" - [ -f "$values_file" ] - - tmp=$(mktemp -d) - trap 'rm -rf "$tmp"' EXIT - - helm template invariant packages/apps/kubernetes \ - --namespace tenant-root \ - --values "$values_file" \ - 2>/dev/null > "$tmp/rendered.yaml" - - # yq streams one JSON object per input document. jq -s slurps the stream - # into an array so we can treat all Deployments as a single collection. - yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \ - | jq -s --raw-output ' - map(select(.kind == "Deployment")) | - map({ - name: .metadata.name, - volumes: (.spec.template.spec.volumes // []), - initNames: ((.spec.template.spec.initContainers // []) | map(.name)), - }) | - map( - .name as $n | - .initNames as $ins | - (.volumes[] | select(.secret.secretName | test("-admin-kubeconfig$")?)) - | { - name: $n, - optional: (.secret.optional == true), - hasInit: ($ins | index("wait-for-kubeconfig") != null), - } - ) - ' > "$tmp/summary.json" - - # At least one Deployment must match; if a refactor removes every - # admin-kubeconfig volume from this chart, the test must be updated - # deliberately rather than silently passing. - matched=$(jq 'length' "$tmp/summary.json") - [ "$matched" -ge 1 ] - - offenders=$(jq --raw-output '.[] | select(.optional != true or .hasInit != true) | .name' "$tmp/summary.json") - - if [ -n "$offenders" ]; then - echo "Deployments mounting *-admin-kubeconfig without optional:true + wait-for-kubeconfig init:" >&2 - echo "$offenders" >&2 - echo "Full summary:" >&2 - cat "$tmp/summary.json" >&2 - exit 1 - fi - - echo "Invariant holds for $matched Deployment(s)" -} - -@test "chart emits zero admin-kubeconfig Deployments when tenant has no etcd DataStore" { - # Without a DataStore (parent Tenant has not populated _namespace.etcd yet) - # the control-plane-side Deployments must NOT render at all. If they did, - # the wait-for-kubeconfig init would CrashLoopBackOff indefinitely - there - # would be no KamajiControlPlane to provision the Secret - consuming the - # HelmRelease wait budget and triggering exactly the remediation cycle the - # rest of this chart tries to avoid. This test renders the whole chart - # with etcd empty and asserts no Deployment references the admin-kubeconfig - # Secret. - tmp=$(mktemp -d) - trap 'rm -rf "$tmp"' EXIT - - helm template invariant packages/apps/kubernetes \ - --namespace tenant-root \ - --values packages/apps/kubernetes/tests/values-ci-no-etcd.yaml \ - 2>/dev/null > "$tmp/rendered.yaml" - - matched=$( - yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \ - | jq -s ' - map(select(.kind == "Deployment")) | - map(select( - (.spec.template.spec.volumes // []) - | any(.secret.secretName | test("-admin-kubeconfig$")?) - )) | - length - ' - ) - - if [ "$matched" -ne 0 ]; then - echo "Expected zero Deployments mounting *-admin-kubeconfig when etcd is empty, got $matched:" >&2 - yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \ - | jq -s 'map(select(.kind == "Deployment") | .metadata.name)' >&2 - exit 1 - fi - - echo "No admin-kubeconfig Deployments rendered for empty etcd (as expected)" -} - -@test "chart emits zero admin-kubeconfig HelmReleases when tenant has no etcd DataStore" { - # Same principle as the Deployment variant above, extended to every child - # HelmRelease (cilium, coredns, csi, cert-manager, ...). They reference - # *-admin-kubeconfig via kubeConfig.secretRef and would otherwise sit in - # NotReady forever on an etcd-less tenant, polluting the HelmRelease list - # the operator sees and contradicting the "awaiting-etcd beacon only" - # contract of the soft-skip path. - tmp=$(mktemp -d) - trap 'rm -rf "$tmp"' EXIT - - helm template invariant packages/apps/kubernetes \ - --namespace tenant-root \ - --values packages/apps/kubernetes/tests/values-ci-no-etcd.yaml \ - 2>/dev/null > "$tmp/rendered.yaml" - - matched=$( - yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \ - | jq -s ' - map(select(.kind == "HelmRelease")) | - map(select(.spec.kubeConfig.secretRef.name | test("-admin-kubeconfig$")?)) | - length - ' - ) - - if [ "$matched" -ne 0 ]; then - echo "Expected zero HelmReleases referencing *-admin-kubeconfig when etcd is empty, got $matched:" >&2 - yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \ - | jq -s 'map(select(.kind == "HelmRelease") | .metadata.name)' >&2 - exit 1 - fi - - echo "No admin-kubeconfig HelmReleases rendered for empty etcd (as expected)" -} diff --git a/hack/cdi_golden_image_create.sh b/hack/cdi_golden_image_create.sh index f19f9970..be1558d0 100644 --- a/hack/cdi_golden_image_create.sh +++ b/hack/cdi_golden_image_create.sh @@ -16,7 +16,7 @@ kubectl create -f - <:(:)+ -# where each is [a-z0-9_]. Raw DCGM metrics (DCGM_FI_*), -# kube-state-metrics (kube_*) and similar uppercase / single-word metric -# names do not match because the leading segment must be lowercase and the -# whole expression must contain at least two ':' characters. -extract_refs() { - json_file=$1 - # Prometheus convention allows 2-segment rule names (level:metric); this - # regex is tuned to the 3+ segment convention used in this repo - # (level:metric:op — e.g. cluster:gpu_count:total). Update if future - # rules use 2 segments, otherwise they will be silently skipped. - grep -hoE '[a-z][a-z0-9_]*:[a-z0-9_]+:[a-z0-9_]+' "$json_file" | sort -u -} - -# Resolve "gpu/foo" -> "$DASHBOARDS_DIR/gpu/foo.json" -list_tracked_gpu_dashboards() { - awk '/^gpu\// { print $0 ".json" }' "$DASHBOARDS_LIST" -} - -# Extract the set of DCGM_FI_* metric names declared in a CSV file. Handles -# both the upstream-style default CSV (unindented) and the ConfigMap-style -# custom CSV (YAML-indented). A declaration line starts — after any leading -# whitespace — with "DCGM_FI_," ; comment lines begin with "#" and are -# skipped. Uses POSIX awk's match()+RSTART/RLENGTH so no GNU extensions -# are required. -extract_csv_metrics() { - file=$1 - awk ' - { - line = $0 - sub(/^[[:space:]]+/, "", line) - if (line ~ /^#/) next - if (match(line, /^DCGM_FI_[A-Z0-9_]+/)) { - print substr(line, RSTART, RLENGTH) - } - } - ' "$file" | sort -u -} - -# Extract the set of DCGM_FI_* metric references from a text file (dashboard -# JSON or rules YAML). A DCGM metric name has at least two underscore-delimited -# segments after the "DCGM_FI_" prefix (e.g. DCGM_FI_DEV_GPU_UTIL, DCGM_FI_PROF_ -# PIPE_TENSOR_ACTIVE, DCGM_FI_DRIVER_VERSION). Requiring two segments keeps -# the matcher from latching onto glob stubs like "DCGM_FI_DEV_*_VIOLATION" that -# appear in comments. -extract_dcgm_refs() { - file=$1 - grep -hoE 'DCGM_FI_[A-Z0-9]+(_[A-Z0-9]+)+' "$file" | sort -u -} - -@test "every recording rule reference in tracked GPU dashboards has a matching record" { - TMP=$(mktemp -d) - trap 'rm -rf "$TMP"' EXIT - - extract_rules > "$TMP/rules.txt" - [ -s "$TMP/rules.txt" ] || { echo "no recording rules extracted from $RULES_FILE" >&2; exit 1; } - - list_tracked_gpu_dashboards > "$TMP/dashboards.txt" - [ -s "$TMP/dashboards.txt" ] || { echo "no gpu/* dashboards listed in $DASHBOARDS_LIST" >&2; exit 1; } - - failed=0 - while IFS= read -r dashboard_rel; do - dashboard="$DASHBOARDS_DIR/$dashboard_rel" - if [ ! -f "$dashboard" ]; then - echo "ERROR: dashboard listed but file missing: $dashboard" >&2 - failed=1 - continue - fi - - extract_refs "$dashboard" > "$TMP/refs.txt" - # comm -23: lines unique to refs.txt (referenced but not defined) - # Both inputs must be sorted; extract_* helpers already sort. - comm -23 "$TMP/refs.txt" "$TMP/rules.txt" > "$TMP/missing.txt" - if [ -s "$TMP/missing.txt" ]; then - echo "ERROR: $dashboard_rel references undefined recording rules:" >&2 - sed 's/^/ - /' "$TMP/missing.txt" >&2 - failed=1 - fi - done < "$TMP/dashboards.txt" - - [ "$failed" -eq 0 ] -} - -@test "every DCGM metric referenced in tracked dashboards and rules is declared" { - TMP=$(mktemp -d) - trap 'rm -rf "$TMP"' EXIT - - [ -f "$DCGM_DEFAULT_CSV" ] || { echo "missing $DCGM_DEFAULT_CSV" >&2; exit 1; } - [ -f "$DCGM_CUSTOM_CSV" ] || { echo "missing $DCGM_CUSTOM_CSV" >&2; exit 1; } - - { - extract_csv_metrics "$DCGM_DEFAULT_CSV" - extract_csv_metrics "$DCGM_CUSTOM_CSV" - } | sort -u > "$TMP/declared.txt" - [ -s "$TMP/declared.txt" ] || { echo "no DCGM metrics extracted from CSVs" >&2; exit 1; } - - list_tracked_gpu_dashboards > "$TMP/dashboards.txt" - [ -s "$TMP/dashboards.txt" ] || { echo "no gpu/* dashboards listed in $DASHBOARDS_LIST" >&2; exit 1; } - - failed=0 - - # Dashboard coverage — every dashboard's DCGM references must resolve. - while IFS= read -r dashboard_rel; do - dashboard="$DASHBOARDS_DIR/$dashboard_rel" - [ -f "$dashboard" ] || continue # handled by the existence test - extract_dcgm_refs "$dashboard" > "$TMP/refs.txt" - [ -s "$TMP/refs.txt" ] || continue # dashboard relies entirely on recording rules - comm -23 "$TMP/refs.txt" "$TMP/declared.txt" > "$TMP/missing.txt" - if [ -s "$TMP/missing.txt" ]; then - echo "ERROR: $dashboard_rel references DCGM metrics not declared in any CSV:" >&2 - sed 's/^/ - /' "$TMP/missing.txt" >&2 - failed=1 - fi - done < "$TMP/dashboards.txt" - - # Rules coverage — recording rules consume DCGM directly, so their set - # must be declared too, otherwise derived series on every dashboard - # collapse to empty. - extract_dcgm_refs "$RULES_FILE" > "$TMP/rule-refs.txt" - if [ -s "$TMP/rule-refs.txt" ]; then - comm -23 "$TMP/rule-refs.txt" "$TMP/declared.txt" > "$TMP/rule-missing.txt" - if [ -s "$TMP/rule-missing.txt" ]; then - echo "ERROR: gpu-recording.rules.yaml references DCGM metrics not declared in any CSV:" >&2 - sed 's/^/ - /' "$TMP/rule-missing.txt" >&2 - failed=1 - fi - fi - - [ "$failed" -eq 0 ] -} - -@test "every tracked GPU dashboard listed in dashboards-infra.list exists on disk" { - TMP=$(mktemp -d) - trap 'rm -rf "$TMP"' EXIT - - list_tracked_gpu_dashboards > "$TMP/dashboards.txt" - [ -s "$TMP/dashboards.txt" ] || { echo "no gpu/* dashboards listed in $DASHBOARDS_LIST" >&2; exit 1; } - - failed=0 - while IFS= read -r dashboard_rel; do - dashboard="$DASHBOARDS_DIR/$dashboard_rel" - if [ ! -f "$dashboard" ]; then - echo "ERROR: $dashboard_rel listed in dashboards-infra.list but $dashboard does not exist" >&2 - failed=1 - fi - done < "$TMP/dashboards.txt" - - [ "$failed" -eq 0 ] -} diff --git a/hack/check-host-runtime.bats b/hack/check-host-runtime.bats deleted file mode 100644 index b121b31b..00000000 --- a/hack/check-host-runtime.bats +++ /dev/null @@ -1,415 +0,0 @@ -#!/usr/bin/env bats -# ----------------------------------------------------------------------------- -# Unit tests for hack/check-host-runtime.sh -# -# The script warns when a standalone containerd.service or docker.service is -# active alongside the embedded k3s runtime on Ubuntu hosts running the -# cozystack "generic" variant. Warnings go to stderr; exit code is always 0. -# -# Test strategy: each test builds its own temporary stub directory and prepends -# it to PATH to inject a fake `systemctl` (and optionally `du`) binary. The -# script itself honors a small set of COZYSTACK_PREFLIGHT_* environment -# variables to redirect socket/dir probes into the stub tree, so tests do not -# need root privileges or a real systemd host. -# -# Each test installs a `trap 'rm -rf "$STUB_DIR"' EXIT` immediately after -# creating the stub dir so cleanup runs even when an assertion fails mid-test -# under `set -e`. cozytest.sh runs each @test in its own subshell, so traps -# scope per test and do not leak across tests. -# -# Tests are otherwise self-contained — no shared setup/teardown helpers, -# because cozytest.sh's awk parser only recognizes @test blocks and treats a -# bare `}` on its own line as the end of a test function. -# -# Title syntax constraints (inherited from cozytest.sh's awk parser): -# - Titles must be delimited by ASCII double quotes; embedded literal -# double quotes are NOT escaped and will silently truncate the title. -# - Only alphanumeric characters from the title survive into the shell -# function name (everything else becomes '_'), so titles that differ -# only in punctuation collapse to the same function name. Keep titles -# distinctive in their alphanumeric run. -# -# Run with: hack/cozytest.sh hack/check-host-runtime.bats -# (or `bats hack/check-host-runtime.bats` if the bats binary is -# installed; cozytest.sh is the CI path.) -# ----------------------------------------------------------------------------- - -@test "clean host with no runtime services exits silently" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - cat >"$STUB_DIR/systemctl" <<'STUBEOF' -#!/bin/sh -if [ "$1" = "--version" ]; then - echo "systemd stub" - exit 0 -fi -exit 1 -STUBEOF - chmod +x "$STUB_DIR/systemctl" - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker1.sock $STUB_DIR/missing-docker2.sock" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \ - PATH="$STUB_DIR:$PATH" \ - bash hack/check-host-runtime.sh >"$STUB_DIR/stdout" 2>"$STDERR_FILE" - - [ ! -s "$STDERR_FILE" ] - [ ! -s "$STUB_DIR/stdout" ] -} - -@test "standalone containerd service active prints warning" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - cat >"$STUB_DIR/systemctl" <<'STUBEOF' -#!/bin/sh -if [ "$1" = "--version" ]; then - echo "systemd stub" - exit 0 -fi -if [ "$1" = "is-active" ] && [ "$2" = "containerd.service" ]; then - echo active - exit 0 -fi -exit 1 -STUBEOF - chmod +x "$STUB_DIR/systemctl" - - mkdir -p "$STUB_DIR/var-lib-containerd" - echo dummy >"$STUB_DIR/var-lib-containerd/dummy" - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/var-lib-containerd" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \ - PATH="$STUB_DIR:$PATH" \ - bash hack/check-host-runtime.sh 2>"$STDERR_FILE" - - grep -q 'standalone containerd.service' "$STDERR_FILE" - if grep -q 'standalone docker.service' "$STDERR_FILE"; then - echo "unexpected docker warning found:" >&2 - cat "$STDERR_FILE" >&2 - exit 1 - fi - # HINT line must name only the detected service, not advise disabling - # docker.service when only containerd.service is running. The sudo - # prefix is also required — without it the command silently no-ops - # for a non-root operator, so the prefix is part of the contract. - grep -q 'sudo systemctl disable --now containerd.service' "$STDERR_FILE" - if grep -q 'systemctl disable --now.*docker' "$STDERR_FILE"; then - echo "HINT unexpectedly mentions docker:" >&2 - cat "$STDERR_FILE" >&2 - exit 1 - fi -} - -@test "standalone docker service active prints warning" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - cat >"$STUB_DIR/systemctl" <<'STUBEOF' -#!/bin/sh -if [ "$1" = "--version" ]; then - echo "systemd stub" - exit 0 -fi -if [ "$1" = "is-active" ] && [ "$2" = "docker.service" ]; then - echo active - exit 0 -fi -exit 1 -STUBEOF - chmod +x "$STUB_DIR/systemctl" - - mkdir -p "$STUB_DIR/var-lib-docker" - echo dummy >"$STUB_DIR/var-lib-docker/dummy" - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/var-lib-docker" \ - PATH="$STUB_DIR:$PATH" \ - bash hack/check-host-runtime.sh 2>"$STDERR_FILE" - - grep -q 'standalone docker.service' "$STDERR_FILE" - if grep -q 'standalone containerd.service' "$STDERR_FILE"; then - echo "unexpected containerd warning found:" >&2 - cat "$STDERR_FILE" >&2 - exit 1 - fi - # HINT line must name only the detected service. As in the - # containerd test, the sudo prefix is part of the contract. - grep -q 'sudo systemctl disable --now docker.service' "$STDERR_FILE" - if grep -q 'systemctl disable --now.*containerd' "$STDERR_FILE"; then - echo "HINT unexpectedly mentions containerd:" >&2 - cat "$STDERR_FILE" >&2 - exit 1 - fi -} - -@test "both services active prints two warnings and the HINT block" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - cat >"$STUB_DIR/systemctl" <<'STUBEOF' -#!/bin/sh -if [ "$1" = "--version" ]; then - echo "systemd stub" - exit 0 -fi -if [ "$1" = "is-active" ]; then - case "$2" in - containerd.service|docker.service) echo active; exit 0 ;; - esac -fi -exit 1 -STUBEOF - chmod +x "$STUB_DIR/systemctl" - - mkdir -p "$STUB_DIR/var-lib-containerd" "$STUB_DIR/var-lib-docker" - - STDERR_FILE="$STUB_DIR/stderr" - # Capture exit code explicitly: the script contract says exit 0 - # unconditionally (warning, not blocker). `set -e` in the test - # function body would already fail on a nonzero exit, but an - # explicit status check locks in the contract and makes a - # regression show up as "expected 0, got N" rather than as a - # generic test failure. - status=0 - COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/var-lib-containerd" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/var-lib-docker" \ - PATH="$STUB_DIR:$PATH" \ - bash hack/check-host-runtime.sh 2>"$STDERR_FILE" || status=$? - - [ "$status" -eq 0 ] - grep -q 'standalone containerd.service' "$STDERR_FILE" - grep -q 'standalone docker.service' "$STDERR_FILE" - # HINT block must fire whenever warnings exist; otherwise a future silent - # removal of the HINT would go unnoticed. When both services fire the HINT - # must list both in a single sudo systemctl disable invocation — the sudo - # prefix is as important as the systemctl verb, otherwise the operator - # would be told to run it as a non-root user and quietly fail. - grep -q 'HINT:' "$STDERR_FILE" - grep -q 'sudo systemctl disable --now containerd.service docker.service' "$STDERR_FILE" -} - -@test "failing du does not suppress the containerd warning" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - cat >"$STUB_DIR/systemctl" <<'STUBEOF' -#!/bin/sh -if [ "$1" = "--version" ]; then - echo "systemd stub" - exit 0 -fi -if [ "$1" = "is-active" ] && [ "$2" = "containerd.service" ]; then - echo active - exit 0 -fi -exit 1 -STUBEOF - chmod +x "$STUB_DIR/systemctl" - cat >"$STUB_DIR/du" <<'DUEOF' -#!/bin/sh -exit 1 -DUEOF - chmod +x "$STUB_DIR/du" - - mkdir -p "$STUB_DIR/var-lib-containerd" - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/var-lib-containerd" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \ - PATH="$STUB_DIR:$PATH" \ - bash hack/check-host-runtime.sh 2>"$STDERR_FILE" - - grep -q 'standalone containerd.service' "$STDERR_FILE" -} - -@test "containerd socket fallback fires when systemctl is unavailable" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - # The script uses `[ -e "$sock" ]`, not `[ -S ... ]`, so a regular - # file is a valid stand-in for a unix socket in tests. This also - # removes any optional runtime dependency on python3 and makes the - # test unconditional on every CI runner. - SOCK="$STUB_DIR/containerd.sock" - touch "$SOCK" - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 \ - COZYSTACK_CONTAINERD_SOCKET="$SOCK" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \ - bash hack/check-host-runtime.sh 2>"$STDERR_FILE" - - grep -q 'standalone containerd.service' "$STDERR_FILE" -} - -@test "docker socket fallback fires when systemctl is unavailable" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - SOCK="$STUB_DIR/docker.sock" - touch "$SOCK" - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 \ - COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$SOCK" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \ - bash hack/check-host-runtime.sh 2>"$STDERR_FILE" - - grep -q 'standalone docker.service' "$STDERR_FILE" - if grep -q 'standalone containerd.service' "$STDERR_FILE"; then - echo "unexpected containerd warning found:" >&2 - cat "$STDERR_FILE" >&2 - exit 1 - fi -} - -@test "clean host without systemctl exits silently" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 \ - COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker1.sock $STUB_DIR/missing-docker2.sock" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \ - bash hack/check-host-runtime.sh >"$STUB_DIR/stdout" 2>"$STDERR_FILE" - - [ ! -s "$STDERR_FILE" ] - [ ! -s "$STUB_DIR/stdout" ] -} - -@test "docker service plus socket still emits exactly one warning" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - cat >"$STUB_DIR/systemctl" <<'STUBEOF' -#!/bin/sh -if [ "$1" = "--version" ]; then - echo "systemd stub" - exit 0 -fi -if [ "$1" = "is-active" ] && [ "$2" = "docker.service" ]; then - echo active - exit 0 -fi -exit 1 -STUBEOF - chmod +x "$STUB_DIR/systemctl" - - SOCK="$STUB_DIR/docker.sock" - touch "$SOCK" - - mkdir -p "$STUB_DIR/var-lib-docker" - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$SOCK" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/var-lib-docker" \ - PATH="$STUB_DIR:$PATH" \ - bash hack/check-host-runtime.sh 2>"$STDERR_FILE" - - count=$(grep -c 'standalone docker.service' "$STDERR_FILE") - if [ "$count" != "1" ]; then - echo "expected exactly one docker warning, got $count" >&2 - cat "$STDERR_FILE" >&2 - exit 1 - fi -} - -@test "docker socket paths with glob chars do not expand" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - # Create two directories that a naive `for sock in $PATHS` loop - # would glob-expand and treat as existing "sockets". With the - # array-based parsing the literal path "$STUB_DIR/var-lib-*" does - # not exist and no warning must fire. - mkdir -p "$STUB_DIR/var-lib-docker" "$STUB_DIR/var-lib-containerd" - - cat >"$STUB_DIR/systemctl" <<'STUBEOF' -#!/bin/sh -if [ "$1" = "--version" ]; then - echo "systemd stub" - exit 0 -fi -exit 1 -STUBEOF - chmod +x "$STUB_DIR/systemctl" - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_CONTAINERD_SOCKET="$STUB_DIR/missing-containerd.sock" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/var-lib-*" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/missing-containerd-dir" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \ - PATH="$STUB_DIR:$PATH" \ - bash hack/check-host-runtime.sh 2>"$STDERR_FILE" - - if grep -q 'standalone docker.service' "$STDERR_FILE"; then - echo "glob pattern expanded — docker warning should not fire:" >&2 - cat "$STDERR_FILE" >&2 - exit 1 - fi -} - -@test "containerd service plus socket still emits exactly one warning" { - STUB_DIR=$(mktemp -d) - trap 'rm -rf "$STUB_DIR"' EXIT - - cat >"$STUB_DIR/systemctl" <<'STUBEOF' -#!/bin/sh -if [ "$1" = "--version" ]; then - echo "systemd stub" - exit 0 -fi -if [ "$1" = "is-active" ] && [ "$2" = "containerd.service" ]; then - echo active - exit 0 -fi -exit 1 -STUBEOF - chmod +x "$STUB_DIR/systemctl" - - # The script uses `[ -e "$sock" ]`, not `[ -S ... ]`, so a regular - # file is a valid stand-in for a unix socket in tests. This also - # removes any optional runtime dependency on python3 and makes the - # test unconditional on every CI runner. - SOCK="$STUB_DIR/containerd.sock" - touch "$SOCK" - - mkdir -p "$STUB_DIR/var-lib-containerd" - - STDERR_FILE="$STUB_DIR/stderr" - COZYSTACK_CONTAINERD_SOCKET="$SOCK" \ - COZYSTACK_DOCKER_SOCKET_PATHS="$STUB_DIR/missing-docker.sock" \ - COZYSTACK_CONTAINERD_DIR="$STUB_DIR/var-lib-containerd" \ - COZYSTACK_DOCKER_DIR="$STUB_DIR/missing-docker-dir" \ - PATH="$STUB_DIR:$PATH" \ - bash hack/check-host-runtime.sh 2>"$STDERR_FILE" - - count=$(grep -c 'standalone containerd.service' "$STDERR_FILE") - if [ "$count" != "1" ]; then - echo "expected exactly one containerd warning, got $count" >&2 - cat "$STDERR_FILE" >&2 - exit 1 - fi -} diff --git a/hack/check-host-runtime.sh b/hack/check-host-runtime.sh deleted file mode 100755 index 917453d2..00000000 --- a/hack/check-host-runtime.sh +++ /dev/null @@ -1,161 +0,0 @@ -#!/usr/bin/env bash -# ----------------------------------------------------------------------------- -# check-host-runtime.sh — operator preflight warning -# -# Purpose: -# Warn when a standalone containerd.service or docker.service is running on -# the host alongside the embedded k3s runtime. This mismatch is silent on -# day 0 (k3s uses its own containerd at /run/k3s/containerd/containerd.sock -# and /var/lib/rancher/k3s/agent/containerd) but over time the standalone -# runtime accumulates unpruned images and build cache in /var/lib/containerd -# — enough to trigger DiskPressure and crash cozystack-api with eviction -# loops. The script does NOT block install; it only prints a warning. -# -# When to run: -# Before `helm install cozy-installer` on an Ubuntu host prepared with k3s -# or kubeadm (cozystack "generic" variant). Irrelevant on Talos where the -# container runtime lifecycle is fully managed. Discoverable via -# `make preflight` from the repository root. -# -# Exit code: -# Always 0 (warning, not a blocker). Warnings go to stderr. -# -# Environment variables (test hooks — override default probe paths): -# COZYSTACK_CONTAINERD_SOCKET standalone containerd socket path -# COZYSTACK_DOCKER_SOCKET_PATHS space-separated list of docker socket paths -# COZYSTACK_CONTAINERD_DIR standalone containerd data directory -# COZYSTACK_DOCKER_DIR standalone docker data directory -# COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL=1 pretend systemctl is absent -# ----------------------------------------------------------------------------- -set -euo pipefail - -if [ -t 2 ]; then - YELLOW=$'\033[1;33m' - RESET=$'\033[0m' -else - YELLOW='' - RESET='' -fi - -CONTAINERD_SOCKET=${COZYSTACK_CONTAINERD_SOCKET:-/run/containerd/containerd.sock} -DOCKER_SOCKET_PATHS=${COZYSTACK_DOCKER_SOCKET_PATHS:-/run/docker.sock /var/run/docker.sock} -CONTAINERD_DIR=${COZYSTACK_CONTAINERD_DIR:-/var/lib/containerd} -DOCKER_DIR=${COZYSTACK_DOCKER_DIR:-/var/lib/docker} - -CONTAINERD_WARN=0 -DOCKER_WARN=0 - -warn() { - printf '%sWARNING:%s %s\n' "$YELLOW" "$RESET" "$1" >&2 -} - -detect_systemctl() { - if [ "${COZYSTACK_PREFLIGHT_FORCE_NO_SYSTEMCTL:-0}" = "1" ]; then - return 1 - fi - if command -v systemctl >/dev/null 2>&1 && systemctl --version >/dev/null 2>&1; then - return 0 - fi - return 1 -} - -disk_usage() { - local path=$1 - local usage - if [ -d "$path" ]; then - # Wrap `du` in `timeout 5s` so a container data directory with - # millions of files (the exact scenario this script exists to - # warn about) cannot stall the preflight indefinitely. If the - # `timeout` binary is absent the pipeline still exits 0 via - # `|| true` and `usage` stays empty; the warning itself is - # still printed, just without the size detail. - usage=$(timeout 5s du -sh "$path" 2>/dev/null | awk '{print $1}' || true) - if [ -n "${usage:-}" ]; then - printf ' (%s uses %s)' "$path" "$usage" - fi - fi -} - -service_active() { - local service=$1 - if [ "$HAS_SYSTEMCTL" = "1" ]; then - if systemctl is-active "$service" >/dev/null 2>&1; then - return 0 - fi - fi - return 1 -} - -check_containerd() { - local detail="" - local found=0 - if service_active containerd.service; then - found=1 - fi - if [ "$found" -eq 0 ] && [ -e "$CONTAINERD_SOCKET" ]; then - found=1 - fi - if [ "$found" -eq 1 ]; then - detail=$(disk_usage "$CONTAINERD_DIR") - warn "standalone containerd.service detected alongside k3s embedded runtime${detail}" - CONTAINERD_WARN=1 - fi -} - -check_docker() { - local detail="" - local found=0 - if service_active docker.service; then - found=1 - fi - if [ "$found" -eq 0 ]; then - # DOCKER_SOCKET_PATHS is a space separated list of paths. Parse - # it into an array via `read -ra` so that word splitting is - # explicit AND glob expansion is suppressed — `for sock in - # $DOCKER_SOCKET_PATHS` would both word split and glob, so a - # path containing a literal `*` or `?` could expand into - # directory entries and produce false positives. - local -a _socks - read -ra _socks <<<"$DOCKER_SOCKET_PATHS" - for sock in "${_socks[@]}"; do - if [ -e "$sock" ]; then - found=1 - break - fi - done - fi - if [ "$found" -eq 1 ]; then - detail=$(disk_usage "$DOCKER_DIR") - warn "standalone docker.service detected alongside k3s embedded runtime${detail}" - DOCKER_WARN=1 - fi -} - -if detect_systemctl; then - HAS_SYSTEMCTL=1 -else - HAS_SYSTEMCTL=0 -fi - -check_containerd -check_docker - -if [ "$CONTAINERD_WARN" -eq 1 ] || [ "$DOCKER_WARN" -eq 1 ]; then - services="" - if [ "$CONTAINERD_WARN" -eq 1 ]; then - services="containerd.service" - fi - if [ "$DOCKER_WARN" -eq 1 ]; then - if [ -n "$services" ]; then - services="$services docker.service" - else - services="docker.service" - fi - fi - printf '%sHINT:%s cozystack runs its own containerd under k3s. To stop the shadow runtime:\n' "$YELLOW" "$RESET" >&2 - printf ' sudo systemctl disable --now %s\n' "$services" >&2 - printf 'Inspect and reclaim standalone runtime storage separately — it may contain container data\n' >&2 - printf 'that the operator still needs; do not delete it blindly.\n' >&2 -fi - -exit 0 diff --git a/hack/check-readiness.sh b/hack/check-readiness.sh deleted file mode 100755 index bd3a3ffc..00000000 --- a/hack/check-readiness.sh +++ /dev/null @@ -1,83 +0,0 @@ -#!/usr/bin/env bash -# Check readiness of Packages, ArtifactGenerators, ExternalArtifacts, and HelmReleases -# Shows only non-ready resources -# -# Usage: check-readiness.sh [-w [INTERVAL]] -# -w [INTERVAL] Watch mode: refresh continuously every INTERVAL seconds (default: 5) - -set -euo pipefail - -KUBECTL="kubectl" -if [[ -n "${KUBECONFIG:-}" ]]; then - KUBECTL="kubectl --kubeconfig=${KUBECONFIG}" -fi - -RED='\033[0;31m' -GREEN='\033[0;32m' -YELLOW='\033[1;33m' -BOLD='\033[1m' -RESET='\033[0m' - -WATCH=0 -INTERVAL=5 - -while [[ $# -gt 0 ]]; do - case "$1" in - -w|--watch) - WATCH=1 - if [[ $# -gt 1 && "$2" =~ ^[0-9]+$ ]]; then - INTERVAL="$2" - shift - fi - shift - ;; - *) echo "Unknown argument: $1"; exit 2 ;; - esac -done - -check_resource() { - local kind="$1" - local header_printed=0 - - while IFS= read -r line; do - if [[ "$line" =~ ^(NAME|NAMESPACE) ]]; then - continue - fi - if ! echo "$line" | awk '{for(i=1;i<=NF;i++) if($i=="True") exit 0; exit 1}'; then - if [[ $header_printed -eq 0 ]]; then - echo -e "${BOLD}${YELLOW}=== ${kind} (not ready) ===${RESET}" - header_printed=1 - fi - echo -e "${RED}${line}${RESET}" - found_issues=1 - fi - done < <($KUBECTL get "$kind" -A 2>/dev/null) - - return 0 -} - -run_once() { - found_issues=0 - - check_resource packages.cozystack.io - check_resource artifactgenerators.source.extensions.fluxcd.io - check_resource externalartifacts.source.toolkit.fluxcd.io - check_resource helmreleases.helm.toolkit.fluxcd.io - - if [[ $found_issues -eq 0 ]]; then - echo -e "${GREEN}${BOLD}All resources are ready.${RESET}" - fi -} - -if [[ $WATCH -eq 1 ]]; then - while true; do - output=$(run_once 2>&1) - clear - echo -e "${BOLD}Last updated: $(date) (refreshing every ${INTERVAL}s, Ctrl+C to stop)${RESET}\n" - echo -e "$output" - sleep "$INTERVAL" - done -else - run_once - [[ $found_issues -eq 0 ]] || exit 1 -fi diff --git a/hack/cozytest.sh b/hack/cozytest.sh index a3955fd1..363a4d9f 100755 --- a/hack/cozytest.sh +++ b/hack/cozytest.sh @@ -65,7 +65,6 @@ run_one() { echo "----- captured output -----------------------------------------" grep -v '^__RC__' "$log" echo "$LINE" - rm -rf "$tmp" exit "$rc" fi diff --git a/hack/dcgm-default-counters.csv b/hack/dcgm-default-counters.csv deleted file mode 100644 index b5e94540..00000000 --- a/hack/dcgm-default-counters.csv +++ /dev/null @@ -1,104 +0,0 @@ -# Snapshot of the upstream DCGM Exporter default-counters.csv used as a -# fixture by hack/check-gpu-recording-rules.bats. The test verifies that -# every DCGM_FI_* metric referenced by a tracked GPU dashboard is either -# declared here (upstream defaults) or in -# packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml -# (the project's custom CSV). -# -# Source: https://github.com/NVIDIA/dcgm-exporter/blob/4.1.1-4.0.4/etc/default-counters.csv -# Pinned to the DCGM Exporter image tag shipped by the gpu-operator -# chart under packages/system/gpu-operator/charts/gpu-operator/values.yaml -# (dcgmExporter.version = 4.1.1-4.0.4-ubuntu22.04). When that image is -# bumped, refresh this file from the matching tag in the NVIDIA/dcgm-exporter -# repo and re-run `./hack/cozytest.sh hack/check-gpu-recording-rules.bats`. - -# Format -# If line starts with a '#' it is considered a comment -# DCGM FIELD, Prometheus metric type, help message - -# Clocks -DCGM_FI_DEV_SM_CLOCK, gauge, SM clock frequency (in MHz). -DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz). - -# Temperature -DCGM_FI_DEV_MEMORY_TEMP, gauge, Memory temperature (in C). -DCGM_FI_DEV_GPU_TEMP, gauge, GPU temperature (in C). - -# Power -DCGM_FI_DEV_POWER_USAGE, gauge, Power draw (in W). -DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION, counter, Total energy consumption since boot (in mJ). - -# PCIE -# DCGM_FI_PROF_PCIE_TX_BYTES, counter, Total number of bytes transmitted through PCIe TX via NVML. -# DCGM_FI_PROF_PCIE_RX_BYTES, counter, Total number of bytes received through PCIe RX via NVML. -DCGM_FI_DEV_PCIE_REPLAY_COUNTER, counter, Total number of PCIe retries. - -# Utilization (the sample period varies depending on the product) -DCGM_FI_DEV_GPU_UTIL, gauge, GPU utilization (in %). -DCGM_FI_DEV_MEM_COPY_UTIL, gauge, Memory utilization (in %). -DCGM_FI_DEV_ENC_UTIL, gauge, Encoder utilization (in %). -DCGM_FI_DEV_DEC_UTIL , gauge, Decoder utilization (in %). - -# Errors and violations -DCGM_FI_DEV_XID_ERRORS, gauge, Value of the last XID error encountered. -# DCGM_FI_DEV_POWER_VIOLATION, counter, Throttling duration due to power constraints (in us). -# DCGM_FI_DEV_THERMAL_VIOLATION, counter, Throttling duration due to thermal constraints (in us). -# DCGM_FI_DEV_SYNC_BOOST_VIOLATION, counter, Throttling duration due to sync-boost constraints (in us). -# DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (in us). -# DCGM_FI_DEV_LOW_UTIL_VIOLATION, counter, Throttling duration due to low utilization (in us). -# DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (in us). - -# Memory usage -DCGM_FI_DEV_FB_FREE, gauge, Framebuffer memory free (in MiB). -DCGM_FI_DEV_FB_USED, gauge, Framebuffer memory used (in MiB). - -# ECC -# DCGM_FI_DEV_ECC_SBE_VOL_TOTAL, counter, Total number of single-bit volatile ECC errors. -# DCGM_FI_DEV_ECC_DBE_VOL_TOTAL, counter, Total number of double-bit volatile ECC errors. -# DCGM_FI_DEV_ECC_SBE_AGG_TOTAL, counter, Total number of single-bit persistent ECC errors. -# DCGM_FI_DEV_ECC_DBE_AGG_TOTAL, counter, Total number of double-bit persistent ECC errors. - -# Retired pages -# DCGM_FI_DEV_RETIRED_SBE, counter, Total number of retired pages due to single-bit errors. -# DCGM_FI_DEV_RETIRED_DBE, counter, Total number of retired pages due to double-bit errors. -# DCGM_FI_DEV_RETIRED_PENDING, counter, Total number of pages pending retirement. - -# NVLink -# DCGM_FI_DEV_NVLINK_CRC_FLIT_ERROR_COUNT_TOTAL, counter, Total number of NVLink flow-control CRC errors. -# DCGM_FI_DEV_NVLINK_CRC_DATA_ERROR_COUNT_TOTAL, counter, Total number of NVLink data CRC errors. -# DCGM_FI_DEV_NVLINK_REPLAY_ERROR_COUNT_TOTAL, counter, Total number of NVLink retries. -# DCGM_FI_DEV_NVLINK_RECOVERY_ERROR_COUNT_TOTAL, counter, Total number of NVLink recovery errors. -DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL, counter, Total number of NVLink bandwidth counters for all lanes. -# DCGM_FI_DEV_NVLINK_BANDWIDTH_L0, counter, The number of bytes of active NVLink rx or tx data including both header and payload. - -# VGPU License status -DCGM_FI_DEV_VGPU_LICENSE_STATUS, gauge, vGPU License status - -# Remapped rows -DCGM_FI_DEV_UNCORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for uncorrectable errors -DCGM_FI_DEV_CORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for correctable errors -DCGM_FI_DEV_ROW_REMAP_FAILURE, gauge, Whether remapping of rows has failed - -# Static configuration information. These appear as labels on the other metrics -DCGM_FI_DRIVER_VERSION, label, Driver Version -# DCGM_FI_NVML_VERSION, label, NVML Version -# DCGM_FI_DEV_BRAND, label, Device Brand -# DCGM_FI_DEV_SERIAL, label, Device Serial Number -# DCGM_FI_DEV_OEM_INFOROM_VER, label, OEM inforom version -# DCGM_FI_DEV_ECC_INFOROM_VER, label, ECC inforom version -# DCGM_FI_DEV_POWER_INFOROM_VER, label, Power management object inforom version -# DCGM_FI_DEV_INFOROM_IMAGE_VER, label, Inforom image version -# DCGM_FI_DEV_VBIOS_VERSION, label, VBIOS version of the device - -# Datacenter Profiling (DCP) metrics -# NOTE: supported on Nvidia datacenter Volta GPUs and newer -DCGM_FI_PROF_GR_ENGINE_ACTIVE, gauge, Ratio of time the graphics engine is active. -# DCGM_FI_PROF_SM_ACTIVE, gauge, The ratio of cycles an SM has at least 1 warp assigned. -# DCGM_FI_PROF_SM_OCCUPANCY, gauge, The ratio of number of warps resident on an SM. -DCGM_FI_PROF_PIPE_TENSOR_ACTIVE, gauge, Ratio of cycles the tensor (HMMA) pipe is active. -DCGM_FI_PROF_DRAM_ACTIVE, gauge, Ratio of cycles the device memory interface is active sending or receiving data. -# DCGM_FI_PROF_PIPE_FP64_ACTIVE, gauge, Ratio of cycles the fp64 pipes are active. -# DCGM_FI_PROF_PIPE_FP32_ACTIVE, gauge, Ratio of cycles the fp32 pipes are active. -# DCGM_FI_PROF_PIPE_FP16_ACTIVE, gauge, Ratio of cycles the fp16 pipes are active. -DCGM_FI_PROF_PCIE_TX_BYTES, gauge, The rate of data transmitted over the PCIe bus - including both protocol headers and data payloads - in bytes per second. -DCGM_FI_PROF_PCIE_RX_BYTES, gauge, The rate of data received over the PCIe bus - including both protocol headers and data payloads - in bytes per second. diff --git a/hack/e2e-apps/bucket.bats b/hack/e2e-apps/bucket.bats index 31e7efb0..9239d780 100644 --- a/hack/e2e-apps/bucket.bats +++ b/hack/e2e-apps/bucket.bats @@ -3,8 +3,6 @@ @test "Create and Verify Seeweedfs Bucket" { # Create the bucket resource with readwrite and readonly users name='test' - kubectl -n tenant-test delete bucket.apps.cozystack.io $name --ignore-not-found --timeout=2m || true - pkill -f "port-forward.*8333:" 2>/dev/null || true kubectl apply -f - </dev/null || true -} - -@test "Create and Verify ExternalDNS with inmemory provider" { - name='test' - kubectl apply -f - </dev/null || true kubectl apply -f- </dev/null || true - kubectl -n tenant-test wait kuberneteses.apps.cozystack.io "${test_name}" --for=delete --timeout=2m 2>/dev/null || true - kubectl apply -f - < /dev/null 2>&1 & - # Wait for port-forward to be ready before using it - timeout 15 sh -ec 'until curl -sk https://localhost:'"${port}"' >/dev/null 2>&1; do sleep 1; done' + bash -c 'timeout 500s kubectl port-forward service/kubernetes-'"${test_name}"' -n tenant-test '"${port}"':6443 > /dev/null 2>&1 &' # Verify the Kubernetes version matches what we expect (retry for up to 20 seconds) - timeout 20 sh -ec 'until kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' version 2>/dev/null | grep -Fq "Server Version: ${k8s_version}"; do sleep 1; done' + timeout 20 sh -ec 'until kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' version 2>/dev/null | grep -Fq "Server Version: ${k8s_version}"; do sleep 5; done' # Wait for at least 2 nodes to join (timeout after 8 minutes) timeout 8m bash -c ' @@ -111,11 +102,10 @@ EOF done ' # Verify the nodes are ready - if ! kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=3m --for=condition=Ready; then - # Dump debug info and fail fast — no point running LB/NFS tests without Ready nodes + if ! kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=2m --for=condition=Ready; then + # Additional debug messages kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe nodes kubectl -n tenant-test get hr - exit 1 fi kubectl --kubeconfig "tenantkubeconfig-${test_name}" get nodes -o wide @@ -216,28 +206,24 @@ EOF done " - LB_ADDR=$( - kubectl get svc --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" \ - -n tenant-test \ - -o jsonpath='{.status.loadBalancer.ingress[0].ip}{.status.loadBalancer.ingress[0].hostname}' - ) +LB_ADDR=$( + kubectl get svc --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" \ + -n tenant-test \ + -o jsonpath='{.status.loadBalancer.ingress[0].ip}{.status.loadBalancer.ingress[0].hostname}' +) - if [ -z "$LB_ADDR" ]; then - echo "LoadBalancer address is empty" >&2 - exit 1 - fi +if [ -z "$LB_ADDR" ]; then + echo "LoadBalancer address is empty" >&2 + exit 1 +fi - lb_ok=false for i in $(seq 1 20); do echo "Attempt $i" - if curl --silent --fail "http://${LB_ADDR}"; then - lb_ok=true - break - fi + curl --silent --fail "http://${LB_ADDR}" && break sleep 3 done - if [ "$lb_ok" != true ]; then + if [ "$i" -eq 20 ]; then echo "LoadBalancer not reachable" >&2 exit 1 fi @@ -268,8 +254,8 @@ spec: storage: 1Gi EOF - # Wait for PVC to be bound (RWX via kubevirt CSI provisions an NFS server pod, needs time) - kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pvc nfs-test-pvc -n tenant-test --timeout=3m --for=jsonpath='{.status.phase}'=Bound + # Wait for PVC to be bound + kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pvc nfs-test-pvc -n tenant-test --timeout=2m --for=jsonpath='{.status.phase}'=Bound # Create Pod that writes and reads data from NFS volume kubectl --kubeconfig "tenantkubeconfig-${test_name}" apply -f - <&2 - kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe pod nfs-test-pod -n tenant-test >&2 || true - kubectl --kubeconfig "tenantkubeconfig-${test_name}" get events -n tenant-test --sort-by='.lastTimestamp' >&2 || true - exit 1 - fi + kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait pod nfs-test-pod -n tenant-test --timeout=5m --for=jsonpath='{.status.phase}'=Succeeded # Verify NFS data integrity nfs_result=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" logs nfs-test-pod -n tenant-test) @@ -322,38 +303,7 @@ EOF done kubectl wait hr kubernetes-${test_name}-ingress-nginx -n tenant-test --timeout=5m --for=condition=ready - # Guard: parent HelmRelease must not have entered an install/upgrade remediation cycle. - # A non-zero installFailures/upgradeFailures indicates the helm-wait budget expired while - # admin-kubeconfig was still being provisioned, which would trigger uninstall remediation - # and churn the Cluster CR. - # Flux helm-controller v2 retains per-revision release Snapshots in - # .status.history; each Snapshot's .status reflects the Helm release - # state (deployed/superseded/failed/uninstalled). A remediation cycle - # leaves a "failed" or "uninstalled" entry behind that survives a later - # successful reinstall, unlike the installFailures/upgradeFailures - # counters (which ClearFailures zeroes on every successful reconcile). - # The shape is pinned by hack/remediation-guard.bats; the upstream - # types are github.com/fluxcd/helm-controller/api v2 Snapshot. - history_statuses=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" \ - -ojsonpath='{range .status.history[*]}{.status}{"\n"}{end}') - # Always emit the raw value so a silent future-Flux field rename shows - # up as "empty history on a Ready HR" in CI logs rather than vanishing. - echo "Parent HelmRelease history statuses:" - printf '%s\n' "${history_statuses:-}" - if [ -z "${history_statuses}" ]; then - echo "Unexpected empty .status.history on a Ready HelmRelease - Flux API shape may have changed." >&2 - kubectl -n tenant-test describe hr "kubernetes-${test_name}" >&2 - exit 1 - fi - if helmrelease_has_remediation_cycle "${history_statuses}"; then - echo "Parent HelmRelease entered remediation cycle." >&2 - kubectl -n tenant-test describe hr "kubernetes-${test_name}" >&2 - exit 1 - fi - - # Clean up - pkill -f "port-forward.*${port}:" 2>/dev/null || true - rm -f "tenantkubeconfig-${test_name}" - kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --wait=false 2>/dev/null || true + # Clean up by deleting the Kubernetes resource + kubectl -n tenant-test delete kuberneteses.apps.cozystack.io $test_name } diff --git a/hack/e2e-apps/vminstance.bats b/hack/e2e-apps/vminstance.bats index fa0f0b5b..60513e8e 100644 --- a/hack/e2e-apps/vminstance.bats +++ b/hack/e2e-apps/vminstance.bats @@ -2,8 +2,6 @@ @test "Create a VM Disk" { name='test' - kubectl -n tenant-test delete vminstances.apps.cozystack.io $name --ignore-not-found --timeout=2m || true - kubectl -n tenant-test delete vmdisks.apps.cozystack.io $name --ignore-not-found --timeout=2m || true kubectl apply -f - </dev/null 2>&1; do sleep 1; done' - kubectl wait deployment/capi-controller-manager deployment/capi-kamaji-controller-manager deployment/capi-kubeadm-bootstrap-controller-manager deployment/capi-operator-cluster-api-operator deployment/capk-controller-manager -n cozy-cluster-api --timeout=2m --for=condition=available + timeout 60 sh -ec 'until kubectl get deploy -n cozy-cluster-api capi-controller-manager capi-kamaji-controller-manager capi-kubeadm-bootstrap-controller-manager capi-operator-cluster-api-operator capk-controller-manager >/dev/null 2>&1; do sleep 1; done' + kubectl wait deployment/capi-controller-manager deployment/capi-kamaji-controller-manager deployment/capi-kubeadm-bootstrap-controller-manager deployment/capi-operator-cluster-api-operator deployment/capk-controller-manager -n cozy-cluster-api --timeout=1m --for=condition=available } @test "Wait for LINSTOR and configure storage" { @@ -178,8 +175,8 @@ EOF # VictoriaMetrics components kubectl wait vmalert/vmalert-shortterm vmalertmanager/alertmanager -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=15m - kubectl wait vlclusters/generic -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m - kubectl wait vmcluster/shortterm vmcluster/longterm -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m + kubectl wait vlogs/generic -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m + kubectl wait vmcluster/shortterm vmcluster/longterm -n tenant-root --for=jsonpath='{.status.clusterStatus}'=operational --timeout=5m # Grafana kubectl wait clusters.postgresql.cnpg.io/grafana-db -n tenant-root --for=condition=ready --timeout=5m @@ -200,60 +197,8 @@ EOF kubectl wait hr/keycloak hr/keycloak-configure hr/keycloak-operator -n cozy-keycloak --timeout=10m --for=condition=ready } -@test "Aggregated API rejects Tenant name with dashes" { - # Regression guard: the tenant Helm chart's tenant.name helper splits the - # Release.Name on "-" and fails unless the result is exactly - # ["tenant", ""]. The aggregated API must catch tenant names - # containing dashes up-front with a tenant-specific error, instead of - # silently accepting the Application and letting Flux fail later. - - # Defensive cleanup: if a prior regression left foo-bar in the cluster, - # remove it before exercising the validation so we are not observing - # stale state. Safe even in the happy path because of --ignore-not-found. - kubectl delete tenants.apps.cozystack.io foo-bar -n tenant-root --ignore-not-found - - # Preflight: tenant-root is created by earlier tests in this suite. Fail - # loudly if it is missing so this test does not silently trigger an - # unrelated "namespace not found" error and misreport as a pass. - kubectl get namespace tenant-root - - # --validate=ignore forces kubectl to skip client-side OpenAPI validation - # and send the payload straight to the aggregated API. This guarantees the - # server-side name check runs and the error we grep for is the tenant - # contract error, not a kubectl schema rejection. (--validate=false is the - # deprecated alias.) - local output rc - # Run the apply in its own subshell so we can capture BOTH stdout+stderr - # AND the exit code explicitly, without `|| true` swallowing a real failure - # mode (e.g. network error, auth failure) that should also fail the test. - output=$( - kubectl apply --validate=ignore -f - 2>&1 <&2 - exit 1 - fi -} - -@test "single deployed snapshot returns not-detected" { - . hack/e2e-apps/remediation-guard.sh - if helmrelease_has_remediation_cycle "deployed"; then - echo "expected not-detected for deployed-only history" >&2 - exit 1 - fi -} - -@test "deployed then superseded returns not-detected" { - . hack/e2e-apps/remediation-guard.sh - statuses=$(printf 'deployed\nsuperseded\n') - if helmrelease_has_remediation_cycle "${statuses}"; then - echo "expected not-detected for deployed+superseded history" >&2 - exit 1 - fi -} - -@test "single failed snapshot returns detected" { - . hack/e2e-apps/remediation-guard.sh - if ! helmrelease_has_remediation_cycle "failed"; then - echo "expected detected when history contains failed snapshot" >&2 - exit 1 - fi -} - -@test "single uninstalled snapshot returns detected" { - # The exact signature of the install-remediation race: the first install - # exceeded flux's wait budget, remediation uninstalled, the next retry - # eventually succeeded. History still carries the uninstalled snapshot. - . hack/e2e-apps/remediation-guard.sh - if ! helmrelease_has_remediation_cycle "uninstalled"; then - echo "expected detected when history contains uninstalled snapshot" >&2 - exit 1 - fi -} - -@test "uninstalled then deployed still returns detected" { - . hack/e2e-apps/remediation-guard.sh - statuses=$(printf 'uninstalled\ndeployed\n') - if ! helmrelease_has_remediation_cycle "${statuses}"; then - echo "expected detected despite later successful deploy" >&2 - exit 1 - fi -} - -@test "deployed then failed still returns detected" { - . hack/e2e-apps/remediation-guard.sh - statuses=$(printf 'deployed\nfailed\n') - if ! helmrelease_has_remediation_cycle "${statuses}"; then - echo "expected detected when any entry is failed" >&2 - exit 1 - fi -} - -@test "status.history extraction pins HR v2 status.history shape" { - # Pins the Flux HelmRelease v2 .status.history[].status shape that - # run-kubernetes.sh relies on. If a future flux release renames the - # field, the jsonpath returns nothing, the guard reports no cycle, - # and real remediation loops slip past the e2e assertion. This test - # uses yq to read the exact path used in the e2e script; the upstream - # Snapshot type lives at - # github.com/fluxcd/helm-controller/api/v2.Snapshot (via go.mod). - tmp=$(mktemp -d) - trap 'rm -rf "$tmp"' EXIT - - cat > "$tmp/hr.yaml" <<'YAML' -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: kubernetes-test - namespace: tenant-test -status: - history: - - name: kubernetes-test - namespace: tenant-test - version: 1 - status: uninstalled - - name: kubernetes-test - namespace: tenant-test - version: 2 - status: deployed -YAML - - # Default yq output is yaml scalar format, which for string values emits - # bare unquoted tokens - matching what kubectl -o jsonpath produces in - # e2e. Do not switch to JSON output here; that would quote the values - # and break the loop in helmrelease_has_remediation_cycle. - statuses=$(yq '.status.history[].status' "$tmp/hr.yaml") - - [ -n "$statuses" ] - echo "$statuses" | grep --quiet '^uninstalled$' - - . hack/e2e-apps/remediation-guard.sh - if ! helmrelease_has_remediation_cycle "$statuses"; then - echo "expected detected for pinned HR snippet with uninstalled + deployed history" >&2 - exit 1 - fi -} diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh index f3a47e78..6a6fc3be 100755 --- a/hack/update-codegen.sh +++ b/hack/update-codegen.sh @@ -68,7 +68,7 @@ kube::codegen::gen_client \ "${SCRIPT_ROOT}/pkg/apis" $CONTROLLER_GEN object:headerFile="hack/boilerplate.go.txt" paths="./api/..." -$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/v1alpha1/..." paths="./api/backups/..." paths="./api/dashboard/..." output:crd:artifacts:config=${TMPDIR} +$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR} mv ${TMPDIR}/cozystack.io_packages.yaml ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml mv ${TMPDIR}/cozystack.io_packagesources.yaml ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml @@ -80,12 +80,3 @@ mv ${TMPDIR}/backups.cozystack.io*.yaml ${BACKUPS_CORE_CRDDIR}/ mv ${TMPDIR}/strategy.backups.cozystack.io*.yaml ${BACKUPSTRATEGY_CRDDIR}/ mv ${TMPDIR}/*.yaml ${COZY_CONTROLLER_CRDDIR}/ - -# Tidy dependencies for standalone api/apps/v1alpha1 submodule -(cd "${SCRIPT_ROOT}/api/apps/v1alpha1" && go mod tidy) - -# Generate deepcopy for standalone api/apps/v1alpha1 submodule (separate Go module) -# Use absolute path for headerFile since we cd into the submodule directory -APPS_API_ROOT="$(cd "${SCRIPT_ROOT}" && pwd)" -(cd "${APPS_API_ROOT}/api/apps/v1alpha1" && $CONTROLLER_GEN object:headerFile="${APPS_API_ROOT}/hack/boilerplate.go.txt" paths="./...") - diff --git a/hack/upload-assets.sh b/hack/upload-assets.sh index 2f7f9813..f9bb7b25 100755 --- a/hack/upload-assets.sh +++ b/hack/upload-assets.sh @@ -14,4 +14,3 @@ gh release upload --clobber $version _out/assets/kernel-amd64 gh release upload --clobber $version _out/assets/initramfs-metal-amd64.xz gh release upload --clobber $version _out/assets/cozypkg-*.tar.gz gh release upload --clobber $version _out/assets/cozypkg-checksums.txt -gh release upload --clobber $version _out/assets/openapi.json diff --git a/internal/backupcontroller/backup_controller.go b/internal/backupcontroller/backup_controller.go deleted file mode 100644 index 486a24ae..00000000 --- a/internal/backupcontroller/backup_controller.go +++ /dev/null @@ -1,136 +0,0 @@ -package backupcontroller - -import ( - "context" - "fmt" - - apierrors "k8s.io/apimachinery/pkg/api/errors" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/types" - "k8s.io/client-go/tools/record" - ctrl "sigs.k8s.io/controller-runtime" - "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" - "sigs.k8s.io/controller-runtime/pkg/log" - - backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1" - velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1" -) - -const backupFinalizer = "backups.cozystack.io/cleanup-velero" - -// BackupReconciler reconciles Backup objects. -// It manages a finalizer that ensures the underlying Velero backup is deleted -// when the cozystack Backup resource is deleted. -type BackupReconciler struct { - client.Client - Scheme *runtime.Scheme - Recorder record.EventRecorder -} - -func (r *BackupReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { - logger := log.FromContext(ctx) - logger.V(1).Info("reconciling Backup", "namespace", req.Namespace, "name", req.Name) - - backup := &backupsv1alpha1.Backup{} - if err := r.Get(ctx, types.NamespacedName{Namespace: req.Namespace, Name: req.Name}, backup); err != nil { - if apierrors.IsNotFound(err) { - return ctrl.Result{}, nil - } - return ctrl.Result{}, err - } - - // Handle deletion: clean up Velero backup - if !backup.DeletionTimestamp.IsZero() { - if controllerutil.ContainsFinalizer(backup, backupFinalizer) { - if err := r.cleanupVeleroBackup(ctx, backup); err != nil { - logger.Error(err, "failed to clean up Velero backup") - return ctrl.Result{}, err - } - - controllerutil.RemoveFinalizer(backup, backupFinalizer) - if err := r.Update(ctx, backup); err != nil { - return ctrl.Result{}, err - } - logger.V(1).Info("removed finalizer and cleaned up Velero backup", "backup", backup.Name) - } - return ctrl.Result{}, nil - } - - // Ensure finalizer is present - if !controllerutil.ContainsFinalizer(backup, backupFinalizer) { - controllerutil.AddFinalizer(backup, backupFinalizer) - if err := r.Update(ctx, backup); err != nil { - return ctrl.Result{}, err - } - logger.V(1).Info("added finalizer to Backup", "backup", backup.Name) - } - - return ctrl.Result{}, nil -} - -// cleanupVeleroBackup deletes the Velero backup and its data from storage -// by creating a Velero DeleteBackupRequest. A direct Delete of the -// backup.velero.io resource only removes the Kubernetes object; Velero's -// BSL sync will recreate it from the object store. The DeleteBackupRequest -// tells Velero to also purge the data, preventing resurrection. -func (r *BackupReconciler) cleanupVeleroBackup(ctx context.Context, backup *backupsv1alpha1.Backup) error { - logger := log.FromContext(ctx) - - veleroBackupName, ok := backup.Spec.DriverMetadata[veleroBackupNameMetadataKey] - if !ok || veleroBackupName == "" { - logger.V(1).Info("no Velero backup name in driverMetadata, nothing to clean up") - return nil - } - - veleroBackupNamespace := backup.Spec.DriverMetadata[veleroBackupNamespaceMetadataKey] - if veleroBackupNamespace == "" { - veleroBackupNamespace = veleroNamespace - } - - // Check if the Velero Backup still exists - veleroBackup := &velerov1.Backup{} - err := r.Get(ctx, types.NamespacedName{ - Namespace: veleroBackupNamespace, - Name: veleroBackupName, - }, veleroBackup) - if err != nil { - if apierrors.IsNotFound(err) { - logger.V(1).Info("Velero backup already deleted", "name", veleroBackupName) - return nil - } - return fmt.Errorf("failed to get Velero backup %s/%s: %w", veleroBackupNamespace, veleroBackupName, err) - } - - // Create a DeleteBackupRequest so Velero removes backup data from storage. - // Without this, BSL sync will recreate the backup.velero.io resource. - dbr := &velerov1.DeleteBackupRequest{ - ObjectMeta: metav1.ObjectMeta{ - GenerateName: veleroBackupName + "-", - Namespace: veleroBackupNamespace, - }, - Spec: velerov1.DeleteBackupRequestSpec{ - BackupName: veleroBackupName, - }, - } - if err := r.Create(ctx, dbr); err != nil { - if apierrors.IsAlreadyExists(err) { - logger.V(1).Info("DeleteBackupRequest already exists", "backup", veleroBackupName) - return nil - } - return fmt.Errorf("failed to create DeleteBackupRequest for %s/%s: %w", veleroBackupNamespace, veleroBackupName, err) - } - - logger.Info("created DeleteBackupRequest for Velero backup", - "name", veleroBackupName, "namespace", veleroBackupNamespace, - "deleteRequest", dbr.Name) - return nil -} - -// SetupWithManager registers the BackupReconciler with the Manager. -func (r *BackupReconciler) SetupWithManager(mgr ctrl.Manager) error { - return ctrl.NewControllerManagedBy(mgr). - For(&backupsv1alpha1.Backup{}). - Complete(r) -} diff --git a/internal/backupcontroller/backupclass_resolver_test.go b/internal/backupcontroller/backupclass_resolver_test.go index cd65f22a..5e29cd02 100644 --- a/internal/backupcontroller/backupclass_resolver_test.go +++ b/internal/backupcontroller/backupclass_resolver_test.go @@ -369,3 +369,7 @@ func TestResolveBackupClass(t *testing.T) { }) } } + +func stringPtr(s string) *string { + return &s +} diff --git a/internal/backupcontroller/restorejob_controller.go b/internal/backupcontroller/restorejob_controller.go index f0062064..71307ba3 100644 --- a/internal/backupcontroller/restorejob_controller.go +++ b/internal/backupcontroller/restorejob_controller.go @@ -17,16 +17,12 @@ import ( ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/client/apiutil" - "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" "sigs.k8s.io/controller-runtime/pkg/log" strategyv1alpha1 "github.com/cozystack/cozystack/api/backups/strategy/v1alpha1" backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1" - velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1" ) -const restoreJobFinalizer = "backups.cozystack.io/cleanup-velero-restore" - // RestoreJobReconciler reconciles RestoreJob objects. // It routes RestoreJobs to strategy-specific handlers based on the strategy // referenced in the Backup that the RestoreJob is restoring from. @@ -53,27 +49,6 @@ func (r *RestoreJobReconciler) Reconcile(ctx context.Context, req ctrl.Request) return ctrl.Result{}, err } - // Handle deletion: clean up Velero Restore - if !restoreJob.DeletionTimestamp.IsZero() { - if controllerutil.ContainsFinalizer(restoreJob, restoreJobFinalizer) { - r.cleanupVeleroRestore(ctx, restoreJob) - controllerutil.RemoveFinalizer(restoreJob, restoreJobFinalizer) - if err := r.Update(ctx, restoreJob); err != nil { - return ctrl.Result{}, err - } - logger.V(1).Info("removed finalizer and cleaned up Velero Restore", "restoreJob", restoreJob.Name) - } - return ctrl.Result{}, nil - } - - // Ensure finalizer is present - if !controllerutil.ContainsFinalizer(restoreJob, restoreJobFinalizer) { - controllerutil.AddFinalizer(restoreJob, restoreJobFinalizer) - if err := r.Update(ctx, restoreJob); err != nil { - return ctrl.Result{}, err - } - } - // If already completed, no need to reconcile if restoreJob.Status.Phase == backupsv1alpha1.RestoreJobPhaseSucceeded || restoreJob.Status.Phase == backupsv1alpha1.RestoreJobPhaseFailed { @@ -128,6 +103,17 @@ func (r *RestoreJobReconciler) SetupWithManager(mgr ctrl.Manager) error { Complete(r) } +// getTargetApplicationRef determines the effective target application reference. +// According to DESIGN.md, if spec.targetApplicationRef is omitted, drivers SHOULD +// restore into backup.spec.applicationRef. +// The returned reference is normalized to ensure APIGroup has a default value. +func (r *RestoreJobReconciler) getTargetApplicationRef(restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup) corev1.TypedLocalObjectReference { + if restoreJob.Spec.TargetApplicationRef != nil { + return backupsv1alpha1.NormalizeApplicationRef(*restoreJob.Spec.TargetApplicationRef) + } + return backup.Spec.ApplicationRef +} + // markRestoreJobFailed updates the RestoreJob status to Failed with the given message. func (r *RestoreJobReconciler) markRestoreJobFailed(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, message string) (ctrl.Result, error) { logger := getLogger(ctx) @@ -152,43 +138,3 @@ func (r *RestoreJobReconciler) markRestoreJobFailed(ctx context.Context, restore logger.Debug("RestoreJob failed", "message", message) return ctrl.Result{}, nil } - -// cleanupResourceModifierConfigMaps deletes resource modifier ConfigMaps owned -// by this RestoreJob. Called on completion (success or failure) to avoid leaking -// ConfigMaps in cozy-velero when RestoreJobs are not immediately deleted. -func (r *RestoreJobReconciler) cleanupResourceModifierConfigMaps(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob) { - logger := log.FromContext(ctx) - opts := []client.DeleteAllOfOption{ - client.InNamespace(veleroNamespace), - client.MatchingLabels{ - backupsv1alpha1.OwningJobNameLabel: restoreJob.Name, - backupsv1alpha1.OwningJobNamespaceLabel: restoreJob.Namespace, - }, - } - if err := r.DeleteAllOf(ctx, &corev1.ConfigMap{}, opts...); err != nil { - logger.Error(err, "failed to clean up resourceModifiers ConfigMap(s)") - } -} - -// cleanupVeleroRestore deletes all Velero Restores and resourceModifier -// ConfigMaps owned by this RestoreJob (identified by labels). -func (r *RestoreJobReconciler) cleanupVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob) { - logger := log.FromContext(ctx) - opts := []client.DeleteAllOfOption{ - client.InNamespace(veleroNamespace), - client.MatchingLabels{ - backupsv1alpha1.OwningJobNameLabel: restoreJob.Name, - backupsv1alpha1.OwningJobNamespaceLabel: restoreJob.Namespace, - }, - } - - if err := r.DeleteAllOf(ctx, &velerov1.Restore{}, opts...); err != nil { - logger.Error(err, "failed to delete Velero Restore(s)") - r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "CleanupFailed", - fmt.Sprintf("Failed to delete Velero Restore: %v", err)) - } - - if err := r.DeleteAllOf(ctx, &corev1.ConfigMap{}, opts...); err != nil { - logger.Error(err, "failed to delete resourceModifiers ConfigMap(s)") - } -} diff --git a/internal/backupcontroller/velerostrategy_controller.go b/internal/backupcontroller/velerostrategy_controller.go index 8b063519..6809bd4f 100644 --- a/internal/backupcontroller/velerostrategy_controller.go +++ b/internal/backupcontroller/velerostrategy_controller.go @@ -2,21 +2,13 @@ package backupcontroller import ( "context" - "crypto/sha256" - "encoding/hex" - "encoding/json" "fmt" - "strings" "time" - "sigs.k8s.io/yaml" - corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/meta" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" - "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/client" @@ -45,6 +37,15 @@ func (l loggerWithDebug) Debug(msg string, keysAndValues ...interface{}) { l.Logger.V(1).Info(msg, keysAndValues...) } +// S3Credentials holds the discovered S3 credentials from a Bucket storageRef +type S3Credentials struct { + BucketName string + Endpoint string + Region string + AccessKeyID string + AccessSecretKey string +} + const ( defaultRequeueAfter = 5 * time.Second defaultActiveJobPollingInterval = defaultRequeueAfter @@ -54,163 +55,12 @@ const ( veleroNamespace = "cozy-velero" veleroBackupNameMetadataKey = "velero.io/backup-name" veleroBackupNamespaceMetadataKey = "velero.io/backup-namespace" - - // Annotation key for persisting underlying resources on the Velero Backup object - underlyingResourcesAnnotation = "backups.cozystack.io/underlying-resources" - - // VM-specific constants - vmInstanceKind = "VMInstance" - vmDiskAppKind = "VMDisk" - vmNamePrefix = "vm-instance-" - vmDiskNamePrefix = "vm-disk-" - appKindLabel = "apps.cozystack.io/application.kind" - appNameLabel = "apps.cozystack.io/application.name" - vmPodNameLabel = "vm.kubevirt.io/name" - ovnIPAnnotation = "ovn.kubernetes.io/ip_address" - ovnMACAnnotation = "ovn.kubernetes.io/mac_address" - cdiAllowClaimAdoption = "cdi.kubevirt.io/allowClaimAdoption" ) -func stringPtr(s string) *string { - return &s -} - -// boolPtr returns a pointer to a bool value. func boolPtr(b bool) *bool { return &b } -// boolDefault returns the value of a *bool pointer, or the given default if nil. -func boolDefault(p *bool, def bool) bool { - if p != nil { - return *p - } - return def -} - -// CommonRestoreOptions contains driver-agnostic restore options shared across -// all application kinds. -type CommonRestoreOptions struct { - // TargetNamespace is the namespace to restore into. When set (and differs - // from the backup namespace), a cross-namespace restore (copy) is performed - // using Velero's namespaceMapping. - TargetNamespace string `json:"targetNamespace,omitempty"` - // FailIfTargetExists makes the restore fail if the target resource already - // exists. Defaults to true when omitted. - FailIfTargetExists *bool `json:"failIfTargetExists,omitempty"` -} - -// RestoreOptions is the typed representation of RestoreJob.Spec.Options for the -// Velero driver. The struct is deserialized from runtime.RawExtension and used -// for all application kinds. VMInstance-specific fields (KeepOriginalPVC, -// KeepOriginalIpAndMac) are only effective when the application kind is VMInstance. -type RestoreOptions struct { - CommonRestoreOptions `json:",inline"` - // KeepOriginalPVC renames the original PVC to -orig- before restore. - // Only effective for in-place VMInstance restore (no targetNamespace). Defaults to true when omitted. - KeepOriginalPVC *bool `json:"keepOriginalPVC,omitempty"` - // KeepOriginalIpAndMac preserves the original IP and MAC address via OVN - // annotations. Only effective for VMInstance restores. Defaults to true when omitted. - KeepOriginalIpAndMac *bool `json:"keepOriginalIpAndMac,omitempty"` -} - -// GetFailIfTargetExists returns the effective value (default: true). -func (o *CommonRestoreOptions) GetFailIfTargetExists() bool { - return boolDefault(o.FailIfTargetExists, true) -} - -// GetKeepOriginalPVC returns the effective value (default: true). -func (o *RestoreOptions) GetKeepOriginalPVC() bool { - return boolDefault(o.KeepOriginalPVC, true) -} - -// GetKeepOriginalIpAndMac returns the effective value (default: true). -func (o *RestoreOptions) GetKeepOriginalIpAndMac() bool { - return boolDefault(o.KeepOriginalIpAndMac, true) -} - -// parseRestoreOptions deserializes RestoreJob.Spec.Options into RestoreOptions. -// Returns zero-value RestoreOptions if options is nil. -func parseRestoreOptions(opts *runtime.RawExtension) (RestoreOptions, error) { - var ro RestoreOptions - if opts == nil || len(opts.Raw) == 0 { - return ro, nil - } - if err := json.Unmarshal(opts.Raw, &ro); err != nil { - return ro, fmt.Errorf("failed to parse restore options: %w", err) - } - return ro, nil -} - -// restoreTarget holds the resolved target namespace and app identity for a restore operation. -type restoreTarget struct { - Namespace string - AppName string - AppKind string - IsCopy bool // true when targetNamespace differs from backup namespace - IsRenamed bool // true when target app name differs from source app name -} - -// resolveRestoreTarget computes the effective restore target from RestoreJob, Backup, and options. -func resolveRestoreTarget(restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, opts RestoreOptions) restoreTarget { - targetNS := backup.Namespace - isCopy := false - if opts.TargetNamespace != "" && opts.TargetNamespace != backup.Namespace { - targetNS = opts.TargetNamespace - isCopy = true - } - targetAppName := backup.Spec.ApplicationRef.Name - if restoreJob.Spec.TargetApplicationRef != nil && restoreJob.Spec.TargetApplicationRef.Name != "" { - targetAppName = restoreJob.Spec.TargetApplicationRef.Name - } - targetAppKind := backup.Spec.ApplicationRef.Kind - if restoreJob.Spec.TargetApplicationRef != nil && restoreJob.Spec.TargetApplicationRef.Kind != "" { - targetAppKind = restoreJob.Spec.TargetApplicationRef.Kind - } - return restoreTarget{ - Namespace: targetNS, - AppName: targetAppName, - AppKind: targetAppKind, - IsCopy: isCopy, - IsRenamed: targetAppName != backup.Spec.ApplicationRef.Name, - } -} - -// vmInstanceResources contains VM-specific underlying resources discovered during backup. -type vmInstanceResources struct { - DataVolumes []backupsv1alpha1.DataVolumeResource `json:"dataVolumes,omitempty"` - IP string `json:"ip,omitempty"` - MAC string `json:"mac,omitempty"` -} - -// marshalUnderlyingResources serializes application-specific data into a -// runtime.RawExtension suitable for Backup.Status.UnderlyingResources. -func marshalUnderlyingResources(data interface{}) (*runtime.RawExtension, error) { - raw, err := json.Marshal(data) - if err != nil { - return nil, err - } - return &runtime.RawExtension{Raw: raw}, nil -} - -// getVMInstanceResources extracts VMInstance-specific resources from the opaque blob. -// The caller is responsible for checking that the application kind is VMInstance -// (via backup.Spec.ApplicationRef.Kind) before calling this function. -// Returns nil if ur is nil or has no VM-specific data. -func getVMInstanceResources(ur *runtime.RawExtension) *vmInstanceResources { - if ur == nil || len(ur.Raw) == 0 { - return nil - } - var res vmInstanceResources - if err := json.Unmarshal(ur.Raw, &res); err != nil { - return nil - } - if len(res.DataVolumes) == 0 && res.IP == "" && res.MAC == "" { - return nil - } - return &res -} - func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1alpha1.BackupJob, resolved *ResolvedBackupConfig) (ctrl.Result, error) { logger := getLogger(ctx) logger.Debug("reconciling Velero strategy", "backupjob", j.Name, "phase", j.Status.Phase) @@ -347,7 +197,10 @@ func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1a // Step 5: On failure if phase == "Failed" || phase == "PartiallyFailed" { - message := formatVeleroBackupFailureMessageForBackupJob(ctx, r.Client, veleroBackup) + message := fmt.Sprintf("Velero Backup failed with phase: %s", phase) + if len(veleroBackup.Status.ValidationErrors) > 0 { + message = fmt.Sprintf("%s: %v", message, veleroBackup.Status.ValidationErrors) + } return r.markBackupJobFailed(ctx, j, message) } @@ -355,76 +208,6 @@ func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1a return ctrl.Result{RequeueAfter: 5 * time.Second}, nil } -// collectUnderlyingResources discovers resources associated with an application -// that need to be backed up and restored. Returns a map keyed by application kind. -// Returns nil if the application type has no underlying resources to collect. -func (r *BackupJobReconciler) collectUnderlyingResources(ctx context.Context, app *unstructured.Unstructured, appKind, ns string) (*runtime.RawExtension, error) { - logger := getLogger(ctx) - - if appKind != vmInstanceKind { - logger.Debug("application is not a VMInstance, skipping underlying resource collection", "kind", appKind) - return nil, nil - } - - appName := app.GetName() - - // Extract disk names from VMInstance spec.disks[].name - disks, found, err := unstructured.NestedSlice(app.Object, "spec", "disks") - if err != nil { - return nil, fmt.Errorf("failed to read spec.disks from application: %w", err) - } - - var dataVolumes []backupsv1alpha1.DataVolumeResource - if found { - for _, d := range disks { - disk, ok := d.(map[string]interface{}) - if !ok { - continue - } - name, ok := disk["name"].(string) - if !ok || name == "" { - continue - } - dataVolumes = append(dataVolumes, backupsv1alpha1.DataVolumeResource{ - DataVolumeName: vmDiskNamePrefix + name, - ApplicationName: name, - }) - } - } - logger.Debug("collected dataVolumes from VMInstance", "count", len(dataVolumes), "appName", appName) - - // Find VM Pod to extract OVN IP/MAC addresses - vmName := vmNamePrefix + appName - podList := &corev1.PodList{} - if err := r.List(ctx, podList, - client.InNamespace(ns), - client.MatchingLabels{vmPodNameLabel: vmName}, - ); err != nil { - logger.Error(err, "failed to list VM pods for IP/MAC collection", "vmName", vmName) - // Non-fatal: we can still proceed without IP/MAC - } - - var ip, mac string - if len(podList.Items) > 0 { - pod := podList.Items[0] - ip = pod.Annotations[ovnIPAnnotation] - mac = pod.Annotations[ovnMACAnnotation] - logger.Debug("collected OVN network info from VM pod", "ip", ip, "mac", mac, "pod", pod.Name) - } else { - logger.Debug("no VM pod found for OVN info", "vmName", vmName) - } - - if len(dataVolumes) == 0 && ip == "" && mac == "" { - return nil, nil - } - - return marshalUnderlyingResources(vmInstanceResources{ - DataVolumes: dataVolumes, - IP: ip, - MAC: mac, - }) -} - func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob *backupsv1alpha1.BackupJob, strategy *strategyv1alpha1.Velero, resolved *ResolvedBackupConfig) error { logger := getLogger(ctx) logger.Debug("createVeleroBackup called", "strategy", strategy.Name) @@ -442,13 +225,6 @@ func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob return err } - // Collect underlying resources (VM disks, IP/MAC) - underlyingResources, err := r.collectUnderlyingResources(ctx, app, backupJob.Spec.ApplicationRef.Kind, backupJob.Namespace) - if err != nil { - logger.Error(err, "failed to collect underlying resources, proceeding without them") - // Non-fatal: proceed with backup even if collection fails - } - templateContext := map[string]interface{}{ "Application": app.Object, "Parameters": resolved.Parameters, @@ -458,28 +234,6 @@ func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob if err != nil { return err } - - // Add label selectors for underlying VMDisk HelmReleases - if vmRes := getVMInstanceResources(underlyingResources); vmRes != nil { - for _, dv := range vmRes.DataVolumes { - veleroBackupSpec.OrLabelSelectors = append(veleroBackupSpec.OrLabelSelectors, &metav1.LabelSelector{ - MatchLabels: map[string]string{ - appKindLabel: vmDiskAppKind, - appNameLabel: dv.ApplicationName, - }, - }) - } - if len(vmRes.DataVolumes) > 0 { - logger.Debug("added VMDisk label selectors to Velero backup", "count", len(vmRes.DataVolumes)) - } - } - - // Serialize underlying resources as annotation to persist across reconcile cycles - annotations := map[string]string{} - if underlyingResources != nil && len(underlyingResources.Raw) > 0 { - annotations[underlyingResourcesAnnotation] = string(underlyingResources.Raw) - } - veleroBackup := &velerov1.Backup{ ObjectMeta: metav1.ObjectMeta{ GenerateName: fmt.Sprintf("%s.%s-", backupJob.Namespace, backupJob.Name), @@ -488,7 +242,6 @@ func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob backupsv1alpha1.OwningJobNameLabel: backupJob.Name, backupsv1alpha1.OwningJobNamespaceLabel: backupJob.Namespace, }, - Annotations: annotations, }, Spec: *veleroBackupSpec, } @@ -531,18 +284,19 @@ func (r *BackupJobReconciler) createBackupResource(ctx context.Context, backupJo URI: fmt.Sprintf("velero://%s/%s", veleroBackup.Namespace, veleroBackup.Name), } - // Read underlying resources from Velero Backup annotation - var underlyingResources *runtime.RawExtension - if urJSON, ok := veleroBackup.Annotations[underlyingResourcesAnnotation]; ok && urJSON != "" { - underlyingResources = &runtime.RawExtension{Raw: []byte(urJSON)} - } - - // Note: No OwnerReferences set on Backup. The Backup must survive BackupJob deletion - // so users don't lose their backup artifacts when cleaning up completed jobs. backup := &backupsv1alpha1.Backup{ ObjectMeta: metav1.ObjectMeta{ Name: backupJob.Name, Namespace: backupJob.Namespace, + OwnerReferences: []metav1.OwnerReference{ + { + APIVersion: backupJob.APIVersion, + Kind: backupJob.Kind, + Name: backupJob.Name, + UID: backupJob.UID, + Controller: boolPtr(true), + }, + }, }, Spec: backupsv1alpha1.BackupSpec{ ApplicationRef: backupJob.Spec.ApplicationRef, @@ -551,9 +305,8 @@ func (r *BackupJobReconciler) createBackupResource(ctx context.Context, backupJo DriverMetadata: driverMetadata, }, Status: backupsv1alpha1.BackupStatus{ - Phase: backupsv1alpha1.BackupPhaseReady, - Artifact: artifact, - UnderlyingResources: underlyingResources, + Phase: backupsv1alpha1.BackupPhaseReady, + Artifact: artifact, }, } @@ -566,8 +319,7 @@ func (r *BackupJobReconciler) createBackupResource(ctx context.Context, backupJo return nil, err } - logger.Debug("created Backup resource", "name", backup.Name, - "hasUnderlyingResources", underlyingResources != nil) + logger.Debug("created Backup resource", "name", backup.Name) return backup, nil } @@ -576,37 +328,6 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto logger := getLogger(ctx) logger.Debug("reconciling Velero strategy restore", "restorejob", restoreJob.Name, "backup", backup.Name) - // Parse restore options from the opaque blob - restoreOpts, err := parseRestoreOptions(restoreJob.Spec.Options) - if err != nil { - return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("invalid restore options: %v", err)) - } - - target := resolveRestoreTarget(restoreJob, backup, restoreOpts) - logger.Debug("resolved restore target", "targetNS", target.Namespace, "targetApp", target.AppName, "isCopy", target.IsCopy) - - // Validate: target namespace must exist for cross-namespace copies - if target.IsCopy { - targetNS := &corev1.Namespace{} - if err := r.Get(ctx, client.ObjectKey{Name: target.Namespace}, targetNS); err != nil { - if errors.IsNotFound(err) { - return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf( - "target namespace %q does not exist; create it before requesting a cross-namespace restore", - target.Namespace)) - } - return ctrl.Result{}, fmt.Errorf("failed to check target namespace %q: %w", target.Namespace, err) - } - } - - // Validate: same-namespace restore with a different app name is not supported - // due to Velero DataUpload always writing to PVCs with the original name. - if !target.IsCopy && target.AppName != backup.Spec.ApplicationRef.Name { - return r.markRestoreJobFailed(ctx, restoreJob, - "restoring to the same namespace with a different application name is not supported "+ - "due to Velero DataUpload limitations: data is always uploaded to PVCs with the original name. "+ - "Use options.targetNamespace to restore into a different namespace") - } - // Step 1: On first reconcile, set startedAt and phase = Running if restoreJob.Status.StartedAt == nil { logger.Debug("setting RestoreJob StartedAt and phase to Running") @@ -657,40 +378,9 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto } if len(veleroRestoreList.Items) == 0 { - // For copy restores, enforce failIfTargetExists before touching anything. - // In-place restores are excluded: the source application is expected to exist - // and will be halted/overwritten deliberately. - if target.IsCopy && restoreOpts.GetFailIfTargetExists() { - targetHRName := helmReleaseNameForApp(target.AppKind, target.AppName) - exists, err := r.targetHelmReleaseExists(ctx, target.AppKind, targetHRName, target.Namespace) - if err != nil { - logger.Error(err, "failed to check whether target HelmRelease exists") - return ctrl.Result{}, err - } - if exists { - return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf( - "target application %q already exists in namespace %q; "+ - "set options.failIfTargetExists=false to overwrite", - target.AppName, target.Namespace)) - } - } - - // Resolve underlying resources once; prefer Backup status, fall back to Velero annotation. - ur := r.resolveUnderlyingResourcesForRestore(ctx, backup, veleroBackupName) - - // Pre-restore: graceful shutdown, suspend HRs, rename PVCs (skipped for copy) - ready, result, err := r.prepareForRestore(ctx, restoreJob, backup, ur, target, restoreOpts) - if err != nil { - return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("pre-restore preparation failed: %v", err)) - } - if !ready { - logger.Debug("pre-restore preparation in progress, requeuing") - return result, nil - } - // Create Velero Restore logger.Debug("Velero Restore not found, creating new one") - if err := r.createVeleroRestore(ctx, restoreJob, backup, veleroStrategy, veleroBackupName, ur, target, restoreOpts); err != nil { + if err := r.createVeleroRestore(ctx, restoreJob, backup, veleroStrategy, veleroBackupName); err != nil { logger.Error(err, "failed to create Velero Restore") return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("failed to create Velero Restore: %v", err)) } @@ -716,18 +406,6 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto // Step 4: On success if phase == "Completed" { - // Post-restore: rename resources if target app name differs from source. - // Velero resource modifiers cannot change metadata.name, so we do it after restore. - if target.IsRenamed { - if err := r.postRestoreRename(ctx, restoreJob, backup, target); err != nil { - r.cleanupResourceModifierConfigMaps(ctx, restoreJob) - return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("post-restore rename failed: %v", err)) - } - } - - // Clean up resource modifier ConfigMaps now that the restore is complete. - r.cleanupResourceModifierConfigMaps(ctx, restoreJob) - now := metav1.Now() restoreJob.Status.CompletedAt = &now restoreJob.Status.Phase = backupsv1alpha1.RestoreJobPhaseSucceeded @@ -741,7 +419,6 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto // Step 5: On failure if phase == "Failed" || phase == "PartiallyFailed" { - r.cleanupResourceModifierConfigMaps(ctx, restoreJob) message := fmt.Sprintf("Velero Restore failed with phase: %s", phase) if veleroRestore.Status.FailureReason != "" { message = fmt.Sprintf("%s: %s", message, veleroRestore.Status.FailureReason) @@ -753,593 +430,31 @@ func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, resto return ctrl.Result{RequeueAfter: defaultRestoreRequeueAfter}, nil } -// Velero resource modifier types (local mirrors of the internal Velero types). - -type resourceModifiers struct { - Version string `yaml:"version"` - ResourceModifierRules []resourceModifierRule `yaml:"resourceModifierRules"` -} - -type resourceModifierRule struct { - Conditions resourceModifierConditions `yaml:"conditions"` - MergePatches []mergePatch `yaml:"mergePatches,omitempty"` - Patches []jsonPatch `yaml:"patches,omitempty"` -} - -type resourceModifierConditions struct { - GroupResource string `yaml:"groupResource"` - ResourceNameRegex string `yaml:"resourceNameRegex,omitempty"` - Namespaces []string `yaml:"namespaces,omitempty"` -} - -type mergePatch struct { - PatchData string `yaml:"patchData"` -} - -type jsonPatch struct { - Operation string `yaml:"operation"` - Path string `yaml:"path"` - Value string `yaml:"value,omitempty"` -} - -// marshalPatchData marshals an arbitrary object to YAML for use as -// mergePatch.PatchData in Velero resource modifiers. -func marshalPatchData(v interface{}) (string, error) { - b, err := yaml.Marshal(v) - if err != nil { - return "", fmt.Errorf("failed to marshal patch data: %w", err) - } - return string(b), nil -} - -// createResourceModifiersConfigMap creates a Velero resource modifiers ConfigMap -// that patches VM resources during restore: -// - PVC adoption: always adds cdi.kubevirt.io/allowClaimAdoption=true to all -// restored PVCs so CDI can adopt them when a HelmRelease of VMDisk recreates a DV. -// - OVN IP/MAC: sets OVN annotations on the VirtualMachine for correct ssh access to restored VM. -func (r *RestoreJobReconciler) createResourceModifiersConfigMap(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, ur *runtime.RawExtension, target restoreTarget, opts RestoreOptions) (*corev1.ConfigMap, error) { - logger := getLogger(ctx) - - targetNS := target.Namespace - - var rules []resourceModifierRule - - // PVC adoption: allow CDI to adopt restored PVCs when the HelmRelease recreates a DV. - pvcPatch, err := marshalPatchData(map[string]interface{}{ - "metadata": map[string]interface{}{ - "annotations": map[string]string{ - cdiAllowClaimAdoption: "true", - }, - }, - }) - if err != nil { - return nil, err - } - rules = append(rules, resourceModifierRule{ - Conditions: resourceModifierConditions{ - GroupResource: "persistentvolumeclaims", - ResourceNameRegex: ".*", - Namespaces: []string{targetNS}, - }, - MergePatches: []mergePatch{{PatchData: pvcPatch}}, - }) - - // For cross-namespace restore: strip Velero's dynamic PV restore selector and - // volumeName from PVCs so the storage provisioner can dynamically provision new PVs. - // Without this, Velero's CSI PVCAction adds spec.selector with a velero.io/dynamic-pv-restore - // label that prevents dynamic provisioning when PVs are not included in the restore. - // Uses merge patch (null values) instead of JSON Patch remove to avoid RFC 6902 - // failures when the fields don't exist on the PVC (e.g. statically provisioned PVCs). - if target.IsCopy { - pvcStripPatch, err := marshalPatchData(map[string]interface{}{ - "spec": map[string]interface{}{ - "selector": nil, - "volumeName": nil, - }, - }) - if err != nil { - return nil, err - } - rules = append(rules, resourceModifierRule{ - Conditions: resourceModifierConditions{ - GroupResource: "persistentvolumeclaims", - ResourceNameRegex: ".*", - Namespaces: []string{targetNS}, - }, - MergePatches: []mergePatch{{PatchData: pvcStripPatch}}, - }) - } - - // OVN IP/MAC annotations on VirtualMachine for correct network identity after restore. - // Only applied when keepOriginalIpAndMac is true; for restore-to-copy the copy - // should get new IP/MAC from the network to avoid conflicts. - if opts.GetKeepOriginalIpAndMac() { - if vmRes := getVMInstanceResources(ur); vmRes != nil && (vmRes.IP != "" || vmRes.MAC != "") { - ovnAnnotations := map[string]string{} - if vmRes.IP != "" { - ovnAnnotations[ovnIPAnnotation] = vmRes.IP - } - if vmRes.MAC != "" { - ovnAnnotations[ovnMACAnnotation] = vmRes.MAC - } - vmPatch, err := marshalPatchData(map[string]interface{}{ - "spec": map[string]interface{}{ - "template": map[string]interface{}{ - "metadata": map[string]interface{}{ - "annotations": ovnAnnotations, - }, - }, - }, - }) - if err != nil { - return nil, err - } - rules = append(rules, resourceModifierRule{ - Conditions: resourceModifierConditions{ - GroupResource: "virtualmachines.kubevirt.io", - ResourceNameRegex: ".*", - Namespaces: []string{targetNS}, - }, - MergePatches: []mergePatch{{PatchData: vmPatch}}, - }) - } - } - - rulesYAML, err := yaml.Marshal(resourceModifiers{ - Version: "v1", - ResourceModifierRules: rules, - }) - if err != nil { - return nil, fmt.Errorf("failed to marshal resource modifier rules: %w", err) - } - - cmName := fmt.Sprintf("restore-modifiers-%s-%s", restoreJob.Namespace, restoreJob.Name) - // Truncate name to fit Kubernetes 253-char limit - if len(cmName) > 253 { - cmName = cmName[:253] - } - - cm := &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: cmName, - Namespace: veleroNamespace, - Labels: map[string]string{ - backupsv1alpha1.OwningJobNameLabel: restoreJob.Name, - backupsv1alpha1.OwningJobNamespaceLabel: restoreJob.Namespace, - }, - }, - Data: map[string]string{ - "resource-modifier-rules.yaml": string(rulesYAML), - }, - } - - if err := r.Create(ctx, cm); err != nil { - if errors.IsAlreadyExists(err) { - // ConfigMap already exists (e.g. RestoreJob recreated with same name). - // Update its data to reflect the current backup's underlying resources. - existing := &corev1.ConfigMap{} - if err := r.Get(ctx, client.ObjectKey{Namespace: veleroNamespace, Name: cmName}, existing); err != nil { - return nil, fmt.Errorf("failed to get existing resourceModifiers ConfigMap: %w", err) - } - existing.Data = cm.Data - if err := r.Update(ctx, existing); err != nil { - return nil, fmt.Errorf("failed to update existing resourceModifiers ConfigMap: %w", err) - } - logger.Debug("updated existing resourceModifiers ConfigMap", "name", cmName) - return existing, nil - } - return nil, fmt.Errorf("failed to create resourceModifiers ConfigMap: %w", err) - } - - logger.Debug("created resourceModifiers ConfigMap", "name", cm.Name, "namespace", cm.Namespace) - return cm, nil -} - -// resolveUnderlyingResourcesForRestore returns underlying resources for symmetric -// restore label selectors. Velero Backup annotation is used when Backup.status was empty -// (e.g. CRD without underlyingResources in schema). -func (r *RestoreJobReconciler) resolveUnderlyingResourcesForRestore(ctx context.Context, backup *backupsv1alpha1.Backup, veleroBackupName string) *runtime.RawExtension { - if backup.Status.UnderlyingResources != nil && len(backup.Status.UnderlyingResources.Raw) > 0 { - return backup.Status.UnderlyingResources - } - vb := &velerov1.Backup{} - if err := r.Get(ctx, client.ObjectKey{Namespace: veleroNamespace, Name: veleroBackupName}, vb); err != nil { - return backup.Status.UnderlyingResources - } - if urJSON, ok := vb.Annotations[underlyingResourcesAnnotation]; ok && urJSON != "" { - return &runtime.RawExtension{Raw: []byte(urJSON)} - } - return backup.Status.UnderlyingResources -} - -// GVRs used during pre-restore preparation. -var ( - helmReleaseGVR = schema.GroupVersionResource{Group: "helm.toolkit.fluxcd.io", Version: "v2", Resource: "helmreleases"} - virtualMachineGVR = schema.GroupVersionResource{Group: "kubevirt.io", Version: "v1", Resource: "virtualmachines"} - vmiGVR = schema.GroupVersionResource{Group: "kubevirt.io", Version: "v1", Resource: "virtualmachineinstances"} - dataVolumeGVR = schema.GroupVersionResource{Group: "cdi.kubevirt.io", Version: "v1beta1", Resource: "datavolumes"} -) - -// helmReleaseNameForApp returns the HelmRelease name for the given application -// kind and name. Returns empty string for unsupported kinds. -func helmReleaseNameForApp(appKind, appName string) string { - switch appKind { - case vmInstanceKind: - return vmNamePrefix + appName - case vmDiskAppKind: - return vmDiskNamePrefix + appName - default: - return "" - } -} - -// targetHelmReleaseExists returns true when a HelmRelease with the given name -// already exists in namespace. Returns false for unsupported application kinds -// (those where helmReleaseNameForApp returns ""). -func (r *RestoreJobReconciler) targetHelmReleaseExists(ctx context.Context, appKind, hrName, namespace string) (bool, error) { - if hrName == "" { - return false, nil - } - _, err := r.Resource(helmReleaseGVR).Namespace(namespace).Get(ctx, hrName, metav1.GetOptions{}) - if err != nil { - if errors.IsNotFound(err) { - return false, nil - } - return false, err - } - return true, nil -} - -// shortHash returns the first 4 hex characters of sha256(input). -func shortHash(input string) string { - h := sha256.Sum256([]byte(input)) - return hex.EncodeToString(h[:])[:4] -} - -// prepareForRestore performs graceful pre-restore cleanup: -// 1. Suspends HelmReleases that belong to the backup scope. -// 2. Halts the VirtualMachine (sets spec.runStrategy=Halted). -// 3. Waits for the VMI to disappear (graceful shutdown complete). -// 4. Deletes DataVolumes so CDI doesn't recreate PVCs after rename. -// 5. Renames existing PVCs to -orig- so Velero can create fresh -// ones via Data Movement. -// -// Failures in individual steps are non-fatal: missing resources are expected -// (e.g. restore requested when app was already deleted). Each action emits -// a Kubernetes Event on the RestoreJob for observability. -// -// postRestoreRename renames VMInstance HelmRelease after Velero Restore completes. -// Velero resource modifiers cannot change metadata.name, so this step creates -// a new HelmRelease with the target name and deletes the old one. -// Flux will reconcile the renamed HelmRelease and recreate downstream resources -// (VM, VMI) with the new name. -func (r *RestoreJobReconciler) postRestoreRename(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, target restoreTarget) error { - logger := getLogger(ctx) - sourceAppName := backup.Spec.ApplicationRef.Name - sourceHRName := vmNamePrefix + sourceAppName - targetHRName := vmNamePrefix + target.AppName - - logger.Debug("post-restore rename", "from", sourceHRName, "to", targetHRName, "namespace", target.Namespace) - - // Get the restored HelmRelease with the original name - hrClient := r.Resource(helmReleaseGVR).Namespace(target.Namespace) - oldHR, err := hrClient.Get(ctx, sourceHRName, metav1.GetOptions{}) - if err != nil { - if errors.IsNotFound(err) { - logger.Debug("source HelmRelease not found, skipping rename", "name", sourceHRName) - return nil - } - return fmt.Errorf("failed to get HelmRelease %s: %w", sourceHRName, err) - } - - // Create new HelmRelease with the target name - newHR := oldHR.DeepCopy() - newHR.SetName(targetHRName) - newHR.SetResourceVersion("") - newHR.SetUID("") - newHR.SetCreationTimestamp(metav1.Time{}) - newHR.SetManagedFields(nil) - newHR.SetGeneration(0) - - // Update labels - labels := newHR.GetLabels() - if labels == nil { - labels = map[string]string{} - } - labels[appNameLabel] = target.AppName - labels["app.kubernetes.io/instance"] = targetHRName - labels["helm.toolkit.fluxcd.io/name"] = targetHRName - newHR.SetLabels(labels) - - // Remove Velero restore annotations/labels that tie it to the old restore - annotations := newHR.GetAnnotations() - delete(annotations, "velero.io/restore-name") - newHR.SetAnnotations(annotations) - - // Clear status so Flux reconciles fresh - unstructured.RemoveNestedField(newHR.Object, "status") - - if _, err := hrClient.Create(ctx, newHR, metav1.CreateOptions{}); err != nil { - if errors.IsAlreadyExists(err) { - logger.Debug("target HelmRelease already exists, skipping create", "name", targetHRName) - } else { - return fmt.Errorf("failed to create renamed HelmRelease %s: %w", targetHRName, err) - } - } else { - r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PostRestoreRename", - fmt.Sprintf("Created renamed HelmRelease %s (from %s)", targetHRName, sourceHRName)) - } - - // Delete the old HelmRelease - if err := hrClient.Delete(ctx, sourceHRName, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) { - return fmt.Errorf("failed to delete old HelmRelease %s: %w", sourceHRName, err) - } - r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PostRestoreRename", - fmt.Sprintf("Deleted old HelmRelease %s", sourceHRName)) - - logger.Debug("post-restore rename complete", "from", sourceHRName, "to", targetHRName) - return nil -} - -// Returns true when preparation is complete and the Velero Restore can be created. -// Returns false (with a requeue) when still waiting for VM shutdown. -func (r *RestoreJobReconciler) prepareForRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, ur *runtime.RawExtension, target restoreTarget, opts RestoreOptions) (ready bool, result ctrl.Result, err error) { - // For restore-to-copy, skip all source-app preparation. - // The source application remains untouched; we're restoring a copy into another namespace. - if target.IsCopy { - r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore", - "Restore to copy: skipping source application preparation") - return true, ctrl.Result{}, nil - } - - ns := restoreJob.Namespace - appName := backup.Spec.ApplicationRef.Name - appKind := backup.Spec.ApplicationRef.Kind - origSuffix := "-orig-" + shortHash(restoreJob.Name) - - // --- Step 1: Suspend HelmReleases --- - vmRes := getVMInstanceResources(ur) - hrNames := []string{} - if appKind == vmInstanceKind { - hrNames = append(hrNames, vmNamePrefix+appName) - } - if vmRes != nil { - for _, dv := range vmRes.DataVolumes { - hrNames = append(hrNames, dv.DataVolumeName) - } - } - for _, hrName := range hrNames { - if err := r.suspendHelmRelease(ctx, ns, hrName); err != nil { - r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore", - fmt.Sprintf("Failed to suspend HelmRelease %s: %v", hrName, err)) - } else { - r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore", - fmt.Sprintf("Suspended HelmRelease %s", hrName)) - } - } - - // --- Step 2: Halt VM and wait for shutdown --- - if appKind == vmInstanceKind { - vmName := vmNamePrefix + appName - halted, err := r.haltVirtualMachine(ctx, ns, vmName) - if err != nil { - r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore", - fmt.Sprintf("Failed to halt VM %s: %v", vmName, err)) - // Non-fatal: proceed even if halting fails (VM might not exist) - } else if !halted { - r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore", - fmt.Sprintf("Waiting for VM %s to shut down", vmName)) - return false, ctrl.Result{RequeueAfter: defaultRestoreRequeueAfter}, nil - } else { - r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore", - fmt.Sprintf("VM %s is halted", vmName)) - } - } - - // --- Step 3: Rename PVCs to -orig- --- - // Must happen BEFORE deleting DVs: the PVC has an ownerReference to the DV, - // so deleting the DV first would cascade-delete the PVC via garbage collection. - // Only when keepOriginalPVC is true (default for in-place restore). - if opts.GetKeepOriginalPVC() && vmRes != nil { - for _, dv := range vmRes.DataVolumes { - if err := r.renamePVC(ctx, restoreJob, ns, dv.DataVolumeName, dv.DataVolumeName+origSuffix); err != nil { - r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore", - fmt.Sprintf("Failed to keep old PVC %s: %v", dv.DataVolumeName, err)) - } - } - } - - // --- Step 4: Delete DataVolumes so CDI doesn't recreate PVCs --- - if vmRes != nil { - for _, dv := range vmRes.DataVolumes { - if err := r.deleteDataVolume(ctx, ns, dv.DataVolumeName); err != nil { - r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "PrepareForRestore", - fmt.Sprintf("Failed to delete DataVolume %s: %v", dv.DataVolumeName, err)) - } else { - r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore", - fmt.Sprintf("Deleted DataVolume %s", dv.DataVolumeName)) - } - } - } - - r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore", "Pre-restore preparation complete") - return true, ctrl.Result{}, nil -} - -// suspendHelmRelease sets spec.suspend=true on a HelmRelease. -func (r *RestoreJobReconciler) suspendHelmRelease(ctx context.Context, ns, name string) error { - hr, err := r.Resource(helmReleaseGVR).Namespace(ns).Get(ctx, name, metav1.GetOptions{}) - if err != nil { - if errors.IsNotFound(err) { - return nil - } - return err - } - suspended, _, _ := unstructured.NestedBool(hr.Object, "spec", "suspend") - if suspended { - return nil - } - if err := unstructured.SetNestedField(hr.Object, true, "spec", "suspend"); err != nil { - return err - } - if _, err := r.Resource(helmReleaseGVR).Namespace(ns).Update(ctx, hr, metav1.UpdateOptions{}); err != nil { - return err - } - return nil -} - -// haltVirtualMachine sets runStrategy=Halted and returns true when the VMI is gone. -func (r *RestoreJobReconciler) haltVirtualMachine(ctx context.Context, ns, vmName string) (bool, error) { - vm, err := r.Resource(virtualMachineGVR).Namespace(ns).Get(ctx, vmName, metav1.GetOptions{}) - if err != nil { - if errors.IsNotFound(err) { - return true, nil - } - return false, err - } - - currentStrategy, _, _ := unstructured.NestedString(vm.Object, "spec", "runStrategy") - if currentStrategy != "Halted" { - if err := unstructured.SetNestedField(vm.Object, "Halted", "spec", "runStrategy"); err != nil { - return false, err - } - if _, err := r.Resource(virtualMachineGVR).Namespace(ns).Update(ctx, vm, metav1.UpdateOptions{}); err != nil { - return false, err - } - } - - // VMI gone = shutdown complete - _, err = r.Resource(vmiGVR).Namespace(ns).Get(ctx, vmName, metav1.GetOptions{}) - if err != nil { - if errors.IsNotFound(err) { - return true, nil - } - return false, err - } - return false, nil -} - -// deleteDataVolume deletes a DataVolume so CDI doesn't recreate the PVC after rename. -// Uses Orphan propagation to avoid cascade-deleting the PVC that the DV owns via -// ownerReference. Without this, keepOriginalPVC=false would silently destroy the -// original PVC through garbage collection instead of leaving it for Velero to overwrite. -func (r *RestoreJobReconciler) deleteDataVolume(ctx context.Context, ns, name string) error { - orphan := metav1.DeletePropagationOrphan - err := r.Resource(dataVolumeGVR).Namespace(ns).Delete(ctx, name, metav1.DeleteOptions{ - PropagationPolicy: &orphan, - }) - if err != nil && !errors.IsNotFound(err) { - return err - } - return nil -} - -// renamePVC preserves an existing PVC by rebinding it under a new name. -// The original PVC is deleted and a new one pointing to the same PV is created. -// Missing resources are silently skipped (non-fatal). -func (r *RestoreJobReconciler) renamePVC(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, ns, oldName, newName string) error { - logger := getLogger(ctx) - - // Check if already renamed - existingNew := &corev1.PersistentVolumeClaim{} - if err := r.Get(ctx, client.ObjectKey{Namespace: ns, Name: newName}, existingNew); err == nil { - return nil - } - - // Get the original PVC - oldPVC := &corev1.PersistentVolumeClaim{} - if err := r.Get(ctx, client.ObjectKey{Namespace: ns, Name: oldName}, oldPVC); err != nil { - if errors.IsNotFound(err) { - return nil // nothing to rename - } - return err - } - - pvName := oldPVC.Spec.VolumeName - if pvName == "" { - logger.Debug("PVC not bound, deleting", "name", oldName) - return r.Delete(ctx, oldPVC) - } - - // Patch PV reclaim policy to Retain so it survives PVC deletion - pv := &corev1.PersistentVolume{} - if err := r.Get(ctx, client.ObjectKey{Name: pvName}, pv); err != nil { - return fmt.Errorf("failed to get PV %s: %w", pvName, err) - } - if pv.Spec.PersistentVolumeReclaimPolicy != corev1.PersistentVolumeReclaimRetain { - pv.Spec.PersistentVolumeReclaimPolicy = corev1.PersistentVolumeReclaimRetain - if err := r.Update(ctx, pv); err != nil { - return fmt.Errorf("failed to set Retain policy on PV %s: %w", pvName, err) - } - } - - // Create the new -orig PVC first (unbound, just the object) - newPVC := &corev1.PersistentVolumeClaim{ - ObjectMeta: metav1.ObjectMeta{ - Name: newName, - Namespace: ns, - }, - Spec: corev1.PersistentVolumeClaimSpec{ - AccessModes: oldPVC.Spec.AccessModes, - Resources: oldPVC.Spec.Resources, - StorageClassName: oldPVC.Spec.StorageClassName, - VolumeMode: oldPVC.Spec.VolumeMode, - VolumeName: pvName, - }, - } - if err := r.Create(ctx, newPVC); err != nil && !errors.IsAlreadyExists(err) { - return fmt.Errorf("failed to create -orig PVC %s: %w", newName, err) - } - // Re-read to get UID for the claimRef - if err := r.Get(ctx, client.ObjectKey{Namespace: ns, Name: newName}, newPVC); err != nil { - return fmt.Errorf("failed to get -orig PVC %s: %w", newName, err) - } - - // Delete the original PVC - if err := r.Delete(ctx, oldPVC); err != nil && !errors.IsNotFound(err) { - return fmt.Errorf("failed to delete PVC %s: %w", oldName, err) - } - - // Point the PV's claimRef directly to the new -orig PVC. - // This is atomic — no window where the PV is Available for other PVCs to grab. - if err := r.Get(ctx, client.ObjectKey{Name: pvName}, pv); err != nil { - return fmt.Errorf("failed to re-fetch PV %s: %w", pvName, err) - } - pv.Spec.ClaimRef = &corev1.ObjectReference{ - APIVersion: "v1", - Kind: "PersistentVolumeClaim", - Namespace: ns, - Name: newName, - UID: newPVC.UID, - } - if err := r.Update(ctx, pv); err != nil { - return fmt.Errorf("failed to rebind PV %s to %s: %w", pvName, newName, err) - } - - r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "PrepareForRestore", - fmt.Sprintf("Keep old PVC %s as %s (PV: %s)", oldName, newName, pvName)) - return nil -} - // createVeleroRestore creates a Velero Restore resource. -func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, strategy *strategyv1alpha1.Velero, veleroBackupName string, ur *runtime.RawExtension, target restoreTarget, opts RestoreOptions) error { +func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, strategy *strategyv1alpha1.Velero, veleroBackupName string) error { logger := getLogger(ctx) - logger.Debug("createVeleroRestore called", "strategy", strategy.Name, "veleroBackupName", veleroBackupName, "targetNS", target.Namespace, "isCopy", target.IsCopy) + logger.Debug("createVeleroRestore called", "strategy", strategy.Name, "veleroBackupName", veleroBackupName) - // For restore template context, always use the source (backup) namespace and app name. - // The strategy template uses includedNamespaces and orLabelSelectors to select - // resources from the backup tarball, which are stored under the source namespace - // and labeled with the source app name. - // Velero's namespaceMapping handles redirecting to the target namespace; - // resource modifiers handle renaming when the target app name differs. + // Determine target application reference + targetAppRef := r.getTargetApplicationRef(restoreJob, backup) + + // Get the target application object for templating + mapping, err := r.RESTMapping(schema.GroupKind{Group: *targetAppRef.APIGroup, Kind: targetAppRef.Kind}) + if err != nil { + return fmt.Errorf("failed to get REST mapping for target application: %w", err) + } + ns := restoreJob.Namespace + if mapping.Scope.Name() != meta.RESTScopeNameNamespace { + ns = "" + } + app, err := r.Resource(mapping.Resource).Namespace(ns).Get(ctx, targetAppRef.Name, metav1.GetOptions{}) + if err != nil { + return fmt.Errorf("failed to get target application: %w", err) + } + + // Build template context templateContext := map[string]interface{}{ - "Application": map[string]interface{}{ - "metadata": map[string]interface{}{ - "name": backup.Spec.ApplicationRef.Name, - "namespace": backup.Namespace, - }, - "kind": backup.Spec.ApplicationRef.Kind, - }, + "Application": app.Object, // TODO: Parameters are not currently stored on Backup, so they're unavailable during restore. // This is a design limitation that should be addressed by persisting Parameters on the Backup object. "Parameters": map[string]string{}, @@ -1358,46 +473,6 @@ func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJ // Set the backupName in the spec (required by Velero) veleroRestoreSpec.BackupName = veleroBackupName - // For restore-to-copy, set Velero namespaceMapping to redirect resources - // from the source namespace to the target namespace. - if target.IsCopy { - if veleroRestoreSpec.NamespaceMapping == nil { - veleroRestoreSpec.NamespaceMapping = make(map[string]string) - } - veleroRestoreSpec.NamespaceMapping[backup.Namespace] = target.Namespace - logger.Debug("set namespaceMapping on Velero Restore", "from", backup.Namespace, "to", target.Namespace) - } - - // Match backup: add OR selectors for each underlying VMDisk so restore applies the same - // scope as the intended backup (see createVeleroBackup). - if vmRes := getVMInstanceResources(ur); vmRes != nil { - for _, dv := range vmRes.DataVolumes { - veleroRestoreSpec.OrLabelSelectors = append(veleroRestoreSpec.OrLabelSelectors, &metav1.LabelSelector{ - MatchLabels: map[string]string{ - appKindLabel: vmDiskAppKind, - appNameLabel: dv.ApplicationName, - }, - }) - } - if len(vmRes.DataVolumes) > 0 { - logger.Debug("added VMDisk label selectors to Velero restore", "count", len(vmRes.DataVolumes)) - } - } - - // Create resourceModifiers ConfigMap - resourceModifierCM, err := r.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts) - if err != nil { - return fmt.Errorf("failed to create resourceModifiers ConfigMap: %w", err) - } - if resourceModifierCM != nil { - veleroRestoreSpec.ResourceModifier = &corev1.TypedLocalObjectReference{ - APIGroup: stringPtr(""), - Kind: "ConfigMap", - Name: resourceModifierCM.Name, - } - logger.Debug("set resourceModifier on Velero Restore", "configMap", resourceModifierCM.Name) - } - generateName := fmt.Sprintf("%s.%s-", restoreJob.Namespace, restoreJob.Name) veleroRestore := &velerov1.Restore{ ObjectMeta: metav1.ObjectMeta{ @@ -1422,60 +497,3 @@ func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJ fmt.Sprintf("Created Velero Restore %s/%s", veleroNamespace, veleroRestore.Name)) return nil } - -// dataUploadListGVK is the API version shipped with Velero data mover CRDs (see velero datauploads CRD). -var dataUploadListGVK = schema.GroupVersionKind{Group: "velero.io", Version: "v2alpha1", Kind: "DataUploadList"} - -// formatVeleroBackupFailureMessageForBackupJob builds a BackupJob status message from Velero Backup -// status plus failed DataUpload resources (CSI data mover), similar to `velero backup describe`. -func formatVeleroBackupFailureMessageForBackupJob(ctx context.Context, c client.Client, veleroBackup *velerov1.Backup) string { - var b strings.Builder - fmt.Fprintf(&b, "Velero Backup failed with phase %s", veleroBackup.Status.Phase) - if fr := strings.TrimSpace(veleroBackup.Status.FailureReason); fr != "" { - fmt.Fprintf(&b, ": %s", fr) - } - if len(veleroBackup.Status.ValidationErrors) > 0 { - fmt.Fprintf(&b, "; validation: %v", veleroBackup.Status.ValidationErrors) - } - if h := veleroBackup.Status.HookStatus; h != nil && h.HooksFailed > 0 { - fmt.Fprintf(&b, "; hooks failed %d/%d", h.HooksFailed, h.HooksAttempted) - } - if veleroBackup.Status.BackupItemOperationsFailed > 0 { - fmt.Fprintf(&b, "; async item operations failed %d (completed %d, attempted %d)", - veleroBackup.Status.BackupItemOperationsFailed, - veleroBackup.Status.BackupItemOperationsCompleted, - veleroBackup.Status.BackupItemOperationsAttempted) - } - b.WriteString(appendFailedDataUploadMessages(ctx, c, veleroBackup.Name)) - return b.String() -} - -func appendFailedDataUploadMessages(ctx context.Context, c client.Client, veleroBackupName string) string { - ul := unstructured.UnstructuredList{} - ul.SetGroupVersionKind(dataUploadListGVK) - if err := c.List(ctx, &ul, client.InNamespace(veleroNamespace)); err != nil { - return "" - } - prefix := veleroBackupName + "-" - var b strings.Builder - for _, item := range ul.Items { - if !strings.HasPrefix(item.GetName(), prefix) { - continue - } - phase, _, _ := unstructured.NestedString(item.Object, "status", "phase") - if phase != "Failed" { - continue - } - msg, _, _ := unstructured.NestedString(item.Object, "status", "message") - if strings.TrimSpace(msg) == "" { - msg = "(empty status.message)" - } - srcPVC, _, _ := unstructured.NestedString(item.Object, "spec", "sourcePVC") - if srcPVC != "" { - fmt.Fprintf(&b, "; DataUpload %s failed for PVC %s: %s", item.GetName(), srcPVC, msg) - } else { - fmt.Fprintf(&b, "; DataUpload %s failed: %s", item.GetName(), msg) - } - } - return b.String() -} diff --git a/internal/backupcontroller/velerostrategy_controller_test.go b/internal/backupcontroller/velerostrategy_controller_test.go index 7b085dbf..a7de2076 100644 --- a/internal/backupcontroller/velerostrategy_controller_test.go +++ b/internal/backupcontroller/velerostrategy_controller_test.go @@ -2,13 +2,11 @@ package backupcontroller import ( "context" - "encoding/json" "testing" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/meta" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" dynamicfake "k8s.io/client-go/dynamic/fake" @@ -208,1006 +206,3 @@ func TestCreateVeleroBackup_TemplateContext(t *testing.T) { t.Errorf("Template context Parameters.backupStorageLocationName not applied correctly. Expected 'default-storage', got '%s'", veleroBackup.Spec.StorageLocation) } } - -func TestResolveRestoreTarget_NoTargetNamespace_InPlace(t *testing.T) { - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{ - Name: "restore-test", - Namespace: "tenant-root", - }, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "my-backup"}, - TargetApplicationRef: &corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-vm", - }, - }, - } - - backup := &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-backup", - Namespace: "tenant-root", - }, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-vm", - }, - }, - } - - // No targetNamespace in options → in-place restore - opts := RestoreOptions{} - target := resolveRestoreTarget(restoreJob, backup, opts) - - if target.IsCopy { - t.Error("expected IsCopy=false when targetNamespace is omitted, got true") - } - if target.Namespace != "tenant-root" { - t.Errorf("expected namespace 'tenant-root', got '%s'", target.Namespace) - } - if target.AppName != "test-vm" { - t.Errorf("expected appName 'test-vm', got '%s'", target.AppName) - } - if target.AppKind != "VMInstance" { - t.Errorf("expected appKind 'VMInstance', got '%s'", target.AppKind) - } -} - -func TestResolveRestoreTarget_SameTargetNamespace_InPlace(t *testing.T) { - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{ - Name: "restore-test", - Namespace: "tenant-root", - }, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "my-backup"}, - }, - } - - backup := &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-backup", - Namespace: "tenant-root", - }, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-vm", - }, - }, - } - - // targetNamespace equals backup namespace → still in-place - opts := RestoreOptions{ - CommonRestoreOptions: CommonRestoreOptions{ - TargetNamespace: "tenant-root", - }, - } - target := resolveRestoreTarget(restoreJob, backup, opts) - - if target.IsCopy { - t.Error("expected IsCopy=false when targetNamespace equals backup namespace, got true") - } - if target.Namespace != "tenant-root" { - t.Errorf("expected namespace 'tenant-root', got '%s'", target.Namespace) - } -} - -func TestResolveRestoreTarget_DifferentTargetNamespace_Copy(t *testing.T) { - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{ - Name: "restore-test", - Namespace: "tenant-root", - }, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "my-backup"}, - }, - } - - backup := &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-backup", - Namespace: "tenant-root", - }, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-vm", - }, - }, - } - - opts := RestoreOptions{ - CommonRestoreOptions: CommonRestoreOptions{ - TargetNamespace: "tenant-copy", - }, - } - target := resolveRestoreTarget(restoreJob, backup, opts) - - if !target.IsCopy { - t.Error("expected IsCopy=true when targetNamespace differs from backup namespace, got false") - } - if target.Namespace != "tenant-copy" { - t.Errorf("expected namespace 'tenant-copy', got '%s'", target.Namespace) - } -} - -// newTestRestoreJobReconcilerWithDynamic builds a RestoreJobReconciler with -// both static and dynamic fake clients. Use dynamicObjects to pre-populate -// unstructured resources (e.g. HelmReleases). -func newTestRestoreJobReconcilerWithDynamic(t *testing.T, dynamicObjects []runtime.Object, objects ...client.Object) *RestoreJobReconciler { - t.Helper() - testScheme := runtime.NewScheme() - _ = scheme.AddToScheme(testScheme) - _ = backupsv1alpha1.AddToScheme(testScheme) - _ = velerov1.AddToScheme(testScheme) - - fakeClient := clientfake.NewClientBuilder(). - WithScheme(testScheme). - WithObjects(objects...). - Build() - - dynamicClient := dynamicfake.NewSimpleDynamicClient(testScheme, dynamicObjects...) - - mapping := &meta.RESTMapping{ - Resource: schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}, - GroupVersionKind: schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"}, - Scope: meta.RESTScopeNamespace, - } - - return &RestoreJobReconciler{ - Client: fakeClient, - Interface: dynamicClient, - RESTMapper: &mockRESTMapper{mapping: mapping}, - Scheme: testScheme, - Recorder: record.NewFakeRecorder(100), - } -} - -// newTestRestoreJobReconciler builds a RestoreJobReconciler with fake clients for testing. -func newTestRestoreJobReconciler(t *testing.T, objects ...client.Object) *RestoreJobReconciler { - t.Helper() - testScheme := runtime.NewScheme() - _ = scheme.AddToScheme(testScheme) - _ = backupsv1alpha1.AddToScheme(testScheme) - _ = velerov1.AddToScheme(testScheme) - - fakeClient := clientfake.NewClientBuilder(). - WithScheme(testScheme). - WithObjects(objects...). - Build() - - dynamicClient := dynamicfake.NewSimpleDynamicClient(testScheme) - - mapping := &meta.RESTMapping{ - Resource: schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}, - GroupVersionKind: schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"}, - Scope: meta.RESTScopeNamespace, - } - - return &RestoreJobReconciler{ - Client: fakeClient, - Interface: dynamicClient, - RESTMapper: &mockRESTMapper{mapping: mapping}, - Scheme: testScheme, - Recorder: record.NewFakeRecorder(100), - } -} - -func TestPrepareForRestore_KeepOriginalPVCFalse_SkipsRename(t *testing.T) { - ns := "tenant-root" - - // Create a PVC that would be renamed if keepOriginalPVC were true - pvc := &corev1.PersistentVolumeClaim{ - ObjectMeta: metav1.ObjectMeta{ - Name: "vm-disk-ubuntu-source", - Namespace: ns, - }, - Spec: corev1.PersistentVolumeClaimSpec{}, - } - - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{ - Name: "restore-test", - Namespace: ns, - }, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "my-backup"}, - }, - } - - backup := &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-backup", - Namespace: ns, - }, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-vm", - }, - }, - } - - // underlyingResources with a DataVolume referencing the PVC - urData := vmInstanceResources{ - DataVolumes: []backupsv1alpha1.DataVolumeResource{ - {DataVolumeName: "vm-disk-ubuntu-source", ApplicationName: "ubuntu-source"}, - }, - } - urRaw, _ := json.Marshal(urData) - ur := &runtime.RawExtension{Raw: urRaw} - - target := restoreTarget{ - Namespace: ns, - AppName: "test-vm", - AppKind: "VMInstance", - IsCopy: false, - } - - // keepOriginalPVC = false → PVCs should NOT be renamed - opts := RestoreOptions{ - KeepOriginalPVC: boolPtr(false), - } - - reconciler := newTestRestoreJobReconciler(t, pvc, restoreJob, backup) - - ctx := context.Background() - ready, _, err := reconciler.prepareForRestore(ctx, restoreJob, backup, ur, target, opts) - if err != nil { - t.Fatalf("prepareForRestore() error = %v", err) - } - if !ready { - t.Fatal("expected ready=true, got false") - } - - // Verify the original PVC still exists with its original name (not renamed) - origPVC := &corev1.PersistentVolumeClaim{} - err = reconciler.Get(ctx, client.ObjectKey{Namespace: ns, Name: "vm-disk-ubuntu-source"}, origPVC) - if err != nil { - t.Errorf("original PVC should still exist with original name when keepOriginalPVC=false, got error: %v", err) - } - - // Verify no -orig PVC was created - origSuffix := "-orig-" + shortHash(restoreJob.Name) - renamedPVC := &corev1.PersistentVolumeClaim{} - err = reconciler.Get(ctx, client.ObjectKey{Namespace: ns, Name: "vm-disk-ubuntu-source" + origSuffix}, renamedPVC) - if err == nil { - t.Error("PVC should NOT have been renamed when keepOriginalPVC=false, but found renamed PVC") - } -} - -func TestResolveRestoreTarget_VMDisk_CommonRestoreOptions(t *testing.T) { - tests := []struct { - name string - targetNS string - wantIsCopy bool - wantNamespace string - }{ - { - name: "VMDisk in-place restore when targetNamespace is omitted", - targetNS: "", - wantIsCopy: false, - wantNamespace: "tenant-root", - }, - { - name: "VMDisk cross-namespace restore when targetNamespace differs", - targetNS: "tenant-copy", - wantIsCopy: true, - wantNamespace: "tenant-copy", - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{ - Name: "restore-vmdisk", - Namespace: "tenant-root", - }, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "disk-backup"}, - TargetApplicationRef: &corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMDisk", - Name: "ubuntu-source", - }, - }, - } - - backup := &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{ - Name: "disk-backup", - Namespace: "tenant-root", - }, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMDisk", - Name: "ubuntu-source", - }, - }, - } - - // VMDisk uses only CommonRestoreOptions (no VMI-specific fields) - opts := RestoreOptions{ - CommonRestoreOptions: CommonRestoreOptions{ - TargetNamespace: tt.targetNS, - }, - } - - target := resolveRestoreTarget(restoreJob, backup, opts) - - if target.IsCopy != tt.wantIsCopy { - t.Errorf("IsCopy = %v, want %v", target.IsCopy, tt.wantIsCopy) - } - if target.Namespace != tt.wantNamespace { - t.Errorf("Namespace = %q, want %q", target.Namespace, tt.wantNamespace) - } - if target.AppKind != "VMDisk" { - t.Errorf("AppKind = %q, want 'VMDisk'", target.AppKind) - } - if target.AppName != "ubuntu-source" { - t.Errorf("AppName = %q, want 'ubuntu-source'", target.AppName) - } - }) - } -} - -func TestParseRestoreOptions_VMDiskOnlyCommonFields(t *testing.T) { - // Simulate a VMDisk restore where only CommonRestoreOptions fields are set - raw, _ := json.Marshal(map[string]interface{}{ - "targetNamespace": "tenant-copy", - "failIfTargetExists": true, - }) - ext := &runtime.RawExtension{Raw: raw} - - opts, err := parseRestoreOptions(ext) - if err != nil { - t.Fatalf("parseRestoreOptions() error = %v", err) - } - - if opts.TargetNamespace != "tenant-copy" { - t.Errorf("TargetNamespace = %q, want 'tenant-copy'", opts.TargetNamespace) - } - if !opts.GetFailIfTargetExists() { - t.Error("GetFailIfTargetExists() = false, want true") - } - // VMI-specific fields should be nil (not set by VMDisk options) - if opts.KeepOriginalPVC != nil { - t.Errorf("KeepOriginalPVC should be nil for VMDisk options, got %v", *opts.KeepOriginalPVC) - } - if opts.KeepOriginalIpAndMac != nil { - t.Errorf("KeepOriginalIpAndMac should be nil for VMDisk options, got %v", *opts.KeepOriginalIpAndMac) - } -} - -func TestRestoreOptions_Defaults(t *testing.T) { - t.Run("nil options default all bools to true", func(t *testing.T) { - opts, err := parseRestoreOptions(nil) - if err != nil { - t.Fatalf("parseRestoreOptions(nil) error = %v", err) - } - - if opts.TargetNamespace != "" { - t.Errorf("TargetNamespace default should be empty, got %q", opts.TargetNamespace) - } - if !opts.GetFailIfTargetExists() { - t.Error("GetFailIfTargetExists() should default to true") - } - if !opts.GetKeepOriginalPVC() { - t.Error("GetKeepOriginalPVC() should default to true") - } - if !opts.GetKeepOriginalIpAndMac() { - t.Error("GetKeepOriginalIpAndMac() should default to true") - } - }) - - t.Run("empty JSON defaults all bools to true", func(t *testing.T) { - raw, _ := json.Marshal(map[string]interface{}{}) - opts, err := parseRestoreOptions(&runtime.RawExtension{Raw: raw}) - if err != nil { - t.Fatalf("parseRestoreOptions({}) error = %v", err) - } - - if !opts.GetFailIfTargetExists() { - t.Error("GetFailIfTargetExists() should default to true") - } - if !opts.GetKeepOriginalPVC() { - t.Error("GetKeepOriginalPVC() should default to true") - } - if !opts.GetKeepOriginalIpAndMac() { - t.Error("GetKeepOriginalIpAndMac() should default to true") - } - }) - - t.Run("explicit false overrides defaults", func(t *testing.T) { - raw, _ := json.Marshal(map[string]interface{}{ - "failIfTargetExists": false, - "keepOriginalPVC": false, - "keepOriginalIpAndMac": false, - }) - opts, err := parseRestoreOptions(&runtime.RawExtension{Raw: raw}) - if err != nil { - t.Fatalf("parseRestoreOptions() error = %v", err) - } - - if opts.GetFailIfTargetExists() { - t.Error("GetFailIfTargetExists() should be false when explicitly set") - } - if opts.GetKeepOriginalPVC() { - t.Error("GetKeepOriginalPVC() should be false when explicitly set") - } - if opts.GetKeepOriginalIpAndMac() { - t.Error("GetKeepOriginalIpAndMac() should be false when explicitly set") - } - }) -} - -func TestResolveRestoreTarget_IsRenamed(t *testing.T) { - backup := &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-alpine", - }, - }, - } - - t.Run("same name is not renamed", func(t *testing.T) { - rj := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "bk"}, - TargetApplicationRef: &corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-alpine", - }, - }, - } - target := resolveRestoreTarget(rj, backup, RestoreOptions{ - CommonRestoreOptions: CommonRestoreOptions{TargetNamespace: "tenant-foo"}, - }) - if target.IsRenamed { - t.Error("IsRenamed should be false when names match") - } - }) - - t.Run("different name is renamed", func(t *testing.T) { - rj := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "bk"}, - TargetApplicationRef: &corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-new", - }, - }, - } - target := resolveRestoreTarget(rj, backup, RestoreOptions{ - CommonRestoreOptions: CommonRestoreOptions{TargetNamespace: "tenant-foo"}, - }) - if !target.IsRenamed { - t.Error("IsRenamed should be true when names differ") - } - if target.AppName != "test-new" { - t.Errorf("AppName = %q, want 'test-new'", target.AppName) - } - if !target.IsCopy { - t.Error("IsCopy should be true") - } - }) - - t.Run("no targetApplicationRef is not renamed", func(t *testing.T) { - rj := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "bk"}, - }, - } - target := resolveRestoreTarget(rj, backup, RestoreOptions{ - CommonRestoreOptions: CommonRestoreOptions{TargetNamespace: "tenant-foo"}, - }) - if target.IsRenamed { - t.Error("IsRenamed should be false when targetApplicationRef is nil") - } - if target.AppName != "test-alpine" { - t.Errorf("AppName = %q, want 'test-alpine'", target.AppName) - } - }) -} - -// makeUnstructuredHelmRelease creates an unstructured HelmRelease for dynamic client tests. -func makeUnstructuredHelmRelease(name, namespace string, labels map[string]string) *unstructured.Unstructured { - hr := &unstructured.Unstructured{} - hr.SetAPIVersion("helm.toolkit.fluxcd.io/v2") - hr.SetKind("HelmRelease") - hr.SetName(name) - hr.SetNamespace(namespace) - hr.SetLabels(labels) - return hr -} - -func TestPostRestoreRename_RenamesHelmRelease(t *testing.T) { - ns := "tenant-foo" - sourceHR := makeUnstructuredHelmRelease("vm-instance-test-alpine", ns, map[string]string{ - appNameLabel: "test-alpine", - "app.kubernetes.io/instance": "vm-instance-test-alpine", - "helm.toolkit.fluxcd.io/name": "vm-instance-test-alpine", - }) - - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj-rename", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "bk"}, - }, - } - backup := &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-alpine", - }, - }, - } - target := restoreTarget{ - Namespace: ns, - AppName: "test-new", - AppKind: "VMInstance", - IsCopy: true, - IsRenamed: true, - } - - reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{sourceHR}, restoreJob, backup) - ctx := context.Background() - - err := reconciler.postRestoreRename(ctx, restoreJob, backup, target) - if err != nil { - t.Fatalf("postRestoreRename() error = %v", err) - } - - hrClient := reconciler.Resource(helmReleaseGVR).Namespace(ns) - - // New HelmRelease should exist with target name - newHR, err := hrClient.Get(ctx, "vm-instance-test-new", metav1.GetOptions{}) - if err != nil { - t.Fatalf("new HelmRelease vm-instance-test-new not found: %v", err) - } - - // Check labels were updated - labels := newHR.GetLabels() - if labels[appNameLabel] != "test-new" { - t.Errorf("label %s = %q, want 'test-new'", appNameLabel, labels[appNameLabel]) - } - if labels["app.kubernetes.io/instance"] != "vm-instance-test-new" { - t.Errorf("label app.kubernetes.io/instance = %q, want 'vm-instance-test-new'", labels["app.kubernetes.io/instance"]) - } - if labels["helm.toolkit.fluxcd.io/name"] != "vm-instance-test-new" { - t.Errorf("label helm.toolkit.fluxcd.io/name = %q, want 'vm-instance-test-new'", labels["helm.toolkit.fluxcd.io/name"]) - } - - // Old HelmRelease should be deleted - _, err = hrClient.Get(ctx, "vm-instance-test-alpine", metav1.GetOptions{}) - if err == nil { - t.Error("old HelmRelease vm-instance-test-alpine should have been deleted") - } -} - -func TestPostRestoreRename_SkipsWhenSourceNotFound(t *testing.T) { - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj-rename", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "bk"}, - }, - } - backup := &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-alpine", - }, - }, - } - target := restoreTarget{ - Namespace: "tenant-foo", - AppName: "test-new", - AppKind: "VMInstance", - IsCopy: true, - IsRenamed: true, - } - - // No HelmRelease in dynamic client — should skip gracefully - reconciler := newTestRestoreJobReconcilerWithDynamic(t, nil, restoreJob, backup) - ctx := context.Background() - - err := reconciler.postRestoreRename(ctx, restoreJob, backup, target) - if err != nil { - t.Fatalf("postRestoreRename() should skip gracefully when source HR not found, got error: %v", err) - } -} - -func TestPostRestoreRename_IdempotentWhenTargetExists(t *testing.T) { - ns := "tenant-foo" - sourceHR := makeUnstructuredHelmRelease("vm-instance-test-alpine", ns, map[string]string{ - appNameLabel: "test-alpine", - }) - // Target already exists (e.g. from a previous reconcile) - targetHR := makeUnstructuredHelmRelease("vm-instance-test-new", ns, map[string]string{ - appNameLabel: "test-new", - }) - - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj-rename", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "bk"}, - }, - } - backup := &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: "VMInstance", - Name: "test-alpine", - }, - }, - } - target := restoreTarget{ - Namespace: ns, - AppName: "test-new", - AppKind: "VMInstance", - IsCopy: true, - IsRenamed: true, - } - - reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{sourceHR, targetHR}, restoreJob, backup) - ctx := context.Background() - - err := reconciler.postRestoreRename(ctx, restoreJob, backup, target) - if err != nil { - t.Fatalf("postRestoreRename() should be idempotent, got error: %v", err) - } - - hrClient := reconciler.Resource(helmReleaseGVR).Namespace(ns) - - // Target should still exist - _, err = hrClient.Get(ctx, "vm-instance-test-new", metav1.GetOptions{}) - if err != nil { - t.Fatalf("target HelmRelease should exist: %v", err) - } - - // Source should be deleted - _, err = hrClient.Get(ctx, "vm-instance-test-alpine", metav1.GetOptions{}) - if err == nil { - t.Error("source HelmRelease should have been deleted") - } -} - -// --- failIfTargetExists enforcement tests --- - -func TestTargetHelmReleaseExists_ReturnsTrueWhenPresent(t *testing.T) { - ns := "tenant-copy" - hr := makeUnstructuredHelmRelease("vm-instance-test", ns, nil) - - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"}, - } - backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}} - - reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{hr}, restoreJob, backup) - ctx := context.Background() - - exists, err := reconciler.targetHelmReleaseExists(ctx, vmInstanceKind, "vm-instance-test", ns) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !exists { - t.Error("expected exists=true when HelmRelease is present") - } -} - -func TestTargetHelmReleaseExists_ReturnsFalseWhenAbsent(t *testing.T) { - ns := "tenant-copy" - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"}, - } - backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}} - - reconciler := newTestRestoreJobReconcilerWithDynamic(t, nil, restoreJob, backup) - ctx := context.Background() - - exists, err := reconciler.targetHelmReleaseExists(ctx, vmInstanceKind, "vm-instance-test", ns) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if exists { - t.Error("expected exists=false when HelmRelease is absent") - } -} - -func TestTargetHelmReleaseExists_UnsupportedKindViaHelper(t *testing.T) { - ns := "tenant-copy" - // Even though a HR exists, unsupported kinds produce an empty hrName - // from helmReleaseNameForApp, which makes targetHelmReleaseExists return false. - hr := makeUnstructuredHelmRelease("vm-instance-test", ns, nil) - - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"}, - } - backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}} - - reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{hr}, restoreJob, backup) - ctx := context.Background() - - // Unsupported kinds get empty hrName from the helper - hrName := helmReleaseNameForApp("MariaDB", "mydb") - exists, err := reconciler.targetHelmReleaseExists(ctx, "MariaDB", hrName, ns) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if exists { - t.Error("expected exists=false for unsupported kind (empty hrName)") - } -} - -// --- createResourceModifiersConfigMap tests --- - -func makeTestBackup(ns, appName, appKind string) *backupsv1alpha1.Backup { - return &backupsv1alpha1.Backup{ - ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: ns}, - Spec: backupsv1alpha1.BackupSpec{ - ApplicationRef: corev1.TypedLocalObjectReference{ - APIGroup: stringPtr("apps.cozystack.io"), - Kind: appKind, - Name: appName, - }, - }, - } -} - -func makeTestRestoreJob(ns, name string) *backupsv1alpha1.RestoreJob { - return &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: ns}, - Spec: backupsv1alpha1.RestoreJobSpec{ - BackupRef: corev1.LocalObjectReference{Name: "bk"}, - }, - } -} - -func makeVMInstanceUR(ip, mac string, dvs []backupsv1alpha1.DataVolumeResource) *runtime.RawExtension { - data := vmInstanceResources{IP: ip, MAC: mac, DataVolumes: dvs} - raw, _ := json.Marshal(data) - return &runtime.RawExtension{Raw: raw} -} - -func TestCreateResourceModifiersConfigMap_InPlace_WithOVN(t *testing.T) { - ns := "tenant-root" - restoreJob := makeTestRestoreJob(ns, "rj-inplace") - backup := makeTestBackup(ns, "test-vm", "VMInstance") - - ur := makeVMInstanceUR("10.0.0.5", "aa:bb:cc:dd:ee:ff", nil) - target := restoreTarget{Namespace: ns, AppName: "test-vm", AppKind: "VMInstance", IsCopy: false} - opts := RestoreOptions{} // defaults: keepOriginalIpAndMac=true - - reconciler := newTestRestoreJobReconciler(t, restoreJob, backup) - ctx := context.Background() - - cm, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts) - if err != nil { - t.Fatalf("createResourceModifiersConfigMap() error = %v", err) - } - if cm == nil { - t.Fatal("expected non-nil ConfigMap") - } - - rulesYAML, ok := cm.Data["resource-modifier-rules.yaml"] - if !ok { - t.Fatal("ConfigMap missing resource-modifier-rules.yaml key") - } - - // Should contain PVC adoption annotation - if !containsString(rulesYAML, cdiAllowClaimAdoption) { - t.Error("expected PVC adoption annotation in rules") - } - // Should contain OVN IP annotation (keepOriginalIpAndMac defaults to true) - if !containsString(rulesYAML, ovnIPAnnotation) { - t.Error("expected OVN IP annotation in rules for in-place restore with IP") - } - // Should NOT contain selector removal (in-place, not copy) - if containsString(rulesYAML, "/spec/selector") { - t.Error("selector removal rule should not be present for in-place restore") - } -} - -func TestCreateResourceModifiersConfigMap_Copy_NoOVN(t *testing.T) { - sourceNS := "tenant-root" - targetNS := "tenant-copy" - restoreJob := makeTestRestoreJob(sourceNS, "rj-copy") - backup := makeTestBackup(sourceNS, "test-vm", "VMInstance") - - // Copy restore: keepOriginalIpAndMac=false, no OVN annotations on copy - opts := RestoreOptions{ - KeepOriginalIpAndMac: boolPtr(false), - } - ur := makeVMInstanceUR("10.0.0.5", "aa:bb:cc:dd:ee:ff", nil) - target := restoreTarget{Namespace: targetNS, AppName: "test-vm", AppKind: "VMInstance", IsCopy: true} - - reconciler := newTestRestoreJobReconciler(t, restoreJob, backup) - ctx := context.Background() - - cm, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts) - if err != nil { - t.Fatalf("createResourceModifiersConfigMap() error = %v", err) - } - - rulesYAML := cm.Data["resource-modifier-rules.yaml"] - - // Should contain PVC adoption annotation - if !containsString(rulesYAML, cdiAllowClaimAdoption) { - t.Error("expected PVC adoption annotation in rules") - } - // Should contain merge patch nulling out selector and volumeName (copy restore) - if !containsString(rulesYAML, "selector: null") { - t.Error("expected selector: null merge patch for copy restore") - } - if !containsString(rulesYAML, "volumeName: null") { - t.Error("expected volumeName: null merge patch for copy restore") - } - // Should NOT contain OVN annotations (keepOriginalIpAndMac=false) - if containsString(rulesYAML, ovnIPAnnotation) { - t.Error("OVN IP annotation should not be present when keepOriginalIpAndMac=false") - } -} - -func TestCreateResourceModifiersConfigMap_AlreadyExists_IsIdempotent(t *testing.T) { - ns := "tenant-root" - restoreJob := makeTestRestoreJob(ns, "rj-idem") - backup := makeTestBackup(ns, "test-vm", "VMInstance") - - target := restoreTarget{Namespace: ns, AppName: "test-vm", AppKind: "VMInstance", IsCopy: false} - opts := RestoreOptions{} - ur := makeVMInstanceUR("", "", nil) - - reconciler := newTestRestoreJobReconciler(t, restoreJob, backup) - ctx := context.Background() - - // First call creates the ConfigMap. - cm1, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts) - if err != nil { - t.Fatalf("first call error = %v", err) - } - - // Second call must not error (AlreadyExists → update path). - cm2, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts) - if err != nil { - t.Fatalf("second call error = %v", err) - } - if cm1.Name != cm2.Name { - t.Errorf("ConfigMap name changed: %q → %q", cm1.Name, cm2.Name) - } -} - -// --- helmReleaseNameForApp tests --- - -func TestHelmReleaseNameForApp(t *testing.T) { - tests := []struct { - kind, name, want string - }{ - {vmInstanceKind, "test-alpine", "vm-instance-test-alpine"}, - {vmDiskAppKind, "ubuntu-source", "vm-disk-ubuntu-source"}, - {"MariaDB", "mydb", ""}, - } - for _, tt := range tests { - t.Run(tt.kind+"/"+tt.name, func(t *testing.T) { - got := helmReleaseNameForApp(tt.kind, tt.name) - if got != tt.want { - t.Errorf("helmReleaseNameForApp(%q, %q) = %q, want %q", tt.kind, tt.name, got, tt.want) - } - }) - } -} - -func TestTargetHelmReleaseExists_VMDisk(t *testing.T) { - ns := "tenant-copy" - hr := makeUnstructuredHelmRelease("vm-disk-ubuntu-source", ns, nil) - - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"}, - } - backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}} - - reconciler := newTestRestoreJobReconcilerWithDynamic(t, []runtime.Object{hr}, restoreJob, backup) - ctx := context.Background() - - hrName := helmReleaseNameForApp(vmDiskAppKind, "ubuntu-source") - exists, err := reconciler.targetHelmReleaseExists(ctx, vmDiskAppKind, hrName, ns) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !exists { - t.Error("expected exists=true for VMDisk HelmRelease") - } -} - -func TestTargetHelmReleaseExists_UnsupportedKind_ReturnsFalse(t *testing.T) { - restoreJob := &backupsv1alpha1.RestoreJob{ - ObjectMeta: metav1.ObjectMeta{Name: "rj", Namespace: "tenant-root"}, - } - backup := &backupsv1alpha1.Backup{ObjectMeta: metav1.ObjectMeta{Name: "bk", Namespace: "tenant-root"}} - - reconciler := newTestRestoreJobReconcilerWithDynamic(t, nil, restoreJob, backup) - ctx := context.Background() - - // Unsupported kinds produce empty hrName which returns false - hrName := helmReleaseNameForApp("MariaDB", "mydb") - exists, err := reconciler.targetHelmReleaseExists(ctx, "MariaDB", hrName, "tenant-copy") - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if exists { - t.Error("expected exists=false for unsupported kind") - } -} - -// --- ResourceModifier merge patch test for copy restore --- - -func TestCreateResourceModifiersConfigMap_Copy_UsesMergePatchForPVC(t *testing.T) { - sourceNS := "tenant-root" - targetNS := "tenant-copy" - restoreJob := makeTestRestoreJob(sourceNS, "rj-copy-merge") - backup := makeTestBackup(sourceNS, "test-vm", "VMInstance") - - opts := RestoreOptions{KeepOriginalIpAndMac: boolPtr(false)} - ur := makeVMInstanceUR("", "", nil) - target := restoreTarget{Namespace: targetNS, AppName: "test-vm", AppKind: "VMInstance", IsCopy: true} - - reconciler := newTestRestoreJobReconciler(t, restoreJob, backup) - ctx := context.Background() - - cm, err := reconciler.createResourceModifiersConfigMap(ctx, restoreJob, backup, ur, target, opts) - if err != nil { - t.Fatalf("createResourceModifiersConfigMap() error = %v", err) - } - - rulesYAML := cm.Data["resource-modifier-rules.yaml"] - - // Should use merge patch (patchData with null), NOT JSON patch (operation: remove) - if containsString(rulesYAML, "operation: remove") { - t.Error("should use merge patch instead of JSON Patch remove for PVC fields") - } - // The merge patch should null out selector and volumeName - if !containsString(rulesYAML, "selector: null") { - t.Error("expected selector: null in merge patch") - } - if !containsString(rulesYAML, "volumeName: null") { - t.Error("expected volumeName: null in merge patch") - } -} - -// containsString reports whether substr appears in s. -func containsString(s, substr string) bool { - if len(substr) == 0 || len(s) < len(substr) { - return false - } - for i := 0; i <= len(s)-len(substr); i++ { - if s[i:i+len(substr)] == substr { - return true - } - } - return false -} diff --git a/internal/controller/dashboard/customformsoverride.go b/internal/controller/dashboard/customformsoverride.go index 0a20ae71..e06ca909 100644 --- a/internal/controller/dashboard/customformsoverride.go +++ b/internal/controller/dashboard/customformsoverride.go @@ -61,9 +61,6 @@ func (m *Manager) ensureCustomFormsOverride(ctx context.Context, crd *cozyv1alph // Override specific fields with API-backed dropdowns (listInput type) applyListInputOverrides(schema, kind, openAPIProps) - // Hide deprecated fields from the UI - hidden = append(hidden, hiddenDeprecatedFields(kind)...) - spec := map[string]any{ "customizationId": customizationID, "hidden": hidden, @@ -141,10 +138,7 @@ func (m *Manager) ensureCFOMapping(ctx context.Context, crd *cozyv1alpha1.Applic } // buildMultilineStringSchema parses OpenAPI schema and creates schema with multilineString -// for all string fields inside spec that don't have enum. -// It handles two structures: -// - properties.spec.properties (most resources) -// - properties.properties (VMDisk and similar resources without spec wrapper) +// for all string fields inside spec that don't have enum func buildMultilineStringSchema(openAPISchema string) (map[string]any, error) { if openAPISchema == "" { return map[string]any{}, nil @@ -164,25 +158,15 @@ func buildMultilineStringSchema(openAPISchema string) (map[string]any, error) { "properties": map[string]any{}, } - var specProps map[string]any - var hasSpec bool - - // First try to find properties under spec - if specProp, ok := props["spec"].(map[string]any); ok { - specProps, hasSpec = specProp["properties"].(map[string]any) + // Check if there's a spec property + specProp, ok := props["spec"].(map[string]any) + if !ok { + return map[string]any{}, nil } - // If no spec wrapper, use top-level properties directly (VMDisk pattern) - if !hasSpec { - specProps = props - // Still wrap in spec for consistency with applyListInputOverrides - schemaProps := schema["properties"].(map[string]any) - specSchema := map[string]any{ - "properties": map[string]any{}, - } - schemaProps["spec"] = specSchema - processSpecProperties(specProps, specSchema["properties"].(map[string]any)) - return schema, nil + specProps, ok := specProp["properties"].(map[string]any) + if !ok { + return map[string]any{}, nil } // Create spec.properties structure in schema @@ -232,57 +216,11 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma }, } - // Override networks[].name to be an API-backed dropdown listing NetworkAttachmentDefinitions - networksItemProps := ensureArrayItemProps(specProps, "networks") - networksItemProps["name"] = map[string]any{ - "type": "listInput", - "customProps": map[string]any{ - "valueUri": "/api/clusters/{cluster}/k8s/apis/k8s.cni.cncf.io/v1/namespaces/{namespace}/network-attachment-definitions", - "keysToValue": []any{"metadata", "name"}, - "keysToLabel": []any{"metadata", "name"}, - }, - } - case "ClickHouse", "Harbor", "HTTPCache", "Kubernetes", "MariaDB", "MongoDB", - "NATS", "OpenBAO", "Postgres", "Qdrant", "RabbitMQ", "Redis": + "NATS", "OpenBAO", "Postgres", "Qdrant", "RabbitMQ", "Redis", "VMDisk": specProps := ensureSchemaPath(schema, "spec") specProps["storageClass"] = storageClassListInput() - case "VMDisk": - specProps := ensureSchemaPath(schema, "spec") - specProps["storageClass"] = storageClassListInput() - - // Override source.image.name to be an API-backed dropdown listing default images - if sourceObj, ok := specProps["source"].(map[string]any); ok { - if imgProps, ok := sourceObj["properties"].(map[string]any); ok { - if imgName, ok := imgProps["image"].(map[string]any); ok { - if imgNameProps, ok := imgName["properties"].(map[string]any); ok { - imgNameProps["name"] = map[string]any{ - "type": "listInput", - "customProps": map[string]any{ - "valueUri": "/api/clusters/{cluster}/k8s/apis/cdi.kubevirt.io/v1beta1/namespaces/cozy-public/datavolumes", - "keysToValue": []any{"metadata", "annotations", "vm-default-images.cozystack.io/name"}, - "keysToLabel": []any{"metadata", "annotations", "vm-default-images.cozystack.io/description"}, - }, - } - } - } - // Override source.disk.name to be an API-backed dropdown listing VMDisk resources - if diskName, ok := imgProps["disk"].(map[string]any); ok { - if diskNameProps, ok := diskName["properties"].(map[string]any); ok { - diskNameProps["name"] = map[string]any{ - "type": "listInput", - "customProps": map[string]any{ - "valueUri": "/api/clusters/{cluster}/k8s/apis/apps.cozystack.io/v1alpha1/namespaces/{namespace}/vmdisks", - "keysToValue": []any{"metadata", "name"}, - "keysToLabel": []any{"metadata", "name"}, - }, - } - } - } - } - } - case "FoundationDB": storageProps := ensureSchemaPath(schema, "spec", "storage") storageProps["storageClass"] = storageClassListInput() @@ -292,25 +230,9 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma kafkaProps["storageClass"] = storageClassListInput() zkProps := ensureSchemaPath(schema, "spec", "zookeeper") zkProps["storageClass"] = storageClassListInput() - - case "Tenant": - specProps := ensureSchemaPath(schema, "spec") - specProps["schedulingClass"] = schedulingClassListInput() } } -// hiddenDeprecatedFields returns hidden paths for deprecated fields that should not -// appear in the dashboard UI for the given kind. -func hiddenDeprecatedFields(kind string) []any { - switch kind { - case "VMInstance": - return []any{ - []any{"spec", "subnets"}, - } - } - return nil -} - // storageClassListInput returns a listInput field config for a storageClass dropdown // backed by the cluster's available StorageClasses. func storageClassListInput() map[string]any { @@ -324,20 +246,6 @@ func storageClassListInput() map[string]any { } } -// schedulingClassListInput returns a listInput field config for a schedulingClass dropdown -// backed by the cluster's available SchedulingClass CRs. -func schedulingClassListInput() map[string]any { - return map[string]any{ - "type": "listInput", - "customProps": map[string]any{ - "valueUri": "/api/clusters/{cluster}/k8s/apis/cozystack.io/v1alpha1/schedulingclasses", - "keysToValue": []any{"metadata", "name"}, - "keysToLabel": []any{"metadata", "name"}, - "allowEmpty": true, - }, - } -} - // ensureArrayItemProps ensures that parentProps[fieldName].items.properties exists // and returns the items properties map. Used for overriding fields inside array items. func ensureArrayItemProps(parentProps map[string]any, fieldName string) map[string]any { diff --git a/internal/controller/dashboard/customformsoverride_test.go b/internal/controller/dashboard/customformsoverride_test.go index 6a83d62e..d0a34abc 100644 --- a/internal/controller/dashboard/customformsoverride_test.go +++ b/internal/controller/dashboard/customformsoverride_test.go @@ -234,56 +234,6 @@ func TestApplyListInputOverrides_VMInstance(t *testing.T) { if diskCustomProps["valueUri"] != expectedDiskURI { t.Errorf("expected disks valueUri %s, got %v", expectedDiskURI, diskCustomProps["valueUri"]) } - - // Check networks[].name is a listInput - networks, ok := specProps["networks"].(map[string]any) - if !ok { - t.Fatal("networks not found in schema.properties.spec.properties") - } - netItems, ok := networks["items"].(map[string]any) - if !ok { - t.Fatal("networks.items not found") - } - netItemProps, ok := netItems["properties"].(map[string]any) - if !ok { - t.Fatal("networks.items.properties not found") - } - netName, ok := netItemProps["name"].(map[string]any) - if !ok { - t.Fatal("networks.items.properties.name not found") - } - if netName["type"] != "listInput" { - t.Errorf("expected networks name type listInput, got %v", netName["type"]) - } - netCustomProps, ok := netName["customProps"].(map[string]any) - if !ok { - t.Fatal("networks name customProps not found") - } - expectedNetURI := "/api/clusters/{cluster}/k8s/apis/k8s.cni.cncf.io/v1/namespaces/{namespace}/network-attachment-definitions" - if netCustomProps["valueUri"] != expectedNetURI { - t.Errorf("expected networks valueUri %s, got %v", expectedNetURI, netCustomProps["valueUri"]) - } -} - -func TestHiddenDeprecatedFields_VMInstance(t *testing.T) { - hidden := hiddenDeprecatedFields("VMInstance") - if len(hidden) != 1 { - t.Fatalf("expected 1 hidden path, got %d", len(hidden)) - } - path, ok := hidden[0].([]any) - if !ok { - t.Fatal("hidden path is not []any") - } - if len(path) != 2 || path[0] != "spec" || path[1] != "subnets" { - t.Errorf("expected [spec subnets], got %v", path) - } -} - -func TestHiddenDeprecatedFields_UnknownKind(t *testing.T) { - hidden := hiddenDeprecatedFields("SomeOtherKind") - if hidden != nil { - t.Errorf("expected nil for unknown kind, got %v", hidden) - } } func TestApplyListInputOverrides_StorageClassSimple(t *testing.T) { @@ -317,108 +267,6 @@ func TestApplyListInputOverrides_StorageClassFoundationDB(t *testing.T) { assertStorageClassListInput(t, sc) } -func TestApplyListInputOverrides_VMDisk_SourceFields(t *testing.T) { - openAPISchema := `{ - "properties":{ - "optical":{"type":"boolean"}, - "source":{ - "type":"object", - "properties":{ - "image":{ - "type":"object", - "properties":{ - "name":{"type":"string"} - } - }, - "disk":{ - "type":"object", - "properties":{ - "name":{"type":"string"} - } - } - } - }, - "storage":{"type":"string"}, - "storageClass":{"type":"string"} - } - }` - - schema, err := buildMultilineStringSchema(openAPISchema) - if err != nil { - t.Fatalf("buildMultilineStringSchema failed: %v", err) - } - - applyListInputOverrides(schema, "VMDisk", map[string]any{}) - - specProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any) - - // Check storageClass - sc, ok := specProps["storageClass"].(map[string]any) - if !ok { - t.Fatal("storageClass not found in spec.properties") - } - assertStorageClassListInput(t, sc) - - // Check source.image.name listInput - // Structure: specProps["source"]["properties"]["image"]["properties"]["name"] - sourceObj, ok := specProps["source"].(map[string]any) - if !ok { - t.Fatal("source not found in spec.properties") - } - sourceObjProps, ok := sourceObj["properties"].(map[string]any) - if !ok { - t.Fatal("source.properties not found") - } - imageObj, ok := sourceObjProps["image"].(map[string]any) - if !ok { - t.Fatal("image not found in source.properties") - } - imageObjProps, ok := imageObj["properties"].(map[string]any) - if !ok { - t.Fatal("image.properties not found") - } - imgName, ok := imageObjProps["name"].(map[string]any) - if !ok { - t.Fatal("name not found in image.properties") - } - if imgName["type"] != "listInput" { - t.Errorf("expected type listInput, got %v", imgName["type"]) - } - imgNameCustomProps, ok := imgName["customProps"].(map[string]any) - if !ok { - t.Fatal("name.customProps not found") - } - expectedImageURI := "/api/clusters/{cluster}/k8s/apis/cdi.kubevirt.io/v1beta1/namespaces/cozy-public/datavolumes" - if imgNameCustomProps["valueUri"] != expectedImageURI { - t.Errorf("expected valueUri %s, got %v", expectedImageURI, imgNameCustomProps["valueUri"]) - } - - // Check source.disk.name listInput - diskObj, ok := sourceObjProps["disk"].(map[string]any) - if !ok { - t.Fatal("disk not found in source.properties") - } - diskObjProps, ok := diskObj["properties"].(map[string]any) - if !ok { - t.Fatal("disk.properties not found") - } - diskName, ok := diskObjProps["name"].(map[string]any) - if !ok { - t.Fatal("name not found in disk.properties") - } - if diskName["type"] != "listInput" { - t.Errorf("expected type listInput, got %v", diskName["type"]) - } - diskNameCustomProps, ok := diskName["customProps"].(map[string]any) - if !ok { - t.Fatal("disk name.customProps not found") - } - expectedDiskURI := "/api/clusters/{cluster}/k8s/apis/apps.cozystack.io/v1alpha1/namespaces/{namespace}/vmdisks" - if diskNameCustomProps["valueUri"] != expectedDiskURI { - t.Errorf("expected valueUri %s, got %v", expectedDiskURI, diskNameCustomProps["valueUri"]) - } -} - func TestApplyListInputOverrides_StorageClassKafka(t *testing.T) { schema := map[string]any{} applyListInputOverrides(schema, "Kafka", map[string]any{}) diff --git a/internal/controller/dashboard/factory.go b/internal/controller/dashboard/factory.go index fe0cadfd..539e503b 100644 --- a/internal/controller/dashboard/factory.go +++ b/internal/controller/dashboard/factory.go @@ -47,7 +47,6 @@ func (m *Manager) ensureFactory(ctx context.Context, crd *cozyv1alpha1.Applicati if prefix, ok := vncTabPrefix(kind); ok { tabs = append(tabs, vncTab(prefix)) } - tabs = append(tabs, eventsTab(kind)) tabs = append(tabs, yamlTab(g, v, plural)) // Use unified factory creation @@ -359,37 +358,6 @@ func secretsTab(kind string) map[string]any { } } -// eventsTab shows Kubernetes Events scoped to the application's namespace. -// Events are namespace-scoped because Kubernetes Events don't carry application -// labels and cannot be filtered by label selector. In Cozystack's multi-tenancy -// model, each tenant namespace maps to a single application scope, so namespace -// filtering provides the correct event scope. -// For Tenant applications, events are fetched from status.namespace (the tenant's -// own namespace) instead of the parent namespace where the Tenant object lives. -func eventsTab(kind string) map[string]any { - nsPlaceholder := "{3}" - if kind == "Tenant" { - nsPlaceholder = "{reqsJsonPath[0]['.status.namespace']}" - } - return map[string]any{ - "key": "events", - "label": "Events", - "children": []any{ - map[string]any{ - "type": "EnrichedTable", - "data": map[string]any{ - "id": "events-table", - "fetchUrl": "/api/clusters/{2}/k8s/api/v1/namespaces/" + nsPlaceholder + "/events", - "cluster": "{2}", - "baseprefix": "/openapi-ui", - "customizationId": "factory-details-events", - "pathToItems": []any{"items"}, - }, - }, - }, - } -} - func yamlTab(group, version, plural string) map[string]any { return map[string]any{ "key": "yaml", diff --git a/internal/controller/dashboard/factory_test.go b/internal/controller/dashboard/factory_test.go deleted file mode 100644 index b3742564..00000000 --- a/internal/controller/dashboard/factory_test.go +++ /dev/null @@ -1,60 +0,0 @@ -package dashboard - -import ( - "testing" -) - -func TestEventsTab_Structure(t *testing.T) { - tab := eventsTab("PostgreSQL") - - if tab["key"] != "events" { - t.Errorf("expected key=events, got %v", tab["key"]) - } - if tab["label"] != "Events" { - t.Errorf("expected label=Events, got %v", tab["label"]) - } - - children, ok := tab["children"].([]any) - if !ok || len(children) != 1 { - t.Fatal("expected exactly 1 child in events tab") - } - - table, ok := children[0].(map[string]any) - if !ok { - t.Fatal("child is not a map") - } - if table["type"] != "EnrichedTable" { - t.Errorf("expected type=EnrichedTable, got %v", table["type"]) - } - - data, ok := table["data"].(map[string]any) - if !ok { - t.Fatal("table data is not a map") - } - if data["id"] != "events-table" { - t.Errorf("expected id=events-table, got %v", data["id"]) - } - if data["fetchUrl"] != "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/events" { - t.Errorf("unexpected fetchUrl for non-Tenant: %v", data["fetchUrl"]) - } - if data["customizationId"] != "factory-details-events" { - t.Errorf("expected customizationId=factory-details-events, got %v", data["customizationId"]) - } - - pathToItems, ok := data["pathToItems"].([]any) - if !ok || len(pathToItems) != 1 || pathToItems[0] != "items" { - t.Errorf("expected pathToItems=[items], got %v", data["pathToItems"]) - } -} - -func TestEventsTab_TenantUsesStatusNamespace(t *testing.T) { - tab := eventsTab("Tenant") - children := tab["children"].([]any) - table := children[0].(map[string]any) - data := table["data"].(map[string]any) - - expectedURL := "/api/clusters/{2}/k8s/api/v1/namespaces/{reqsJsonPath[0]['.status.namespace']}/events" - if data["fetchUrl"] != expectedURL { - t.Errorf("expected Tenant fetchUrl to use status.namespace, got %v", data["fetchUrl"]) - } -} diff --git a/internal/controller/dashboard/sidebar.go b/internal/controller/dashboard/sidebar.go index 69c933fb..90721b3d 100644 --- a/internal/controller/dashboard/sidebar.go +++ b/internal/controller/dashboard/sidebar.go @@ -144,9 +144,6 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati // Add sidebar for backups.cozystack.io Backup resource keysAndTags["backups"] = []any{"backup-sidebar"} - // Add sidebar for backups.cozystack.io RestoreJob resource - keysAndTags["restorejobs"] = []any{"restorejob-sidebar"} - // 3) Sort items within each category by Weight (desc), then Label (A→Z) for cat := range categories { sort.Slice(categories[cat], func(i, j int) bool { @@ -218,11 +215,6 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati "label": "Backups", "link": "/openapi-ui/{cluster}/{namespace}/api-table/backups.cozystack.io/v1alpha1/backups", }, - map[string]any{ - "key": "restorejobs", - "label": "RestoreJobs", - "link": "/openapi-ui/{cluster}/{namespace}/api-table/backups.cozystack.io/v1alpha1/restorejobs", - }, }, }) @@ -266,7 +258,6 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati "stock-project-factory-plan-details", "stock-project-factory-backupjob-details", "stock-project-factory-backup-details", - "stock-project-factory-restorejob-details", "stock-project-factory-external-ips", "stock-project-api-form", "stock-project-api-table", @@ -281,12 +272,7 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati "stock-instance-builtin-table", } - // Add details sidebars for all CRDs with dashboard config, and collect - // the set of IDs that are genuinely CRD-backed (dynamic). The hardcoded - // `-details` IDs above (e.g. kube-* and backup/backupjob/plan/restorejob) - // are not tied to an ApplicationDefinition and must be treated as static - // so they receive consistent labels via upsertMultipleSidebars(). - dynamicDetailsIDs := map[string]bool{} + // Add details sidebars for all CRDs with dashboard config for i := range all { def := &all[i] if def.Spec.Dashboard == nil { @@ -296,22 +282,17 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati lowerKind := strings.ToLower(kind) detailsID := fmt.Sprintf("stock-project-factory-%s-details", lowerKind) targetIDs = append(targetIDs, detailsID) - dynamicDetailsIDs[detailsID] = true } // 7) Upsert all target sidebars with identical menuItems and keysAndTags - return m.upsertMultipleSidebars(ctx, crd, targetIDs, dynamicDetailsIDs, keysAndTags, menuItems) + return m.upsertMultipleSidebars(ctx, crd, targetIDs, keysAndTags, menuItems) } // upsertMultipleSidebars creates/updates several Sidebar resources with the same menu spec. -// dynamicDetailsIDs identifies `stock-project-factory--details` sidebars that are -// backed by an ApplicationDefinition and should therefore be owned by that CRD. -// Any other ID is treated as a static sidebar (managed-by labels, no owner ref). func (m *Manager) upsertMultipleSidebars( ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition, ids []string, - dynamicDetailsIDs map[string]bool, keysAndTags map[string]any, menuItems []any, ) error { @@ -327,10 +308,8 @@ func (m *Manager) upsertMultipleSidebars( if _, err := controllerutil.CreateOrUpdate(ctx, m.Client, obj, func() error { // Only set owner reference for dynamic sidebars (stock-project-factory-{kind}-details) - // that are actually backed by an ApplicationDefinition. Static sidebars — including - // hardcoded details sidebars for built-in/backup resources — must fall through to the - // static-label branch so they're managed consistently. - if strings.HasPrefix(id, "stock-project-factory-") && strings.HasSuffix(id, "-details") && dynamicDetailsIDs[id] { + // Static sidebars (stock-instance-*, stock-project-*) should not have owner references + if strings.HasPrefix(id, "stock-project-factory-") && strings.HasSuffix(id, "-details") { // This is a dynamic sidebar, set owner reference only if it matches the current CRD _, _, kind := pickGVK(crd) lowerKind := strings.ToLower(kind) diff --git a/internal/controller/dashboard/static_helpers.go b/internal/controller/dashboard/static_helpers.go index db37e05b..1a1018cb 100644 --- a/internal/controller/dashboard/static_helpers.go +++ b/internal/controller/dashboard/static_helpers.go @@ -650,31 +650,12 @@ func createStringColumn(name, jsonPath string) map[string]any { } } -// createTimestampColumn creates a timestamp column with custom formatting. -// Extra jsonPaths act as ordered fallbacks: the first non-null path wins, -// and `-` is used only when every path is null. Depth is capped at two -// because the template parser's non-greedy matcher cannot track more than -// one level of alternating quotes in a nested reqsJsonPath fallback. -func createTimestampColumn(name string, jsonPaths ...string) map[string]any { - if len(jsonPaths) == 0 { - panic("createTimestampColumn requires at least one jsonPath") - } - if len(jsonPaths) > 2 { - panic("createTimestampColumn supports at most two jsonPaths (primary + one fallback)") - } - - var text string - switch len(jsonPaths) { - case 1: - text = "{reqsJsonPath[0]['" + jsonPaths[0] + "']['-']}" - case 2: - text = "{reqsJsonPath[0]['" + jsonPaths[0] + "'][\"{reqsJsonPath[0]['" + jsonPaths[1] + "']['-']}\"]}" - } - +// createTimestampColumn creates a timestamp column with custom formatting +func createTimestampColumn(name, jsonPath string) map[string]any { return map[string]any{ "name": name, "type": "factory", - "jsonPath": jsonPaths[0], + "jsonPath": jsonPath, "customProps": map[string]any{ "disableEventBubbling": true, "items": []any{ @@ -692,7 +673,7 @@ func createTimestampColumn(name string, jsonPaths ...string) map[string]any { "data": map[string]any{ "formatter": "timestamp", "id": "time-value", - "text": text, + "text": "{reqsJsonPath[0]['" + jsonPath + "']['-']}", }, }, }, diff --git a/internal/controller/dashboard/static_refactored.go b/internal/controller/dashboard/static_refactored.go index 9f28c0fb..06c4239f 100644 --- a/internal/controller/dashboard/static_refactored.go +++ b/internal/controller/dashboard/static_refactored.go @@ -224,20 +224,6 @@ func CreateAllCustomColumnsOverrides() []*dashboardv1alpha1.CustomColumnsOverrid createStringColumn("Name", ".name"), }), - // Factory details events. Event Time falls back to `.firstTimestamp` - // because core/v1 Events (Helm, controller-runtime) populate only the - // legacy timestamps while events.k8s.io/v1 Events populate only - // `.eventTime`; taking the first non-null of the two covers both. - createCustomColumnsOverride("factory-details-events", []any{ - createTimestampColumn("Last Seen", ".lastTimestamp", ".eventTime"), - createTimestampColumn("Event Time", ".eventTime", ".firstTimestamp"), - createStringColumn("Type", ".type"), - createStringColumn("Reason", ".reason"), - createStringColumn("Object", ".involvedObject.kind"), - createStringColumn("Name", ".involvedObject.name"), - createStringColumn("Message", ".message"), - }), - // Factory status conditions createCustomColumnsOverride("factory-status-conditions", []any{ createStringColumn("Type", ".type"), @@ -425,14 +411,6 @@ func CreateAllCustomColumnsOverrides() []*dashboardv1alpha1.CustomColumnsOverrid createTimestampColumn("Taken At", ".spec.takenAt"), createTimestampColumn("Created", ".metadata.creationTimestamp"), }), - - // Stock namespace backups cozystack io v1alpha1 restorejobs - createCustomColumnsOverride("stock-namespace-/backups.cozystack.io/v1alpha1/restorejobs", []any{ - createCustomColumnWithJsonPath("Name", ".metadata.name", "RestoreJob", "", "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/restorejob-details/{reqsJsonPath[0]['.metadata.name']['-']}"), - createStringColumn("Phase", ".status.phase"), - createStringColumn("Backup", ".spec.backupRef.name"), - createTimestampColumn("Created", ".metadata.creationTimestamp"), - }), } } @@ -555,31 +533,6 @@ func CreateAllCustomFormsOverrides() []*dashboardv1alpha1.CustomFormsOverride { "backupClassName": listInputScemaItemBackupClass(), }), }), - - // RestoreJobs form override - backups.cozystack.io/v1alpha1 - createCustomFormsOverride("default-/backups.cozystack.io/v1alpha1/restorejobs", map[string]any{ - "formItems": []any{ - createFormItem("metadata.name", "Name", "text"), - createFormItem("metadata.namespace", "Namespace", "text"), - createFormItem("spec.backupRef.name", "Backup", "text"), - // Target application: leave empty to restore into the same application - // as referenced by the selected Backup. Fill all three to restore into - // a different application (e.g. rename, or restore into a new target). - createFormItem("spec.targetApplicationRef.apiGroup", "Target Application API Group (optional, used to restore into a different application)", "text"), - createFormItem("spec.targetApplicationRef.kind", "Target Application Kind (optional, used to restore into a different application)", "text"), - createFormItem("spec.targetApplicationRef.name", "Target Application Name (optional, used to restore into a different application)", "text"), - // Driver-specific options (key-value editor). Refer to the backup driver - // documentation for supported keys. - createFormItem("spec.options", "Options (driver-specific key/value pairs)", "object"), - }, - "schema": createSchema(map[string]any{ - "backupRef": map[string]any{ - "properties": map[string]any{ - "name": listInputSchemaItemBackup(), - }, - }, - }), - }), } } @@ -1970,177 +1923,6 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory { } backupSpec := createUnifiedFactory(backupConfig, backupTabs, []any{"/api/clusters/{2}/k8s/apis/backups.cozystack.io/v1alpha1/namespaces/{3}/backups/{6}"}) - // RestoreJob details factory using unified approach - restoreJobConfig := UnifiedResourceConfig{ - Name: "restorejob-details", - ResourceType: "factory", - Kind: "RestoreJob", - Plural: "restorejobs", - Title: "restorejob", - } - restoreJobTabs := []any{ - map[string]any{ - "key": "details", - "label": "Details", - "children": []any{ - contentCard("details-card", map[string]any{ - "marginBottom": "24px", - }, []any{ - antdText("details-title", true, "RestoreJob details", map[string]any{ - "fontSize": 20, - "marginBottom": "12px", - }), - spacer("details-spacer", 16), - antdRow("details-grid", []any{48, 12}, []any{ - antdCol("col-left", 12, []any{ - antdFlexVertical("col-left-stack", 24, []any{ - antdFlexVertical("meta-name-block", 4, []any{ - antdText("meta-name-label", true, "Name", nil), - parsedText("meta-name-value", "{reqsJsonPath[0]['.metadata.name']['-']}", nil), - }), - antdFlexVertical("meta-namespace-block", 8, []any{ - antdText("meta-namespace-label", true, "Namespace", nil), - antdFlex("header-row", 6, []any{ - map[string]any{ - "type": "antdText", - "data": map[string]any{ - "id": "header-badge", - "text": "NS", - "title": "namespace", - "style": map[string]any{ - "backgroundColor": "#a25792ff", - "borderRadius": "20px", - "color": "#fff", - "display": "inline-block", - "fontFamily": "RedHatDisplay, Overpass, overpass, helvetica, arial, sans-serif", - "fontSize": "15px", - "fontWeight": 400, - "lineHeight": "24px", - "minWidth": 24, - "padding": "0 9px", - "textAlign": "center", - "whiteSpace": "nowrap", - }, - }, - }, - map[string]any{ - "type": "antdLink", - "data": map[string]any{ - "id": "namespace-link", - "text": "{reqsJsonPath[0]['.metadata.namespace']['-']}", - "href": "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/marketplace", - }, - }, - }), - }), - antdFlexVertical("meta-created-block", 4, []any{ - antdText("created-time-label", true, "Created", nil), - antdFlex("created-time-block", 6, []any{ - map[string]any{ - "type": "antdText", - "data": map[string]any{ - "id": "created-time-icon", - "text": "🌐", - }, - }, - map[string]any{ - "type": "parsedText", - "data": map[string]any{ - "formatter": "timestamp", - "id": "created-time-value", - "text": "{reqsJsonPath[0]['.metadata.creationTimestamp']['-']}", - }, - }, - }), - }), - }), - }), - antdCol("col-right", 12, []any{ - antdFlexVertical("col-right-stack", 24, []any{ - antdFlexVertical("status-phase-block", 4, []any{ - antdText("phase-label", true, "Phase", nil), - parsedText("phase-value", "{reqsJsonPath[0]['.status.phase']['-']}", nil), - }), - antdFlexVertical("spec-backup-ref-block", 4, []any{ - antdText("backup-ref-label", true, "Backup Ref", nil), - parsedText("backup-ref-value", "{reqsJsonPath[0]['.spec.backupRef.name']['-']}", nil), - }), - antdFlexVertical("spec-target-application-ref-block", 4, []any{ - antdText("target-application-ref-label", true, "Target Application", nil), - // targetApplicationRef is optional — when absent, the restore targets - // the same application as the selected Backup. Show a single friendly - // fallback in that case instead of rendering "-.-/-". - parsedText("target-application-ref-value", "{reqsJsonPath[0]['.spec.targetApplicationRef.name']['Same as backup']}", nil), - }), - antdFlexVertical("spec-options-target-namespace-block", 4, []any{ - antdText("options-target-namespace-label", true, "Target Namespace", nil), - parsedText("options-target-namespace-value", "{reqsJsonPath[0]['.spec.options.targetNamespace']['-']}", nil), - }), - antdFlexVertical("spec-options-fail-if-target-exists-block", 4, []any{ - antdText("options-fail-if-target-exists-label", true, "Fail If Target Exists", nil), - parsedText("options-fail-if-target-exists-value", "{reqsJsonPath[0]['.spec.options.failIfTargetExists']['-']}", nil), - }), - antdFlexVertical("spec-options-keep-original-pvc-block", 4, []any{ - antdText("options-keep-original-pvc-label", true, "Keep Original PVC", nil), - parsedText("options-keep-original-pvc-value", "{reqsJsonPath[0]['.spec.options.keepOriginalPVC']['-']}", nil), - }), - antdFlexVertical("spec-options-keep-original-ip-mac-block", 4, []any{ - antdText("options-keep-original-ip-mac-label", true, "Keep Original IP/MAC", nil), - parsedText("options-keep-original-ip-mac-value", "{reqsJsonPath[0]['.spec.options.keepOriginalIpAndMac']['-']}", nil), - }), - antdFlexVertical("status-started-at-block", 4, []any{ - antdText("started-at-label", true, "Started At", nil), - antdFlex("started-at-time-block", 6, []any{ - map[string]any{ - "type": "antdText", - "data": map[string]any{ - "id": "started-at-time-icon", - "text": "🌐", - }, - }, - map[string]any{ - "type": "parsedText", - "data": map[string]any{ - "formatter": "timestamp", - "id": "started-at-time-value", - "text": "{reqsJsonPath[0]['.status.startedAt']['-']}", - }, - }, - }), - }), - antdFlexVertical("status-completed-at-block", 4, []any{ - antdText("completed-at-label", true, "Completed At", nil), - antdFlex("completed-at-time-block", 6, []any{ - map[string]any{ - "type": "antdText", - "data": map[string]any{ - "id": "completed-at-time-icon", - "text": "🌐", - }, - }, - map[string]any{ - "type": "parsedText", - "data": map[string]any{ - "formatter": "timestamp", - "id": "completed-at-time-value", - "text": "{reqsJsonPath[0]['.status.completedAt']['-']}", - }, - }, - }), - }), - antdFlexVertical("status-message-block", 4, []any{ - antdText("message-label", true, "Message", nil), - parsedText("message-value", "{reqsJsonPath[0]['.status.message']['-']}", nil), - }), - }), - }), - }), - }), - }, - }, - } - restoreJobSpec := createUnifiedFactory(restoreJobConfig, restoreJobTabs, []any{"/api/clusters/{2}/k8s/apis/backups.cozystack.io/v1alpha1/namespaces/{3}/restorejobs/{6}"}) - // External IPs factory (filtered services) externalIPsTabs := []any{ map[string]any{ @@ -2193,7 +1975,6 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory { createFactory("plan-details", planSpec), createFactory("backupjob-details", backupJobSpec), createFactory("backup-details", backupSpec), - createFactory("restorejob-details", restoreJobSpec), createFactory("external-ips", externalIPsSpec), } } @@ -2213,10 +1994,9 @@ func CreateAllNavigations() []*dashboardv1alpha1.Navigation { "base-factory-namespaced-api-networking.k8s.io-v1-ingresses": "kube-ingress-details", "base-factory-namespaced-api-cozystack.io-v1alpha1-workloadmonitors": "workloadmonitor-details", // Backup resources (not ApplicationDefinitions, so ensureNavigation doesn't cover them) - "base-factory-namespaced-api-backups.cozystack.io-v1alpha1-plans": "plan-details", - "base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backupjobs": "backupjob-details", - "base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backups": "backup-details", - "base-factory-namespaced-api-backups.cozystack.io-v1alpha1-restorejobs": "restorejob-details", + "base-factory-namespaced-api-backups.cozystack.io-v1alpha1-plans": "plan-details", + "base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backupjobs": "backupjob-details", + "base-factory-namespaced-api-backups.cozystack.io-v1alpha1-backups": "backup-details", } return []*dashboardv1alpha1.Navigation{ @@ -2341,19 +2121,6 @@ func listInputScemaItemBackupClass() map[string]any { } } -// listInputSchemaItemBackup returns a listInput schema overlay for selecting a Backup -// from the current namespace (used by RestoreJob form for spec.backupRef.name). -func listInputSchemaItemBackup() map[string]any { - return map[string]any{ - "type": "listInput", - "customProps": map[string]any{ - "valueUri": "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/namespaces/{namespace}/backups", - "keysToValue": []any{"metadata", "name"}, - "keysToLabel": []any{"metadata", "name"}, - }, - } -} - // backupClassSchema returns the schema for spec.backupClassName as listInput (BackupJob/Plan). func createSchema(customProps map[string]any) map[string]any { return map[string]any{ diff --git a/internal/controller/workloadmonitor_controller.go b/internal/controller/workloadmonitor_controller.go index 35906a87..a684df9b 100644 --- a/internal/controller/workloadmonitor_controller.go +++ b/internal/controller/workloadmonitor_controller.go @@ -4,13 +4,7 @@ import ( "context" "encoding/json" "fmt" - "io" - "net/http" - "net/url" "sort" - "strconv" - "strings" - "time" apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/runtime" @@ -28,29 +22,8 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" - cosiv1alpha1 "sigs.k8s.io/container-object-storage-interface-api/apis/objectstorage/v1alpha1" ) -const ( - // namespaceMonitoringLabel is the namespace label that indicates which tenant - // namespace hosts the monitoring stack (VictoriaMetrics/Prometheus). - namespaceMonitoringLabel = "namespace.cozystack.io/monitoring" - workloadLabelPrefix = "workloads.cozystack.io/" - // workloadMonitorLabel is reserved: it names the WorkloadMonitor that owns - // the Workload and is always set by the reconciler, so it is never copied - // from monitor labels. - workloadMonitorLabel = workloadLabelPrefix + "monitor" - // vmSelectService is the well-known service name for VictoriaMetrics vmselect - // within a monitoring namespace. Port 8481, path /select/0/prometheus. - vmSelectService = "vmselect-shortterm" - vmSelectPort = "8481" - vmSelectPath = "/select/0/prometheus" -) - -// prometheusHTTPClient is a dedicated HTTP client for Prometheus queries, -// avoiding the shared http.DefaultClient global. -var prometheusHTTPClient = &http.Client{Timeout: 10 * time.Second} - // WorkloadMonitorReconciler reconciles a WorkloadMonitor object type WorkloadMonitorReconciler struct { client.Client @@ -63,13 +36,6 @@ type WorkloadMonitorReconciler struct { // +kubebuilder:rbac:groups=cozystack.io,resources=workloads/status,verbs=get;update;patch // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch // +kubebuilder:rbac:groups=core,resources=persistentvolumeclaims,verbs=get;list;watch -// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get -// +kubebuilder:rbac:groups=objectstorage.k8s.io,resources=bucketclaims,verbs=get;list;watch - -// isBucketClaimReady checks if the BucketClaim has been provisioned. -func (r *WorkloadMonitorReconciler) isBucketClaimReady(bc *cosiv1alpha1.BucketClaim) bool { - return bc.Status.BucketReady -} // isServiceReady checks if the service has an external IP bound func (r *WorkloadMonitorReconciler) isServiceReady(svc *corev1.Service) bool { @@ -135,190 +101,6 @@ func updateOwnerReferences(obj metav1.Object, monitor client.Object) { obj.SetOwnerReferences(owners) } -// resolvePrometheusURL returns the Prometheus-compatible API base URL for the given namespace. -// It reads the namespace.cozystack.io/monitoring label to find the monitoring namespace, -// then constructs the vmselect URL. Returns empty string if monitoring is not configured. -func (r *WorkloadMonitorReconciler) resolvePrometheusURL(ctx context.Context, namespace string) string { - logger := log.FromContext(ctx) - ns := &corev1.Namespace{} - if err := r.Get(ctx, types.NamespacedName{Name: namespace}, ns); err != nil { - logger.V(1).Info("Failed to read namespace for monitoring resolution", "namespace", namespace, "error", err) - return "" - } - monitoringNS := ns.Labels[namespaceMonitoringLabel] - if monitoringNS == "" { - return "" - } - return fmt.Sprintf("http://%s.%s.svc:%s%s", vmSelectService, monitoringNS, vmSelectPort, vmSelectPath) -} - -// bucketMetrics holds size metrics for a single bucket, keyed by metric name. -type bucketMetrics struct { - LogicalSize int64 - PhysicalSize int64 - HasLogical bool - HasPhysical bool -} - -// queryAllBucketMetrics fetches SeaweedFS bucket size metrics for the given -// bucket names in a single Prometheus query and returns them keyed by bucket -// name. The query is scoped to only the requested buckets to avoid fetching -// metrics for buckets belonging to other WorkloadMonitors. -func (r *WorkloadMonitorReconciler) queryAllBucketMetrics(ctx context.Context, prometheusBaseURL string, bucketNames []string) map[string]*bucketMetrics { - result := make(map[string]*bucketMetrics) - if prometheusBaseURL == "" || len(bucketNames) == 0 { - return result - } - logger := log.FromContext(ctx) - - query := fmt.Sprintf(`{__name__=~"SeaweedFS_s3_bucket_(size|physical_size)_bytes",bucket=~"%s"}`, strings.Join(bucketNames, "|")) - u, err := url.Parse(strings.TrimRight(prometheusBaseURL, "/") + "/api/v1/query") - if err != nil { - logger.Error(err, "Failed to parse Prometheus URL") - return result - } - u.RawQuery = url.Values{"query": {query}}.Encode() - - httpCtx, cancel := context.WithTimeout(ctx, 10*time.Second) - defer cancel() - - req, err := http.NewRequestWithContext(httpCtx, http.MethodGet, u.String(), nil) - if err != nil { - logger.Error(err, "Failed to create Prometheus request") - return result - } - - resp, err := prometheusHTTPClient.Do(req) - if err != nil { - logger.V(1).Info("Failed to query Prometheus for bucket metrics", "error", err) - return result - } - defer resp.Body.Close() - - if resp.StatusCode != http.StatusOK { - logger.V(1).Info("Prometheus returned non-OK status for bucket metrics", "status", resp.StatusCode) - return result - } - - body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20)) - if err != nil { - logger.Error(err, "Failed to read Prometheus response") - return result - } - - var promResp struct { - Status string `json:"status"` - Data struct { - Result []struct { - Metric map[string]string `json:"metric"` - Value [2]json.RawMessage `json:"value"` - } `json:"result"` - } `json:"data"` - } - if err := json.Unmarshal(body, &promResp); err != nil { - logger.Error(err, "Failed to parse Prometheus response") - return result - } - if promResp.Status != "success" { - return result - } - - for _, r := range promResp.Data.Result { - bucket := r.Metric["bucket"] - metricName := r.Metric["__name__"] - if bucket == "" || metricName == "" { - continue - } - - var valueStr string - if err := json.Unmarshal(r.Value[1], &valueStr); err != nil { - continue - } - val, err := strconv.ParseFloat(valueStr, 64) - if err != nil { - continue - } - - bm, ok := result[bucket] - if !ok { - bm = &bucketMetrics{} - result[bucket] = bm - } - - switch metricName { - case "SeaweedFS_s3_bucket_size_bytes": - bm.LogicalSize = int64(val) - bm.HasLogical = true - case "SeaweedFS_s3_bucket_physical_size_bytes": - bm.PhysicalSize = int64(val) - bm.HasPhysical = true - } - } - - return result -} - -// reconcileBucketClaimForMonitor creates or updates a Workload object for the given BucketClaim and WorkloadMonitor. -func (r *WorkloadMonitorReconciler) reconcileBucketClaimForMonitor( - ctx context.Context, - monitor *cozyv1alpha1.WorkloadMonitor, - bc cosiv1alpha1.BucketClaim, - allMetrics map[string]*bucketMetrics, -) error { - logger := log.FromContext(ctx) - workload := &cozyv1alpha1.Workload{ - ObjectMeta: metav1.ObjectMeta{ - Name: fmt.Sprintf("bucket-%s", bc.Name), - Namespace: bc.Namespace, - Labels: make(map[string]string, len(bc.Labels)), - }, - } - - resources := make(map[string]resource.Quantity) - - // Look up pre-fetched bucket metrics by the SeaweedFS bucket name. - // bc.Status.BucketName is the COSI Bucket name, which the COSI driver - // uses directly as the SeaweedFS bucket name. - if bm, ok := allMetrics[bc.Status.BucketName]; ok { - if bm.HasLogical { - resources["s3-storage-bytes"] = *resource.NewQuantity(bm.LogicalSize, resource.BinarySI) - } - if bm.HasPhysical { - resources["s3-physical-storage-bytes"] = *resource.NewQuantity(bm.PhysicalSize, resource.BinarySI) - } - } - - monitorLabels := r.getMonitorLabels(monitor) - _, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error { - updateOwnerReferences(workload.GetObjectMeta(), &bc) - - if workload.Labels == nil { - workload.Labels = make(map[string]string) - } - // Apply monitor-level labels first so source-object labels can override on conflict - for k, v := range monitorLabels { - workload.Labels[k] = v - } - for k, v := range bc.Labels { - workload.Labels[k] = v - } - workload.Labels[workloadMonitorLabel] = monitor.Name - - workload.Status.Kind = monitor.Spec.Kind - workload.Status.Type = monitor.Spec.Type - workload.Status.Resources = resources - workload.Status.Operational = r.isBucketClaimReady(&bc) - - return nil - }) - if err != nil { - logger.Error(err, "Failed to CreateOrUpdate Workload", "workload", workload.Name) - return err - } - - return nil -} - // reconcileServiceForMonitor creates or updates a Workload object for the given Service and WorkloadMonitor. func (r *WorkloadMonitorReconciler) reconcileServiceForMonitor( ctx context.Context, @@ -355,22 +137,14 @@ func (r *WorkloadMonitorReconciler) reconcileServiceForMonitor( resourceLabel = fmt.Sprintf("%s.ipaddresspool.metallb.io/requests.ipaddresses", resourceLabel) resources[resourceLabel] = quantity - monitorLabels := r.getMonitorLabels(monitor) _, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error { // Update owner references with the new monitor updateOwnerReferences(workload.GetObjectMeta(), &svc) - // Apply monitor-level labels first so source-object labels can override on conflict - if workload.Labels == nil { - workload.Labels = make(map[string]string) - } - for k, v := range monitorLabels { - workload.Labels[k] = v - } for k, v := range svc.Labels { workload.Labels[k] = v } - workload.Labels[workloadMonitorLabel] = monitor.Name + workload.Labels["workloads.cozystack.io/monitor"] = monitor.Name // Fill Workload status fields: workload.Status.Kind = monitor.Spec.Kind @@ -414,22 +188,14 @@ func (r *WorkloadMonitorReconciler) reconcilePVCForMonitor( resources[resourceLabel] = resourceQuantity } - monitorLabels := r.getMonitorLabels(monitor) _, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error { // Update owner references with the new monitor updateOwnerReferences(workload.GetObjectMeta(), &pvc) - // Apply monitor-level labels first so source-object labels can override on conflict - if workload.Labels == nil { - workload.Labels = make(map[string]string) - } - for k, v := range monitorLabels { - workload.Labels[k] = v - } for k, v := range pvc.Labels { workload.Labels[k] = v } - workload.Labels[workloadMonitorLabel] = monitor.Name + workload.Labels["workloads.cozystack.io/monitor"] = monitor.Name // Fill Workload status fields: workload.Status.Kind = monitor.Spec.Kind @@ -496,22 +262,14 @@ func (r *WorkloadMonitorReconciler) reconcilePodForMonitor( } metaLabels := r.getWorkloadMetadata(&pod) - monitorLabels := r.getMonitorLabels(monitor) _, err := ctrl.CreateOrUpdate(ctx, r.Client, workload, func() error { // Update owner references with the new monitor updateOwnerReferences(workload.GetObjectMeta(), &pod) - // Apply monitor-level labels first so source-object labels can override on conflict - if workload.Labels == nil { - workload.Labels = make(map[string]string) - } - for k, v := range monitorLabels { - workload.Labels[k] = v - } for k, v := range pod.Labels { workload.Labels[k] = v } - workload.Labels[workloadMonitorLabel] = monitor.Name + workload.Labels["workloads.cozystack.io/monitor"] = monitor.Name // Add workload meta to labels for k, v := range metaLabels { @@ -617,34 +375,6 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ } } - bucketClaimList := &cosiv1alpha1.BucketClaimList{} - if err := r.List( - ctx, - bucketClaimList, - client.InNamespace(monitor.Namespace), - client.MatchingLabels(monitor.Spec.Selector), - ); err != nil { - logger.Error(err, "Unable to list BucketClaims for WorkloadMonitor", "monitor", monitor.Name) - return ctrl.Result{}, err - } - - if len(bucketClaimList.Items) > 0 { - bucketPromURL := r.resolvePrometheusURL(ctx, monitor.Namespace) - var bucketNames []string - for _, bc := range bucketClaimList.Items { - if bc.Status.BucketName != "" { - bucketNames = append(bucketNames, bc.Status.BucketName) - } - } - allBucketMetrics := r.queryAllBucketMetrics(ctx, bucketPromURL, bucketNames) - for _, bc := range bucketClaimList.Items { - if err := r.reconcileBucketClaimForMonitor(ctx, monitor, bc, allBucketMetrics); err != nil { - logger.Error(err, "Failed to reconcile Workload for BucketClaim", "BucketClaim", bc.Name) - continue - } - } - } - // Update WorkloadMonitor status based on observed pods monitor.Status.ObservedReplicas = observedReplicas monitor.Status.AvailableReplicas = availableReplicas @@ -658,12 +388,10 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ fresh.Status.ObservedReplicas = observedReplicas fresh.Status.AvailableReplicas = availableReplicas - // Default to operational = true, but check MinReplicas if set. - // Use fresh.Spec to avoid making decisions based on a stale cached copy - // when the spec was updated between the initial read and this retry. - fresh.Status.Operational = pointer.Bool(true) - if fresh.Spec.MinReplicas != nil && availableReplicas < *fresh.Spec.MinReplicas { - fresh.Status.Operational = pointer.Bool(false) + // Default to operational = true, but check MinReplicas if set + monitor.Status.Operational = pointer.Bool(true) + if monitor.Spec.MinReplicas != nil && availableReplicas < *monitor.Spec.MinReplicas { + monitor.Status.Operational = pointer.Bool(false) } return r.Status().Update(ctx, fresh) }) @@ -672,12 +400,7 @@ func (r *WorkloadMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ return ctrl.Result{}, err } - // Requeue periodically if there are BucketClaims to keep sizes up to date. - // Bucket sizes come from Prometheus metrics that update every 60s. - if len(bucketClaimList.Items) > 0 { - return ctrl.Result{RequeueAfter: 60 * time.Second}, nil - } - + // Return without requeue if we want purely event-driven reconciliations return ctrl.Result{}, nil } @@ -696,11 +419,6 @@ func (r *WorkloadMonitorReconciler) SetupWithManager(mgr ctrl.Manager) error { &corev1.PersistentVolumeClaim{}, handler.EnqueueRequestsFromMapFunc(mapObjectToMonitor(&corev1.PersistentVolumeClaim{}, r.Client)), ). - // Watch BucketClaims for S3 bucket billing - Watches( - &cosiv1alpha1.BucketClaim{}, - handler.EnqueueRequestsFromMapFunc(mapObjectToMonitor(&cosiv1alpha1.BucketClaim{}, r.Client)), - ). // Watch for changes to Workload objects we create (owned by WorkloadMonitor) Owns(&cozyv1alpha1.Workload{}). Complete(r) @@ -754,21 +472,3 @@ func (r *WorkloadMonitorReconciler) getWorkloadMetadata(obj client.Object) map[s } return labels } - -// getMonitorLabels extracts workloads.cozystack.io/* labels from a WorkloadMonitor -// so they can be propagated onto Workload objects created for pods, PVCs, services, -// or bucket claims. The monitor label "workloads.cozystack.io/monitor" is reserved -// and set separately per Workload, so it is excluded here. -func (r *WorkloadMonitorReconciler) getMonitorLabels(monitor *cozyv1alpha1.WorkloadMonitor) map[string]string { - labels := make(map[string]string) - for k, v := range monitor.GetLabels() { - if !strings.HasPrefix(k, workloadLabelPrefix) { - continue - } - if k == workloadMonitorLabel { - continue - } - labels[k] = v - } - return labels -} diff --git a/internal/controller/workloadmonitor_controller_test.go b/internal/controller/workloadmonitor_controller_test.go deleted file mode 100644 index 355b0379..00000000 --- a/internal/controller/workloadmonitor_controller_test.go +++ /dev/null @@ -1,846 +0,0 @@ -package controller - -import ( - "context" - "fmt" - "net/http" - "net/http/httptest" - "strings" - "testing" - - cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" - corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/types" - cosiv1alpha1 "sigs.k8s.io/container-object-storage-interface-api/apis/objectstorage/v1alpha1" - "sigs.k8s.io/controller-runtime/pkg/client/fake" - "sigs.k8s.io/controller-runtime/pkg/reconcile" -) - -func TestReconcile_OperationalStatusPersisted(t *testing.T) { - scheme := runtime.NewScheme() - _ = cozyv1alpha1.AddToScheme(scheme) - _ = corev1.AddToScheme(scheme) - _ = cosiv1alpha1.AddToScheme(scheme) - - minReplicas := int32(2) - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-monitor", - Namespace: "default", - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Selector: map[string]string{"app": "test"}, - MinReplicas: &minReplicas, - }, - } - - // Create one pod that is ready — availableReplicas=1 < minReplicas=2, so Operational should be false - pod := &corev1.Pod{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-pod-1", - Namespace: "default", - Labels: map[string]string{"app": "test"}, - }, - Status: corev1.PodStatus{ - Conditions: []corev1.PodCondition{ - {Type: corev1.PodReady, Status: corev1.ConditionTrue}, - }, - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(monitor, pod). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme} - req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}} - - _, err := reconciler.Reconcile(context.TODO(), req) - if err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - // Fetch the monitor back from fake client and check Operational is persisted - updated := &cozyv1alpha1.WorkloadMonitor{} - if err := fakeClient.Get(context.TODO(), req.NamespacedName, updated); err != nil { - t.Fatalf("Failed to get updated WorkloadMonitor: %v", err) - } - - if updated.Status.Operational == nil { - t.Fatal("Expected Operational to be set, got nil") - } - if *updated.Status.Operational { - t.Error("Expected Operational=false (1 available < 2 minReplicas), got true") - } - if updated.Status.ObservedReplicas != 1 { - t.Errorf("Expected ObservedReplicas=1, got %d", updated.Status.ObservedReplicas) - } - if updated.Status.AvailableReplicas != 1 { - t.Errorf("Expected AvailableReplicas=1, got %d", updated.Status.AvailableReplicas) - } -} - -func TestReconcile_OperationalTrue_WhenEnoughReplicas(t *testing.T) { - scheme := runtime.NewScheme() - _ = cozyv1alpha1.AddToScheme(scheme) - _ = corev1.AddToScheme(scheme) - _ = cosiv1alpha1.AddToScheme(scheme) - - minReplicas := int32(1) - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-monitor", - Namespace: "default", - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Selector: map[string]string{"app": "test"}, - MinReplicas: &minReplicas, - }, - } - - pod := &corev1.Pod{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-pod-1", - Namespace: "default", - Labels: map[string]string{"app": "test"}, - }, - Status: corev1.PodStatus{ - Conditions: []corev1.PodCondition{ - {Type: corev1.PodReady, Status: corev1.ConditionTrue}, - }, - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(monitor, pod). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme} - req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}} - - _, err := reconciler.Reconcile(context.TODO(), req) - if err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - updated := &cozyv1alpha1.WorkloadMonitor{} - if err := fakeClient.Get(context.TODO(), req.NamespacedName, updated); err != nil { - t.Fatalf("Failed to get updated WorkloadMonitor: %v", err) - } - - if updated.Status.Operational == nil { - t.Fatal("Expected Operational to be set, got nil") - } - if !*updated.Status.Operational { - t.Error("Expected Operational=true (1 available >= 1 minReplicas), got false") - } -} - -func TestGetMonitorLabels(t *testing.T) { - tests := []struct { - name string - labels map[string]string - expected map[string]string - }{ - { - name: "nil labels", - labels: nil, - expected: map[string]string{}, - }, - { - name: "only workloads.cozystack.io/* labels are propagated", - labels: map[string]string{ - "workloads.cozystack.io/resource-preset": "medium", - "app.kubernetes.io/name": "postgres", - "custom.example.com/team": "platform", - }, - expected: map[string]string{ - "workloads.cozystack.io/resource-preset": "medium", - }, - }, - { - name: "monitor label is reserved and excluded", - labels: map[string]string{ - "workloads.cozystack.io/resource-preset": "small", - "workloads.cozystack.io/monitor": "should-be-dropped", - }, - expected: map[string]string{ - "workloads.cozystack.io/resource-preset": "small", - }, - }, - { - name: "multiple workloads.cozystack.io labels propagate", - labels: map[string]string{ - "workloads.cozystack.io/resource-preset": "large", - "workloads.cozystack.io/tier": "db", - }, - expected: map[string]string{ - "workloads.cozystack.io/resource-preset": "large", - "workloads.cozystack.io/tier": "db", - }, - }, - { - name: "no matching labels returns empty map", - labels: map[string]string{ - "app.kubernetes.io/name": "postgres", - }, - expected: map[string]string{}, - }, - } - - r := &WorkloadMonitorReconciler{} - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{Labels: tc.labels}, - } - got := r.getMonitorLabels(monitor) - if len(got) != len(tc.expected) { - t.Fatalf("expected %d labels, got %d (%v)", len(tc.expected), len(got), got) - } - for k, v := range tc.expected { - if gv, ok := got[k]; !ok || gv != v { - t.Errorf("expected label %q=%q, got %q", k, v, gv) - } - } - }) - } -} - -func TestReconcile_MonitorLabelsPropagatedToPodWorkload(t *testing.T) { - scheme := runtime.NewScheme() - _ = cozyv1alpha1.AddToScheme(scheme) - _ = corev1.AddToScheme(scheme) - - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-monitor", - Namespace: "default", - Labels: map[string]string{ - "workloads.cozystack.io/resource-preset": "medium", - "app.kubernetes.io/name": "ignored-not-propagated", - }, - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Selector: map[string]string{"app": "test"}, - Kind: "postgres", - Type: "postgres", - }, - } - - pod := &corev1.Pod{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-pod-1", - Namespace: "default", - Labels: map[string]string{ - "app": "test", - "app.kubernetes.io/name": "pod-wins-on-conflict", - }, - }, - Status: corev1.PodStatus{ - Conditions: []corev1.PodCondition{ - {Type: corev1.PodReady, Status: corev1.ConditionTrue}, - }, - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(monitor, pod). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme} - req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}} - if _, err := reconciler.Reconcile(context.TODO(), req); err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - workload := &cozyv1alpha1.Workload{} - if err := fakeClient.Get(context.TODO(), types.NamespacedName{Name: "pod-test-pod-1", Namespace: "default"}, workload); err != nil { - t.Fatalf("Failed to get Workload: %v", err) - } - - if got := workload.Labels["workloads.cozystack.io/resource-preset"]; got != "medium" { - t.Errorf("expected monitor label propagated, got %q", got) - } - // Non-workloads.cozystack.io monitor labels must not be copied - if _, ok := workload.Labels["app.kubernetes.io/name"]; !ok { - t.Error("expected pod label to be present on Workload") - } - // Source-object label takes precedence on conflict - if got := workload.Labels["app.kubernetes.io/name"]; got != "pod-wins-on-conflict" { - t.Errorf("expected pod label to win on conflict, got %q", got) - } - // Reserved monitor label is always set from the monitor name - if got := workload.Labels["workloads.cozystack.io/monitor"]; got != "test-monitor" { - t.Errorf("expected monitor-name label, got %q", got) - } -} - -func TestReconcile_BackwardCompat_NoMonitorLabels(t *testing.T) { - scheme := runtime.NewScheme() - _ = cozyv1alpha1.AddToScheme(scheme) - _ = corev1.AddToScheme(scheme) - - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-monitor", - Namespace: "default", - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Selector: map[string]string{"app": "test"}, - }, - } - - pod := &corev1.Pod{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-pod-1", - Namespace: "default", - Labels: map[string]string{"app": "test"}, - }, - Status: corev1.PodStatus{ - Conditions: []corev1.PodCondition{ - {Type: corev1.PodReady, Status: corev1.ConditionTrue}, - }, - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(monitor, pod). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme} - req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}} - if _, err := reconciler.Reconcile(context.TODO(), req); err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - workload := &cozyv1alpha1.Workload{} - if err := fakeClient.Get(context.TODO(), types.NamespacedName{Name: "pod-test-pod-1", Namespace: "default"}, workload); err != nil { - t.Fatalf("Failed to get Workload: %v", err) - } - for k := range workload.Labels { - if strings.HasPrefix(k, "workloads.cozystack.io/") && k != "workloads.cozystack.io/monitor" { - t.Errorf("unexpected workload label present: %q", k) - } - } -} - -func TestReconcile_OperationalTrue_WhenNoMinReplicas(t *testing.T) { - scheme := runtime.NewScheme() - _ = cozyv1alpha1.AddToScheme(scheme) - _ = corev1.AddToScheme(scheme) - _ = cosiv1alpha1.AddToScheme(scheme) - - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-monitor", - Namespace: "default", - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Selector: map[string]string{"app": "test"}, - // No MinReplicas — should default to operational=true - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(monitor). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: scheme} - req := reconcile.Request{NamespacedName: types.NamespacedName{Name: "test-monitor", Namespace: "default"}} - - _, err := reconciler.Reconcile(context.TODO(), req) - if err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - updated := &cozyv1alpha1.WorkloadMonitor{} - if err := fakeClient.Get(context.TODO(), req.NamespacedName, updated); err != nil { - t.Fatalf("Failed to get updated WorkloadMonitor: %v", err) - } - - if updated.Status.Operational == nil { - t.Fatal("Expected Operational to be set, got nil") - } - if !*updated.Status.Operational { - t.Error("Expected Operational=true (no MinReplicas constraint), got false") - } -} - -func newTestScheme() *runtime.Scheme { - s := runtime.NewScheme() - _ = cozyv1alpha1.AddToScheme(s) - _ = corev1.AddToScheme(s) - _ = cosiv1alpha1.AddToScheme(s) - return s -} - -func TestReconcileBucketClaimCreatesWorkload(t *testing.T) { - s := newTestScheme() - - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-bucket", - Namespace: "tenant-demo", - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Kind: "bucket", - Type: "s3", - Selector: map[string]string{ - "app.kubernetes.io/instance": "my-bucket", - }, - }, - } - - bc := &cosiv1alpha1.BucketClaim{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-bucket", - Namespace: "tenant-demo", - Labels: map[string]string{ - "app.kubernetes.io/instance": "my-bucket", - }, - }, - Spec: cosiv1alpha1.BucketClaimSpec{ - BucketClassName: "seaweedfs", - Protocols: []cosiv1alpha1.Protocol{cosiv1alpha1.ProtocolS3}, - }, - Status: cosiv1alpha1.BucketClaimStatus{ - BucketReady: true, - BucketName: "cosi-abc123", - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(s). - WithObjects(monitor, bc). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s} - req := reconcile.Request{NamespacedName: types.NamespacedName{ - Name: "my-bucket", - Namespace: "tenant-demo", - }} - - _, err := reconciler.Reconcile(context.TODO(), req) - if err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - workload := &cozyv1alpha1.Workload{} - err = fakeClient.Get(context.TODO(), types.NamespacedName{ - Name: "bucket-my-bucket", - Namespace: "tenant-demo", - }, workload) - if err != nil { - t.Fatalf("expected Workload to be created, got error: %v", err) - } - - if workload.Status.Kind != "bucket" { - t.Errorf("expected Kind=bucket, got %q", workload.Status.Kind) - } - if workload.Status.Type != "s3" { - t.Errorf("expected Type=s3, got %q", workload.Status.Type) - } - if !workload.Status.Operational { - t.Error("expected Operational=true for ready BucketClaim") - } -} - -func TestReconcileBucketClaimNotReady(t *testing.T) { - s := newTestScheme() - - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-bucket", - Namespace: "tenant-demo", - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Kind: "bucket", - Type: "s3", - Selector: map[string]string{ - "app.kubernetes.io/instance": "my-bucket", - }, - }, - } - - bc := &cosiv1alpha1.BucketClaim{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-bucket", - Namespace: "tenant-demo", - Labels: map[string]string{ - "app.kubernetes.io/instance": "my-bucket", - }, - }, - Spec: cosiv1alpha1.BucketClaimSpec{ - BucketClassName: "seaweedfs", - Protocols: []cosiv1alpha1.Protocol{cosiv1alpha1.ProtocolS3}, - }, - Status: cosiv1alpha1.BucketClaimStatus{ - BucketReady: false, - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(s). - WithObjects(monitor, bc). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s} - req := reconcile.Request{NamespacedName: types.NamespacedName{ - Name: "my-bucket", - Namespace: "tenant-demo", - }} - - _, err := reconciler.Reconcile(context.TODO(), req) - if err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - workload := &cozyv1alpha1.Workload{} - err = fakeClient.Get(context.TODO(), types.NamespacedName{ - Name: "bucket-my-bucket", - Namespace: "tenant-demo", - }, workload) - if err != nil { - t.Fatalf("expected Workload to be created, got error: %v", err) - } - - if workload.Status.Operational { - t.Error("expected Operational=false for not-ready BucketClaim") - } -} - -func TestReconcile_MonitorLabelsPropagatedToBucketClaimWorkload(t *testing.T) { - s := newTestScheme() - - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-bucket", - Namespace: "tenant-demo", - Labels: map[string]string{ - "workloads.cozystack.io/resource-preset": "medium", - "app.kubernetes.io/name": "ignored-not-propagated", - }, - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Kind: "bucket", - Type: "s3", - Selector: map[string]string{ - "app.kubernetes.io/instance": "my-bucket", - }, - }, - } - - bc := &cosiv1alpha1.BucketClaim{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-bucket", - Namespace: "tenant-demo", - Labels: map[string]string{ - "app.kubernetes.io/instance": "my-bucket", - "app.kubernetes.io/name": "bucket-wins-on-conflict", - }, - }, - Spec: cosiv1alpha1.BucketClaimSpec{ - BucketClassName: "seaweedfs", - Protocols: []cosiv1alpha1.Protocol{cosiv1alpha1.ProtocolS3}, - }, - Status: cosiv1alpha1.BucketClaimStatus{ - BucketReady: true, - BucketName: "cosi-abc123", - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(s). - WithObjects(monitor, bc). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s} - req := reconcile.Request{NamespacedName: types.NamespacedName{ - Name: "my-bucket", - Namespace: "tenant-demo", - }} - if _, err := reconciler.Reconcile(context.TODO(), req); err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - workload := &cozyv1alpha1.Workload{} - if err := fakeClient.Get(context.TODO(), types.NamespacedName{ - Name: "bucket-my-bucket", - Namespace: "tenant-demo", - }, workload); err != nil { - t.Fatalf("Failed to get Workload: %v", err) - } - - if got := workload.Labels["workloads.cozystack.io/resource-preset"]; got != "medium" { - t.Errorf("expected monitor label propagated, got %q", got) - } - // Source-object label takes precedence on conflict - if got := workload.Labels["app.kubernetes.io/name"]; got != "bucket-wins-on-conflict" { - t.Errorf("expected bucket claim label to win on conflict, got %q", got) - } - // Reserved monitor label is always set from the monitor name - if got := workload.Labels["workloads.cozystack.io/monitor"]; got != "my-bucket" { - t.Errorf("expected monitor-name label, got %q", got) - } -} - -func TestReconcileNoBucketClaimSkips(t *testing.T) { - s := newTestScheme() - - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-postgres", - Namespace: "tenant-demo", - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Kind: "postgres", - Type: "postgres", - Selector: map[string]string{ - "app.kubernetes.io/instance": "my-postgres", - }, - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(s). - WithObjects(monitor). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s} - req := reconcile.Request{NamespacedName: types.NamespacedName{ - Name: "my-postgres", - Namespace: "tenant-demo", - }} - - _, err := reconciler.Reconcile(context.TODO(), req) - if err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - workloadList := &cozyv1alpha1.WorkloadList{} - err = fakeClient.List(context.TODO(), workloadList) - if err != nil { - t.Fatalf("List returned error: %v", err) - } - - for _, w := range workloadList.Items { - if w.Status.Kind == "bucket" { - t.Error("expected no bucket workloads to be created for postgres monitor") - } - } -} - -func TestQueryAllBucketMetrics(t *testing.T) { - srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[ - {"metric":{"__name__":"SeaweedFS_s3_bucket_size_bytes","bucket":"bucket-aaa"},"value":[1713000000,"10485864"]}, - {"metric":{"__name__":"SeaweedFS_s3_bucket_physical_size_bytes","bucket":"bucket-aaa"},"value":[1713000000,"20971728"]}, - {"metric":{"__name__":"SeaweedFS_s3_bucket_size_bytes","bucket":"bucket-bbb"},"value":[1713000000,"0"]} - ]}}`) - })) - defer srv.Close() - - reconciler := &WorkloadMonitorReconciler{} - metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL, []string{"bucket-aaa", "bucket-bbb"}) - - bm, ok := metrics["bucket-aaa"] - if !ok { - t.Fatal("expected bucket-aaa in metrics") - } - if !bm.HasLogical || bm.LogicalSize != 10485864 { - t.Errorf("expected logical=10485864, got %d", bm.LogicalSize) - } - if !bm.HasPhysical || bm.PhysicalSize != 20971728 { - t.Errorf("expected physical=20971728, got %d", bm.PhysicalSize) - } - - bm2, ok := metrics["bucket-bbb"] - if !ok { - t.Fatal("expected bucket-bbb in metrics") - } - if !bm2.HasLogical || bm2.LogicalSize != 0 { - t.Errorf("expected logical=0 for empty bucket, got %d", bm2.LogicalSize) - } - if bm2.HasPhysical { - t.Error("expected no physical size for bucket-bbb") - } -} - -func TestQueryAllBucketMetricsEmpty(t *testing.T) { - srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - fmt.Fprint(w, `{"status":"success","data":{"resultType":"vector","result":[]}}`) - })) - defer srv.Close() - - reconciler := &WorkloadMonitorReconciler{} - metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL, []string{"bucket-aaa", "bucket-bbb"}) - if len(metrics) != 0 { - t.Errorf("expected empty metrics, got %d", len(metrics)) - } -} - -func TestQueryAllBucketMetricsServerError(t *testing.T) { - srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.WriteHeader(http.StatusInternalServerError) - })) - defer srv.Close() - - reconciler := &WorkloadMonitorReconciler{} - metrics := reconciler.queryAllBucketMetrics(context.TODO(), srv.URL, []string{"bucket-aaa", "bucket-bbb"}) - if len(metrics) != 0 { - t.Errorf("expected empty metrics on error, got %d", len(metrics)) - } -} - -func TestQueryAllBucketMetricsNoURL(t *testing.T) { - reconciler := &WorkloadMonitorReconciler{} - metrics := reconciler.queryAllBucketMetrics(context.TODO(), "", nil) - if len(metrics) != 0 { - t.Errorf("expected empty metrics when URL is empty, got %d", len(metrics)) - } -} - -func TestResolvePrometheusURL(t *testing.T) { - s := newTestScheme() - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{ - Name: "tenant-demo", - Labels: map[string]string{ - "namespace.cozystack.io/monitoring": "tenant-root", - }, - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(s). - WithObjects(ns). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s} - url := reconciler.resolvePrometheusURL(context.TODO(), "tenant-demo") - - expected := "http://vmselect-shortterm.tenant-root.svc:8481/select/0/prometheus" - if url != expected { - t.Errorf("expected %q, got %q", expected, url) - } -} - -func TestResolvePrometheusURLNoLabel(t *testing.T) { - s := newTestScheme() - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{ - Name: "tenant-demo", - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(s). - WithObjects(ns). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s} - url := reconciler.resolvePrometheusURL(context.TODO(), "tenant-demo") - - if url != "" { - t.Errorf("expected empty URL when no monitoring label, got %q", url) - } -} - -func TestReconcileBucketClaimRequeuesWhenBucketsExist(t *testing.T) { - s := newTestScheme() - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{ - Name: "tenant-demo", - }, - } - - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-bucket", - Namespace: "tenant-demo", - }, - Spec: cozyv1alpha1.WorkloadMonitorSpec{ - Kind: "bucket", - Type: "s3", - Selector: map[string]string{ - "app.kubernetes.io/instance": "my-bucket", - }, - }, - } - - bc := &cosiv1alpha1.BucketClaim{ - ObjectMeta: metav1.ObjectMeta{ - Name: "my-bucket", - Namespace: "tenant-demo", - Labels: map[string]string{ - "app.kubernetes.io/instance": "my-bucket", - }, - }, - Spec: cosiv1alpha1.BucketClaimSpec{ - BucketClassName: "seaweedfs", - Protocols: []cosiv1alpha1.Protocol{cosiv1alpha1.ProtocolS3}, - }, - Status: cosiv1alpha1.BucketClaimStatus{ - BucketReady: true, - BucketName: "cosi-abc123", - }, - } - - fakeClient := fake.NewClientBuilder(). - WithScheme(s). - WithObjects(ns, monitor, bc). - WithStatusSubresource(monitor). - Build() - - reconciler := &WorkloadMonitorReconciler{Client: fakeClient, Scheme: s} - req := reconcile.Request{NamespacedName: types.NamespacedName{ - Name: "my-bucket", - Namespace: "tenant-demo", - }} - - result, err := reconciler.Reconcile(context.TODO(), req) - if err != nil { - t.Fatalf("Reconcile returned error: %v", err) - } - - if result.RequeueAfter == 0 { - t.Error("expected RequeueAfter > 0 when buckets exist") - } - - workload := &cozyv1alpha1.Workload{} - err = fakeClient.Get(context.TODO(), types.NamespacedName{ - Name: "bucket-my-bucket", - Namespace: "tenant-demo", - }, workload) - if err != nil { - t.Fatalf("expected Workload to be created, got error: %v", err) - } - - // Without monitoring label on namespace, no size metrics should be set - if _, ok := workload.Status.Resources["s3-storage-bytes"]; ok { - t.Error("expected no s3-storage-bytes when monitoring is not configured") - } - if len(workload.Status.Resources) != 0 { - t.Errorf("expected empty resources without monitoring, got %v", workload.Status.Resources) - } -} diff --git a/internal/crdinstall/manifests/cozystack.io_packagesources.yaml b/internal/crdinstall/manifests/cozystack.io_packagesources.yaml index 1d0037df..0acfcdd2 100644 --- a/internal/crdinstall/manifests/cozystack.io_packagesources.yaml +++ b/internal/crdinstall/manifests/cozystack.io_packagesources.yaml @@ -118,19 +118,6 @@ spec: ReleaseName is the name of the HelmRelease resource that will be created If not specified, defaults to the component Name field type: string - upgradeCRDs: - description: |- - UpgradeCRDs controls how CRDs from the chart's crds/ directory are - handled on HelmRelease upgrades. Maps to HelmRelease.Spec.Upgrade.CRDs. - Empty string (default) preserves the helm-controller default (Skip). - Use "CreateReplace" for operators that evolve their CRD set between - versions. Warning: CreateReplace overwrites CRDs and may cause data - loss if upstream drops fields from a CRD with live objects. - enum: - - Skip - - Create - - CreateReplace - type: string type: object libraries: description: |- diff --git a/internal/lineagecontrollerwebhook/webhook.go b/internal/lineagecontrollerwebhook/webhook.go index cf871fb0..299cbaee 100644 --- a/internal/lineagecontrollerwebhook/webhook.go +++ b/internal/lineagecontrollerwebhook/webhook.go @@ -8,28 +8,22 @@ import ( "strings" "github.com/cozystack/cozystack/pkg/lineage" - corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" - "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/client-go/dynamic" "k8s.io/client-go/rest" ctrl "sigs.k8s.io/controller-runtime" - "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/client/apiutil" "sigs.k8s.io/controller-runtime/pkg/log" "sigs.k8s.io/controller-runtime/pkg/webhook/admission" cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" - appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1" corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1" - schedulerapi "github.com/cozystack/cozystack-scheduler/pkg/apis/v1alpha1" ) var ( - NoAncestors = errors.New("no managed apps found in lineage") - AncestryAmbiguous = errors.New("object ancestry is ambiguous") + NoAncestors = fmt.Errorf("no managed apps found in lineage") + AncestryAmbiguous = fmt.Errorf("object ancestry is ambiguous") ) const ( @@ -101,29 +95,26 @@ func (h *LineageControllerWebhook) Handle(ctx context.Context, req admission.Req return admission.Errored(400, fmt.Errorf("decode object: %w", err)) } - owner, err := h.getOwner(ctx, obj) - switch { - case err != nil && errors.Is(err, AncestryAmbiguous): - warn = append(warn, "object ancestry ambiguous, using first ancestor found") - case err != nil && errors.Is(err, NoAncestors): - // not a problem, mark object as unmanaged - case err != nil: - logger.Error(err, "error computing lineage labels") - return admission.Errored(500, fmt.Errorf("error computing lineage labels: %w", err)) - } - labels, err := h.computeLabels(ctx, obj, owner) - if err != nil { - logger.Error(err, "error computing lineage labels") - return admission.Errored(500, fmt.Errorf("error computing lineage labels: %w", err)) + labels, err := h.computeLabels(ctx, obj) + for { + if err != nil && errors.Is(err, NoAncestors) { + break // not a problem, mark object as unmanaged + } + if err != nil && errors.Is(err, AncestryAmbiguous) { + warn = append(warn, "object ancestry ambiguous, using first ancestor found") + break + } + if err != nil { + logger.Error(err, "error computing lineage labels") + return admission.Errored(500, fmt.Errorf("error computing lineage labels: %w", err)) + } + if err == nil { + break + } } h.applyLabels(obj, labels) - if err := h.applySchedulingClass(ctx, obj, owner, req.Namespace); err != nil { - logger.Error(err, "error applying scheduling class") - return admission.Errored(500, fmt.Errorf("error applying scheduling class: %w", err)) - } - mutated, err := json.Marshal(obj) if err != nil { return admission.Errored(500, fmt.Errorf("marshal mutated pod: %w", err)) @@ -132,29 +123,22 @@ func (h *LineageControllerWebhook) Handle(ctx context.Context, req admission.Req return admission.PatchResponseFromRaw(req.Object.Raw, mutated).WithWarnings(warn...) } -func (h *LineageControllerWebhook) getOwner(ctx context.Context, o *unstructured.Unstructured) (*unstructured.Unstructured, error) { +func (h *LineageControllerWebhook) computeLabels(ctx context.Context, o *unstructured.Unstructured) (map[string]string, error) { owners := lineage.WalkOwnershipGraph(ctx, h.dynClient, h.mapper, h, o) if len(owners) == 0 { - return nil, NoAncestors + return map[string]string{ManagedObjectKey: "false"}, NoAncestors } obj, err := owners[0].GetUnstructured(ctx, h.dynClient, h.mapper) if err != nil { return nil, err } - if len(owners) > 1 { - err = AncestryAmbiguous - } - return obj, err -} - -func (h *LineageControllerWebhook) computeLabels(ctx context.Context, obj *unstructured.Unstructured, owner *unstructured.Unstructured) (map[string]string, error) { - if owner == nil { - return nil, nil - } - gv, err := schema.ParseGroupVersion(owner.GetAPIVersion()) + gv, err := schema.ParseGroupVersion(obj.GetAPIVersion()) if err != nil { // should never happen, we got an APIVersion right from the API - return nil, fmt.Errorf("could not parse APIVersion %s to a group and version: %w", owner.GetAPIVersion(), err) + return nil, fmt.Errorf("could not parse APIVersion %s to a group and version: %w", obj.GetAPIVersion(), err) + } + if len(owners) > 1 { + err = AncestryAmbiguous } labels := map[string]string{ // truncate apigroup to first 63 chars @@ -169,25 +153,25 @@ func (h *LineageControllerWebhook) computeLabels(ctx context.Context, obj *unstr } return s }(gv.Group), - ManagerKindKey: owner.GetKind(), - ManagerNameKey: owner.GetName(), + ManagerKindKey: obj.GetKind(), + ManagerNameKey: obj.GetName(), } templateLabels := map[string]string{ - "kind": strings.ToLower(owner.GetKind()), - "name": owner.GetName(), - "namespace": obj.GetNamespace(), + "kind": strings.ToLower(obj.GetKind()), + "name": obj.GetName(), + "namespace": o.GetNamespace(), } cfg := h.config.Load().(*runtimeConfig) - crd := cfg.appCRDMap[appRef{gv.Group, owner.GetKind()}] - resourceSelectors := h.getResourceSelectors(obj.GroupVersionKind().GroupKind(), crd) + crd := cfg.appCRDMap[appRef{gv.Group, obj.GetKind()}] + resourceSelectors := h.getResourceSelectors(o.GroupVersionKind().GroupKind(), crd) labels[corev1alpha1.TenantResourceLabelKey] = func(b bool) string { if b { return corev1alpha1.TenantResourceLabelValue } return "false" - }(matchResourceToExcludeInclude(ctx, obj.GetName(), templateLabels, obj.GetLabels(), resourceSelectors)) - return labels, nil + }(matchResourceToExcludeInclude(ctx, o.GetName(), templateLabels, o.GetLabels(), resourceSelectors)) + return labels, err } func (h *LineageControllerWebhook) applyLabels(o *unstructured.Unstructured, labels map[string]string) { @@ -201,68 +185,6 @@ func (h *LineageControllerWebhook) applyLabels(o *unstructured.Unstructured, lab o.SetLabels(existing) } -// applySchedulingClass injects schedulerName and scheduling-class annotation -// into Pods whose namespace carries the scheduler.cozystack.io/scheduling-class label. -// If the referenced SchedulingClass CR does not exist (e.g. the scheduler -// package is not installed), the injection is silently skipped so that pods -// are not left Pending. -func (h *LineageControllerWebhook) applySchedulingClass(ctx context.Context, obj, owner *unstructured.Unstructured, namespace string) error { - if obj.GetKind() != "Pod" { - return nil - } - - // Determine scheduling class: owner Application field takes priority, - // then fall back to namespace label. - var schedulingClass string - if owner != nil { - var app appsv1alpha1.Application - if err := runtime.DefaultUnstructuredConverter.FromUnstructured(owner.Object, &app); err == nil { - schedulingClass = app.SchedulingClass() - } - } - if schedulingClass == "" { - ns := &corev1.Namespace{} - if err := h.Get(ctx, client.ObjectKey{Name: namespace}, ns); err != nil { - return fmt.Errorf("getting namespace %s: %w", namespace, err) - } - schedulingClass = ns.Labels[schedulerapi.SchedulingClassLabel] - } - - if schedulingClass == "" { - return nil - } - - // Verify that the referenced SchedulingClass CR exists. - // If the CRD is not installed or the CR is missing, skip injection - // so that pods are not stuck Pending on a non-existent scheduler. - _, err := h.dynClient.Resource(schedulingClassGVR).Get(ctx, schedulingClass, metav1.GetOptions{}) - if err != nil { - logger := log.FromContext(ctx) - logger.Info("SchedulingClass not found, skipping scheduler injection", - "schedulingClass", schedulingClass, "namespace", namespace) - return nil - } - - if err := unstructured.SetNestedField(obj.Object, schedulerapi.SchedulerName, "spec", "schedulerName"); err != nil { - return fmt.Errorf("setting schedulerName: %w", err) - } - - annotations := obj.GetAnnotations() - if annotations == nil { - annotations = make(map[string]string) - } - annotations[schedulerapi.SchedulingClassAnnotation] = schedulingClass - obj.SetAnnotations(annotations) - - return nil -} - -var schedulingClassGVR = schema.GroupVersionResource{ - Group: schedulerapi.Group, - Version: schedulerapi.Version, - Resource: schedulerapi.Resource, -} - func (h *LineageControllerWebhook) decodeUnstructured(req admission.Request, out *unstructured.Unstructured) error { if h.decoder != nil { if err := h.decoder.Decode(req, out); err == nil { diff --git a/internal/operator/package_reconciler.go b/internal/operator/package_reconciler.go index 0e724e49..32e667e4 100644 --- a/internal/operator/package_reconciler.go +++ b/internal/operator/package_reconciler.go @@ -45,16 +45,6 @@ const ( SecretCozystackValues = "cozystack-values" ) -// parseCRDPolicy maps ComponentInstall.UpgradeCRDs to a helmv2.CRDsPolicy. -// Empty / nil preserves the helm-controller default (Skip on upgrade); -// the CRD enum marker restricts the string to Skip/Create/CreateReplace. -func parseCRDPolicy(install *cozyv1alpha1.ComponentInstall) helmv2.CRDsPolicy { - if install == nil || install.UpgradeCRDs == "" { - return "" - } - return helmv2.CRDsPolicy(install.UpgradeCRDs) -} - // PackageReconciler reconciles Package resources type PackageReconciler struct { client.Client @@ -231,7 +221,6 @@ func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct Remediation: &helmv2.UpgradeRemediation{ Retries: -1, }, - CRDs: parseCRDPolicy(component.Install), }, }, } diff --git a/internal/operator/package_reconciler_test.go b/internal/operator/package_reconciler_test.go deleted file mode 100644 index f0ee2c19..00000000 --- a/internal/operator/package_reconciler_test.go +++ /dev/null @@ -1,138 +0,0 @@ -/* -Copyright 2025 The Cozystack Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package operator - -import ( - "encoding/json" - "os" - "path/filepath" - "testing" - - cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" - helmv2 "github.com/fluxcd/helm-controller/api/v2" - apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" - "sigs.k8s.io/yaml" -) - -func TestParseCRDPolicy(t *testing.T) { - tests := []struct { - name string - install *cozyv1alpha1.ComponentInstall - want helmv2.CRDsPolicy - }{ - { - name: "nil install leaves flux default", - install: nil, - want: "", - }, - { - name: "empty upgradeCRDs leaves flux default", - install: &cozyv1alpha1.ComponentInstall{}, - want: "", - }, - { - name: "Skip is passed through", - install: &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "Skip"}, - want: helmv2.Skip, - }, - { - name: "Create is passed through", - install: &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "Create"}, - want: helmv2.Create, - }, - { - name: "CreateReplace is passed through", - install: &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "CreateReplace"}, - want: helmv2.CreateReplace, - }, - } - - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - got := parseCRDPolicy(tc.install) - if got != tc.want { - t.Errorf("parseCRDPolicy() = %q, want %q", got, tc.want) - } - }) - } -} - -// TestPackageSourceCRDHasUpgradeCRDsEnum guards the generated CRD schema: the -// invalid-value case from the spec is enforced at the API server via a -// kubebuilder enum marker, not in the reconciler. If someone drops the marker -// and forgets to regenerate, this test catches it. -func TestPackageSourceCRDHasUpgradeCRDsEnum(t *testing.T) { - path := filepath.Join("..", "crdinstall", "manifests", "cozystack.io_packagesources.yaml") - data, err := os.ReadFile(path) - if err != nil { - t.Fatalf("read %s: %v", path, err) - } - - var crd apiextensionsv1.CustomResourceDefinition - if err := yaml.Unmarshal(data, &crd); err != nil { - t.Fatalf("unmarshal CRD: %v", err) - } - - var field *apiextensionsv1.JSONSchemaProps - for i := range crd.Spec.Versions { - v := &crd.Spec.Versions[i] - if v.Schema == nil || v.Schema.OpenAPIV3Schema == nil { - continue - } - spec, ok := v.Schema.OpenAPIV3Schema.Properties["spec"] - if !ok { - continue - } - variants, ok := spec.Properties["variants"] - if !ok || variants.Items == nil || variants.Items.Schema == nil { - continue - } - components, ok := variants.Items.Schema.Properties["components"] - if !ok || components.Items == nil || components.Items.Schema == nil { - continue - } - install, ok := components.Items.Schema.Properties["install"] - if !ok { - continue - } - f, ok := install.Properties["upgradeCRDs"] - if !ok { - continue - } - field = &f - break - } - - if field == nil { - t.Fatal("upgradeCRDs field not found in PackageSource CRD schema") - } - - got := map[string]bool{} - for _, e := range field.Enum { - var s string - if err := json.Unmarshal(e.Raw, &s); err != nil { - t.Fatalf("unmarshal enum value %q: %v", e.Raw, err) - } - got[s] = true - } - - for _, want := range []string{"Skip", "Create", "CreateReplace"} { - if !got[want] { - t.Errorf("enum value %q missing from upgradeCRDs; got %v", want, got) - } - } -} diff --git a/packages/apps/bucket/Makefile b/packages/apps/bucket/Makefile index 1e35bd53..d1cfda8e 100644 --- a/packages/apps/bucket/Makefile +++ b/packages/apps/bucket/Makefile @@ -1,5 +1,5 @@ include ../../../hack/package.mk generate: - cozyvalues-gen -m 'bucket' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/bucket/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh diff --git a/packages/apps/bucket/templates/bucketclaim.yaml b/packages/apps/bucket/templates/bucketclaim.yaml index 0639916f..2f57fd70 100644 --- a/packages/apps/bucket/templates/bucketclaim.yaml +++ b/packages/apps/bucket/templates/bucketclaim.yaml @@ -4,8 +4,6 @@ apiVersion: objectstorage.k8s.io/v1alpha1 kind: BucketClaim metadata: name: {{ .Release.Name }} - labels: - app.kubernetes.io/instance: {{ .Release.Name }} spec: bucketClassName: {{ $seaweedfs }}{{- if $pool }}-{{ $pool }}{{- end }}{{- if .Values.locking }}-lock{{- end }} protocols: diff --git a/packages/apps/bucket/templates/workloadmonitor.yaml b/packages/apps/bucket/templates/workloadmonitor.yaml deleted file mode 100644 index a23f3147..00000000 --- a/packages/apps/bucket/templates/workloadmonitor.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: cozystack.io/v1alpha1 -kind: WorkloadMonitor -metadata: - name: {{ $.Release.Name }} -spec: - replicas: 0 - minReplicas: 0 - kind: bucket - type: s3 - selector: - app.kubernetes.io/instance: {{ $.Release.Name }} - version: {{ $.Chart.Version }} diff --git a/packages/apps/bucket/values.schema.json b/packages/apps/bucket/values.schema.json index d302842c..ef213a18 100644 --- a/packages/apps/bucket/values.schema.json +++ b/packages/apps/bucket/values.schema.json @@ -27,4 +27,4 @@ } } } -} +} \ No newline at end of file diff --git a/packages/apps/clickhouse/Makefile b/packages/apps/clickhouse/Makefile index 2d671d1d..2c77add9 100644 --- a/packages/apps/clickhouse/Makefile +++ b/packages/apps/clickhouse/Makefile @@ -4,7 +4,7 @@ include ../../../hack/common-envs.mk include ../../../hack/package.mk generate: - cozyvalues-gen -m 'clickhouse' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/clickhouse/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh image: diff --git a/packages/apps/clickhouse/templates/workloadmonitor.yaml b/packages/apps/clickhouse/templates/workloadmonitor.yaml index 62c951c2..9020ad41 100644 --- a/packages/apps/clickhouse/templates/workloadmonitor.yaml +++ b/packages/apps/clickhouse/templates/workloadmonitor.yaml @@ -3,8 +3,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }} - labels: - workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }} spec: replicas: {{ .Values.replicas }} minReplicas: 1 @@ -19,8 +17,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }}-keeper - labels: - workloads.cozystack.io/resource-preset: {{ .Values.clickhouseKeeper.resourcesPreset | quote }} spec: replicas: {{ .Values.clickhouseKeeper.replicas }} minReplicas: 1 diff --git a/packages/apps/clickhouse/values.schema.json b/packages/apps/clickhouse/values.schema.json index e4e1df7d..abb3aeb1 100644 --- a/packages/apps/clickhouse/values.schema.json +++ b/packages/apps/clickhouse/values.schema.json @@ -2,119 +2,6 @@ "title": "Chart Values", "type": "object", "properties": { - "replicas": { - "description": "Number of ClickHouse replicas.", - "type": "integer", - "default": 2 - }, - "shards": { - "description": "Number of ClickHouse shards.", - "type": "integer", - "default": 1 - }, - "resources": { - "description": "Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "CPU available to each replica.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Memory (RAM) available to each replica.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "resourcesPreset": { - "description": "Default sizing preset used when `resources` is omitted.", - "type": "string", - "default": "small", - "enum": [ - "nano", - "micro", - "small", - "medium", - "large", - "xlarge", - "2xlarge" - ] - }, - "size": { - "description": "Persistent Volume Claim size available for application data.", - "default": "10Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "storageClass": { - "description": "StorageClass used to store the data.", - "type": "string", - "default": "" - }, - "logStorageSize": { - "description": "Size of Persistent Volume for logs.", - "default": "2Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "logTTL": { - "description": "TTL (expiration time) for `query_log` and `query_thread_log`.", - "type": "integer", - "default": 15 - }, - "users": { - "description": "Users configuration map.", - "type": "object", - "default": {}, - "additionalProperties": { - "type": "object", - "properties": { - "password": { - "description": "Password for the user.", - "type": "string" - }, - "readonly": { - "description": "User is readonly (default: false).", - "type": "boolean" - } - } - } - }, "backup": { "description": "Backup configuration.", "type": "object", @@ -216,6 +103,119 @@ "x-kubernetes-int-or-string": true } } + }, + "logStorageSize": { + "description": "Size of Persistent Volume for logs.", + "default": "2Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "logTTL": { + "description": "TTL (expiration time) for `query_log` and `query_thread_log`.", + "type": "integer", + "default": 15 + }, + "replicas": { + "description": "Number of ClickHouse replicas.", + "type": "integer", + "default": 2 + }, + "resources": { + "description": "Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.", + "type": "object", + "default": {}, + "properties": { + "cpu": { + "description": "CPU available to each replica.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "memory": { + "description": "Memory (RAM) available to each replica.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, + "resourcesPreset": { + "description": "Default sizing preset used when `resources` is omitted.", + "type": "string", + "default": "small", + "enum": [ + "nano", + "micro", + "small", + "medium", + "large", + "xlarge", + "2xlarge" + ] + }, + "shards": { + "description": "Number of ClickHouse shards.", + "type": "integer", + "default": 1 + }, + "size": { + "description": "Persistent Volume Claim size available for application data.", + "default": "10Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "storageClass": { + "description": "StorageClass used to store the data.", + "type": "string", + "default": "" + }, + "users": { + "description": "Users configuration map.", + "type": "object", + "default": {}, + "additionalProperties": { + "type": "object", + "properties": { + "password": { + "description": "Password for the user.", + "type": "string" + }, + "readonly": { + "description": "User is readonly (default: false).", + "type": "boolean" + } + } + } } } -} +} \ No newline at end of file diff --git a/packages/apps/foundationdb/Makefile b/packages/apps/foundationdb/Makefile index 1a07cd5b..76c84980 100644 --- a/packages/apps/foundationdb/Makefile +++ b/packages/apps/foundationdb/Makefile @@ -1,4 +1,4 @@ include ../../../hack/package.mk generate: - cozyvalues-gen -m 'foundationdb' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/foundationdb/types.go \ No newline at end of file + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md \ No newline at end of file diff --git a/packages/apps/foundationdb/README.md b/packages/apps/foundationdb/README.md index 30f5714e..4f7b6878 100644 --- a/packages/apps/foundationdb/README.md +++ b/packages/apps/foundationdb/README.md @@ -1,4 +1,4 @@ -# Managed FoundationDB Service +# FoundationDB A managed FoundationDB service for Cozystack. diff --git a/packages/apps/foundationdb/templates/workloadmonitor.yaml b/packages/apps/foundationdb/templates/workloadmonitor.yaml index 2e2a3d19..306797f3 100644 --- a/packages/apps/foundationdb/templates/workloadmonitor.yaml +++ b/packages/apps/foundationdb/templates/workloadmonitor.yaml @@ -8,7 +8,6 @@ metadata: app.kubernetes.io/name: foundationdb app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/managed-by: {{ .Release.Service }} - workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }} spec: replicas: {{ .Values.cluster.processCounts.storage }} minReplicas: {{ include "foundationdb.minReplicas" . }} diff --git a/packages/apps/foundationdb/values.schema.json b/packages/apps/foundationdb/values.schema.json index 1fc77d59..7b3a1ba5 100644 --- a/packages/apps/foundationdb/values.schema.json +++ b/packages/apps/foundationdb/values.schema.json @@ -2,6 +2,82 @@ "title": "Chart Values", "type": "object", "properties": { + "automaticReplacements": { + "description": "Enable automatic pod replacements.", + "type": "boolean", + "default": true + }, + "backup": { + "description": "Backup configuration.", + "type": "object", + "default": {}, + "required": [ + "enabled", + "retentionPolicy", + "s3" + ], + "properties": { + "enabled": { + "description": "Enable backups.", + "type": "boolean", + "default": false + }, + "retentionPolicy": { + "description": "Retention policy for backups.", + "type": "string", + "default": "7d" + }, + "s3": { + "description": "S3 configuration for backups.", + "type": "object", + "default": {}, + "required": [ + "bucket", + "credentials", + "endpoint", + "region" + ], + "properties": { + "bucket": { + "description": "S3 bucket name.", + "type": "string", + "default": "" + }, + "credentials": { + "description": "S3 credentials.", + "type": "object", + "default": {}, + "required": [ + "accessKeyId", + "secretAccessKey" + ], + "properties": { + "accessKeyId": { + "description": "S3 access key ID.", + "type": "string", + "default": "" + }, + "secretAccessKey": { + "description": "S3 secret access key.", + "type": "string", + "default": "" + } + } + }, + "endpoint": { + "description": "S3 endpoint URL.", + "type": "string", + "default": "" + }, + "region": { + "description": "S3 region.", + "type": "string", + "default": "us-east-1" + } + } + } + } + }, "cluster": { "description": "Cluster configuration.", "type": "object", @@ -79,33 +155,35 @@ } } }, - "storage": { - "description": "Storage configuration.", + "customParameters": { + "description": "Custom parameters to pass to FoundationDB.", + "type": "array", + "default": [], + "items": { + "type": "string" + } + }, + "imageType": { + "description": "Container image deployment type.", + "type": "string", + "default": "unified", + "enum": [ + "unified", + "split" + ] + }, + "monitoring": { + "description": "Monitoring configuration.", "type": "object", "default": {}, "required": [ - "size", - "storageClass" + "enabled" ], "properties": { - "size": { - "description": "Size of persistent volumes for each instance.", - "default": "16Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "storageClass": { - "description": "Storage class (if not set, uses cluster default).", - "type": "string", - "default": "" + "enabled": { + "description": "Enable WorkloadMonitor integration.", + "type": "boolean", + "default": true } } }, @@ -154,109 +232,6 @@ "2xlarge" ] }, - "backup": { - "description": "Backup configuration.", - "type": "object", - "default": {}, - "required": [ - "enabled", - "retentionPolicy", - "s3" - ], - "properties": { - "enabled": { - "description": "Enable backups.", - "type": "boolean", - "default": false - }, - "retentionPolicy": { - "description": "Retention policy for backups.", - "type": "string", - "default": "7d" - }, - "s3": { - "description": "S3 configuration for backups.", - "type": "object", - "default": {}, - "required": [ - "bucket", - "credentials", - "endpoint", - "region" - ], - "properties": { - "bucket": { - "description": "S3 bucket name.", - "type": "string", - "default": "" - }, - "credentials": { - "description": "S3 credentials.", - "type": "object", - "default": {}, - "required": [ - "accessKeyId", - "secretAccessKey" - ], - "properties": { - "accessKeyId": { - "description": "S3 access key ID.", - "type": "string", - "default": "" - }, - "secretAccessKey": { - "description": "S3 secret access key.", - "type": "string", - "default": "" - } - } - }, - "endpoint": { - "description": "S3 endpoint URL.", - "type": "string", - "default": "" - }, - "region": { - "description": "S3 region.", - "type": "string", - "default": "us-east-1" - } - } - } - } - }, - "monitoring": { - "description": "Monitoring configuration.", - "type": "object", - "default": {}, - "required": [ - "enabled" - ], - "properties": { - "enabled": { - "description": "Enable WorkloadMonitor integration.", - "type": "boolean", - "default": true - } - } - }, - "customParameters": { - "description": "Custom parameters to pass to FoundationDB.", - "type": "array", - "default": [], - "items": { - "type": "string" - } - }, - "imageType": { - "description": "Container image deployment type.", - "type": "string", - "default": "unified", - "enum": [ - "unified", - "split" - ] - }, "securityContext": { "description": "Security context for containers.", "type": "object", @@ -278,10 +253,35 @@ } } }, - "automaticReplacements": { - "description": "Enable automatic pod replacements.", - "type": "boolean", - "default": true + "storage": { + "description": "Storage configuration.", + "type": "object", + "default": {}, + "required": [ + "size", + "storageClass" + ], + "properties": { + "size": { + "description": "Size of persistent volumes for each instance.", + "default": "16Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "storageClass": { + "description": "Storage class (if not set, uses cluster default).", + "type": "string", + "default": "" + } + } } } -} +} \ No newline at end of file diff --git a/packages/apps/harbor/Makefile b/packages/apps/harbor/Makefile index 43c25998..f0ce9944 100644 --- a/packages/apps/harbor/Makefile +++ b/packages/apps/harbor/Makefile @@ -3,5 +3,5 @@ NAME=harbor include ../../../hack/package.mk generate: - cozyvalues-gen -m 'harbor' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/harbor/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh diff --git a/packages/apps/harbor/README.md b/packages/apps/harbor/README.md index 7789d9fe..df44ca8d 100644 --- a/packages/apps/harbor/README.md +++ b/packages/apps/harbor/README.md @@ -1,6 +1,6 @@ # Managed Harbor Container Registry -Harbor is an open-source trusted cloud-native registry project that stores, signs, and scans content. +Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. ## Parameters diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml index bf780967..ff8e88ad 100644 --- a/packages/apps/harbor/templates/harbor.yaml +++ b/packages/apps/harbor/templates/harbor.yaml @@ -158,8 +158,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }}-core - labels: - workloads.cozystack.io/resource-preset: {{ .Values.core.resourcesPreset | quote }} spec: replicas: 1 minReplicas: 1 @@ -176,8 +174,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }}-registry - labels: - workloads.cozystack.io/resource-preset: {{ .Values.registry.resourcesPreset | quote }} spec: replicas: 1 minReplicas: 1 diff --git a/packages/apps/harbor/values.schema.json b/packages/apps/harbor/values.schema.json index 23860ca3..1352f5dc 100644 --- a/packages/apps/harbor/values.schema.json +++ b/packages/apps/harbor/values.schema.json @@ -2,16 +2,6 @@ "title": "Chart Values", "type": "object", "properties": { - "host": { - "description": "Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).", - "type": "string", - "default": "" - }, - "storageClass": { - "description": "StorageClass used to store the data.", - "type": "string", - "default": "" - }, "core": { "description": "Core API server configuration.", "type": "object", @@ -66,6 +56,125 @@ } } }, + "database": { + "description": "PostgreSQL database configuration.", + "type": "object", + "default": {}, + "required": [ + "replicas", + "size" + ], + "properties": { + "replicas": { + "description": "Number of database instances.", + "type": "integer", + "default": 2 + }, + "size": { + "description": "Persistent Volume size for database storage.", + "default": "5Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, + "host": { + "description": "Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).", + "type": "string", + "default": "" + }, + "jobservice": { + "description": "Background job service configuration.", + "type": "object", + "default": {}, + "properties": { + "resources": { + "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.", + "type": "object", + "default": {}, + "properties": { + "cpu": { + "description": "Number of CPU cores allocated.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "memory": { + "description": "Amount of memory allocated.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, + "resourcesPreset": { + "description": "Default sizing preset used when `resources` is omitted.", + "type": "string", + "default": "nano", + "enum": [ + "nano", + "micro", + "small", + "medium", + "large", + "xlarge", + "2xlarge" + ] + } + } + }, + "redis": { + "description": "Redis cache configuration.", + "type": "object", + "default": {}, + "required": [ + "replicas", + "size" + ], + "properties": { + "replicas": { + "description": "Number of Redis replicas.", + "type": "integer", + "default": 2 + }, + "size": { + "description": "Persistent Volume size for cache storage.", + "default": "1Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, "registry": { "description": "Container image registry configuration.", "type": "object", @@ -120,59 +229,10 @@ } } }, - "jobservice": { - "description": "Background job service configuration.", - "type": "object", - "default": {}, - "properties": { - "resources": { - "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "Number of CPU cores allocated.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Amount of memory allocated.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "resourcesPreset": { - "description": "Default sizing preset used when `resources` is omitted.", - "type": "string", - "default": "nano", - "enum": [ - "nano", - "micro", - "small", - "medium", - "large", - "xlarge", - "2xlarge" - ] - } - } + "storageClass": { + "description": "StorageClass used to store the data.", + "type": "string", + "default": "" }, "trivy": { "description": "Trivy vulnerability scanner configuration.", @@ -250,66 +310,6 @@ "x-kubernetes-int-or-string": true } } - }, - "database": { - "description": "PostgreSQL database configuration.", - "type": "object", - "default": {}, - "required": [ - "replicas", - "size" - ], - "properties": { - "replicas": { - "description": "Number of database instances.", - "type": "integer", - "default": 2 - }, - "size": { - "description": "Persistent Volume size for database storage.", - "default": "5Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "redis": { - "description": "Redis cache configuration.", - "type": "object", - "default": {}, - "required": [ - "replicas", - "size" - ], - "properties": { - "replicas": { - "description": "Number of Redis replicas.", - "type": "integer", - "default": 2 - }, - "size": { - "description": "Persistent Volume size for cache storage.", - "default": "1Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } } } -} +} \ No newline at end of file diff --git a/packages/apps/http-cache/Makefile b/packages/apps/http-cache/Makefile index 899f0288..2cc11f87 100644 --- a/packages/apps/http-cache/Makefile +++ b/packages/apps/http-cache/Makefile @@ -17,7 +17,7 @@ image-nginx: rm -f images/nginx-cache.json generate: - cozyvalues-gen -m 'httpcache' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/httpcache/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh update: diff --git a/packages/apps/http-cache/templates/workloadmonitor.yaml b/packages/apps/http-cache/templates/workloadmonitor.yaml index a38a395a..150d8bbe 100644 --- a/packages/apps/http-cache/templates/workloadmonitor.yaml +++ b/packages/apps/http-cache/templates/workloadmonitor.yaml @@ -3,8 +3,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }}-haproxy - labels: - workloads.cozystack.io/resource-preset: {{ .Values.haproxy.resourcesPreset | quote }} spec: replicas: {{ .Values.haproxy.replicas }} minReplicas: 1 @@ -18,8 +16,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }}-nginx - labels: - workloads.cozystack.io/resource-preset: {{ .Values.nginx.resourcesPreset | quote }} spec: replicas: {{ .Values.nginx.replicas }} minReplicas: 1 diff --git a/packages/apps/http-cache/values.schema.json b/packages/apps/http-cache/values.schema.json index 14609cc3..7fd1a37a 100644 --- a/packages/apps/http-cache/values.schema.json +++ b/packages/apps/http-cache/values.schema.json @@ -2,30 +2,6 @@ "title": "Chart Values", "type": "object", "properties": { - "size": { - "description": "Persistent Volume Claim size available for application data.", - "default": "10Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "storageClass": { - "description": "StorageClass used to store the data.", - "type": "string", - "default": "" - }, - "external": { - "description": "Enable external access from outside the cluster.", - "type": "boolean", - "default": false - }, "endpoints": { "description": "Endpoints configuration, as a list of \u003cip:port\u003e.", "type": "array", @@ -34,6 +10,11 @@ "type": "string" } }, + "external": { + "description": "Enable external access from outside the cluster.", + "type": "boolean", + "default": false + }, "haproxy": { "description": "HAProxy configuration.", "type": "object", @@ -159,6 +140,25 @@ ] } } + }, + "size": { + "description": "Persistent Volume Claim size available for application data.", + "default": "10Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "storageClass": { + "description": "StorageClass used to store the data.", + "type": "string", + "default": "" } } -} +} \ No newline at end of file diff --git a/packages/apps/kafka/Makefile b/packages/apps/kafka/Makefile index c1084e86..2cffdfa7 100644 --- a/packages/apps/kafka/Makefile +++ b/packages/apps/kafka/Makefile @@ -2,5 +2,5 @@ include ../../../hack/package.mk PRESET_ENUM := ["nano","micro","small","medium","large","xlarge","2xlarge"] generate: - cozyvalues-gen -m 'kafka' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/kafka/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh diff --git a/packages/apps/kafka/templates/workloadmonitor.yaml b/packages/apps/kafka/templates/workloadmonitor.yaml index c31eb425..4b161b04 100644 --- a/packages/apps/kafka/templates/workloadmonitor.yaml +++ b/packages/apps/kafka/templates/workloadmonitor.yaml @@ -3,8 +3,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }} - labels: - workloads.cozystack.io/resource-preset: {{ .Values.kafka.resourcesPreset | quote }} spec: replicas: {{ .Values.replicas }} minReplicas: 1 @@ -21,8 +19,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }}-zookeeper - labels: - workloads.cozystack.io/resource-preset: {{ .Values.zookeeper.resourcesPreset | quote }} spec: replicas: {{ .Values.replicas }} minReplicas: 1 diff --git a/packages/apps/kafka/values.schema.json b/packages/apps/kafka/values.schema.json index e3b6db12..4b375b63 100644 --- a/packages/apps/kafka/values.schema.json +++ b/packages/apps/kafka/values.schema.json @@ -7,39 +7,6 @@ "type": "boolean", "default": false }, - "topics": { - "description": "Topics configuration.", - "type": "array", - "default": [], - "items": { - "type": "object", - "required": [ - "config", - "name", - "partitions", - "replicas" - ], - "properties": { - "config": { - "description": "Topic configuration.", - "type": "object", - "x-kubernetes-preserve-unknown-fields": true - }, - "name": { - "description": "Topic name.", - "type": "string" - }, - "partitions": { - "description": "Number of partitions.", - "type": "integer" - }, - "replicas": { - "description": "Number of replicas.", - "type": "integer" - } - } - } - }, "kafka": { "description": "Kafka configuration.", "type": "object", @@ -124,6 +91,39 @@ } } }, + "topics": { + "description": "Topics configuration.", + "type": "array", + "default": [], + "items": { + "type": "object", + "required": [ + "config", + "name", + "partitions", + "replicas" + ], + "properties": { + "config": { + "description": "Topic configuration.", + "type": "object", + "x-kubernetes-preserve-unknown-fields": true + }, + "name": { + "description": "Topic name.", + "type": "string" + }, + "partitions": { + "description": "Number of partitions.", + "type": "integer" + }, + "replicas": { + "description": "Number of replicas.", + "type": "integer" + } + } + } + }, "zookeeper": { "description": "ZooKeeper configuration.", "type": "object", @@ -209,4 +209,4 @@ } } } -} +} \ No newline at end of file diff --git a/packages/apps/kubernetes/Makefile b/packages/apps/kubernetes/Makefile index 4fea42ef..48bdc33d 100644 --- a/packages/apps/kubernetes/Makefile +++ b/packages/apps/kubernetes/Makefile @@ -1,14 +1,11 @@ -KUBERNETES_VERSIONS = $(shell awk -F'"' '{print $$2}' files/versions.yaml) +KUBERNETES_VERSION = v1.35 KUBERNETES_PKG_TAG = $(shell awk '$$1 == "version:" {print $$2}' Chart.yaml) include ../../../hack/common-envs.mk include ../../../hack/package.mk -test: - helm unittest . - generate: - cozyvalues-gen -m 'kubernetes' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/kubernetes/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh update: @@ -18,19 +15,17 @@ update: image: image-ubuntu-container-disk image-kubevirt-cloud-provider image-kubevirt-csi-driver image-cluster-autoscaler image-ubuntu-container-disk: - $(foreach ver,$(KUBERNETES_VERSIONS), \ - docker buildx build images/ubuntu-container-disk \ - --build-arg KUBERNETES_VERSION=$(ver) \ - --tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(ver)) \ - --tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(ver)-$(TAG)) \ - --cache-from type=registry,ref=$(REGISTRY)/ubuntu-container-disk:$(call settag,$(ver)) \ - --cache-to type=inline \ - --metadata-file images/ubuntu-container-disk-$(ver).json \ - $(BUILDX_ARGS) && \ - echo "$(REGISTRY)/ubuntu-container-disk:$(call settag,$(ver))@$$(yq e '."containerimage.digest"' images/ubuntu-container-disk-$(ver).json -o json -r)" \ - > images/ubuntu-container-disk-$(ver).tag && \ - rm -f images/ubuntu-container-disk-$(ver).json; \ - ) + docker buildx build images/ubuntu-container-disk \ + --build-arg KUBERNETES_VERSION=${KUBERNETES_VERSION} \ + --tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(KUBERNETES_VERSION)) \ + --tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(KUBERNETES_VERSION)-$(TAG)) \ + --cache-from type=registry,ref=$(REGISTRY)/ubuntu-container-disk:latest \ + --cache-to type=inline \ + --metadata-file images/ubuntu-container-disk.json \ + $(BUILDX_ARGS) + echo "$(REGISTRY)/ubuntu-container-disk:$(call settag,$(KUBERNETES_VERSION))@$$(yq e '."containerimage.digest"' images/ubuntu-container-disk.json -o json -r)" \ + > images/ubuntu-container-disk.tag + rm -f images/ubuntu-container-disk.json image-kubevirt-cloud-provider: docker buildx build images/kubevirt-cloud-provider \ @@ -70,4 +65,3 @@ image-cluster-autoscaler: echo "$(REGISTRY)/cluster-autoscaler:$(call settag,$(KUBERNETES_PKG_TAG))@$$(yq e '."containerimage.digest"' images/cluster-autoscaler.json -o json -r)" \ > images/cluster-autoscaler.tag rm -f images/cluster-autoscaler.json - diff --git a/packages/apps/kubernetes/README.md b/packages/apps/kubernetes/README.md index bed1117a..d62d3a39 100644 --- a/packages/apps/kubernetes/README.md +++ b/packages/apps/kubernetes/README.md @@ -128,9 +128,6 @@ See the reference for components utilized in this service: | `addons.gpuOperator` | NVIDIA GPU Operator. | `object` | `{}` | | `addons.gpuOperator.enabled` | Enable GPU Operator. | `bool` | `false` | | `addons.gpuOperator.valuesOverride` | Custom Helm values overrides. | `object` | `{}` | -| `addons.hami` | HAMi GPU virtualization middleware. | `object` | `{}` | -| `addons.hami.enabled` | Enable HAMi (requires GPU Operator). | `bool` | `false` | -| `addons.hami.valuesOverride` | Custom Helm values overrides. | `object` | `{}` | | `addons.fluxcd` | FluxCD GitOps operator. | `object` | `{}` | | `addons.fluxcd.enabled` | Enable FluxCD. | `bool` | `false` | | `addons.fluxcd.valuesOverride` | Custom Helm values overrides. | `object` | `{}` | @@ -148,33 +145,31 @@ See the reference for components utilized in this service: ### Kubernetes Control Plane Configuration -| Name | Description | Type | Value | -| --------------------------------------------------- | --------------------------------------------------------------------------------------------- | ---------- | ------- | -| `controlPlane` | Kubernetes control-plane configuration. | `object` | `{}` | -| `controlPlane.replicas` | Number of control-plane replicas. | `int` | `2` | -| `controlPlane.apiServer` | API Server configuration. | `object` | `{}` | -| `controlPlane.apiServer.resources` | CPU and memory resources for API Server. | `object` | `{}` | -| `controlPlane.apiServer.resources.cpu` | CPU available. | `quantity` | `""` | -| `controlPlane.apiServer.resources.memory` | Memory (RAM) available. | `quantity` | `""` | -| `controlPlane.apiServer.resourcesPreset` | Preset if `resources` omitted. | `string` | `large` | -| `controlPlane.controllerManager` | Controller Manager configuration. | `object` | `{}` | -| `controlPlane.controllerManager.resources` | CPU and memory resources for Controller Manager. | `object` | `{}` | -| `controlPlane.controllerManager.resources.cpu` | CPU available. | `quantity` | `""` | -| `controlPlane.controllerManager.resources.memory` | Memory (RAM) available. | `quantity` | `""` | -| `controlPlane.controllerManager.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` | -| `controlPlane.scheduler` | Scheduler configuration. | `object` | `{}` | -| `controlPlane.scheduler.resources` | CPU and memory resources for Scheduler. | `object` | `{}` | -| `controlPlane.scheduler.resources.cpu` | CPU available. | `quantity` | `""` | -| `controlPlane.scheduler.resources.memory` | Memory (RAM) available. | `quantity` | `""` | -| `controlPlane.scheduler.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` | -| `controlPlane.konnectivity` | Konnectivity configuration. | `object` | `{}` | -| `controlPlane.konnectivity.server` | Konnectivity Server configuration. | `object` | `{}` | -| `controlPlane.konnectivity.server.resources` | CPU and memory resources for Konnectivity. | `object` | `{}` | -| `controlPlane.konnectivity.server.resources.cpu` | CPU available. | `quantity` | `""` | -| `controlPlane.konnectivity.server.resources.memory` | Memory (RAM) available. | `quantity` | `""` | -| `controlPlane.konnectivity.server.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` | -| `images` | Optional image overrides for air-gapped or rate-limited registries. | `object` | `{}` | -| `images.waitForKubeconfig` | Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag. | `string` | `""` | +| Name | Description | Type | Value | +| --------------------------------------------------- | ------------------------------------------------ | ---------- | ------- | +| `controlPlane` | Kubernetes control-plane configuration. | `object` | `{}` | +| `controlPlane.replicas` | Number of control-plane replicas. | `int` | `2` | +| `controlPlane.apiServer` | API Server configuration. | `object` | `{}` | +| `controlPlane.apiServer.resources` | CPU and memory resources for API Server. | `object` | `{}` | +| `controlPlane.apiServer.resources.cpu` | CPU available. | `quantity` | `""` | +| `controlPlane.apiServer.resources.memory` | Memory (RAM) available. | `quantity` | `""` | +| `controlPlane.apiServer.resourcesPreset` | Preset if `resources` omitted. | `string` | `large` | +| `controlPlane.controllerManager` | Controller Manager configuration. | `object` | `{}` | +| `controlPlane.controllerManager.resources` | CPU and memory resources for Controller Manager. | `object` | `{}` | +| `controlPlane.controllerManager.resources.cpu` | CPU available. | `quantity` | `""` | +| `controlPlane.controllerManager.resources.memory` | Memory (RAM) available. | `quantity` | `""` | +| `controlPlane.controllerManager.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` | +| `controlPlane.scheduler` | Scheduler configuration. | `object` | `{}` | +| `controlPlane.scheduler.resources` | CPU and memory resources for Scheduler. | `object` | `{}` | +| `controlPlane.scheduler.resources.cpu` | CPU available. | `quantity` | `""` | +| `controlPlane.scheduler.resources.memory` | Memory (RAM) available. | `quantity` | `""` | +| `controlPlane.scheduler.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` | +| `controlPlane.konnectivity` | Konnectivity configuration. | `object` | `{}` | +| `controlPlane.konnectivity.server` | Konnectivity Server configuration. | `object` | `{}` | +| `controlPlane.konnectivity.server.resources` | CPU and memory resources for Konnectivity. | `object` | `{}` | +| `controlPlane.konnectivity.server.resources.cpu` | CPU available. | `quantity` | `""` | +| `controlPlane.konnectivity.server.resources.memory` | Memory (RAM) available. | `quantity` | `""` | +| `controlPlane.konnectivity.server.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` | ## Parameter examples and reference diff --git a/packages/apps/kubernetes/images/busybox.tag b/packages/apps/kubernetes/images/busybox.tag deleted file mode 100644 index 39de220a..00000000 --- a/packages/apps/kubernetes/images/busybox.tag +++ /dev/null @@ -1 +0,0 @@ -docker.io/library/busybox:1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag index 00aa2caa..e74aac71 100644 --- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag +++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag @@ -1 +1 @@ -ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:72154a97054e16cdf3dea6129d962b8d7e86b55cf9386095e8ac2ce7c8b69172 +ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:c40b352c18e4a7d9b3a40d6c29c32bbf6dd9bd8fdca35185b194187e797aeeb6 diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go index a367f27f..5636a1d5 100644 --- a/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go +++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/node.go @@ -4,7 +4,6 @@ import ( "context" "fmt" "os" - "path/filepath" csi "github.com/container-storage-interface/spec/lib/go/csi" "google.golang.org/grpc/codes" @@ -33,8 +32,7 @@ func (w *WrappedNodeService) NodeStageVolume(ctx context.Context, req *csi.NodeS return w.NodeService.NodeStageVolume(ctx, req) } -// NodePublishVolume for NFS volumes: mounts the /data subdir of the NFS export -// at the target path, hiding internal artifacts (disk.img, lost+found). +// NodePublishVolume for NFS volumes: mounts NFS at the target path. // For RWO volumes, delegates to upstream (mount block device). func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolumeRequest) (*csi.NodePublishVolumeResponse, error) { nfsExport := req.GetPublishContext()[nfsExportKey] @@ -62,11 +60,13 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod } notMnt = true } + if !notMnt { klog.V(3).Infof("NFS volume %s already mounted at %s", req.GetVolumeId(), targetPath) return &csi.NodePublishVolumeResponse{}, nil } + source := fmt.Sprintf("%s:%s", host, path) mountOptions := []string{ "nfsvers=4.2", fmt.Sprintf("port=%s", port), @@ -75,60 +75,9 @@ func (w *WrappedNodeService) NodePublishVolume(ctx context.Context, req *csi.Nod mountOptions = append(mountOptions, "ro") } - // Temp-mount the NFS root to ensure /data subdir exists and migrate any - // user files that were written before this fix (backward compatibility). - tmpMount, err := os.MkdirTemp("", fmt.Sprintf("nfs-init-%s-", req.GetVolumeId())) - if err != nil { - return nil, status.Errorf(codes.Internal, "failed to create temp mount dir: %v", err) - } - defer os.Remove(tmpMount) - - rootSource := fmt.Sprintf("%s:%s", host, path) - rootOpts := []string{"nfsvers=4.2", fmt.Sprintf("port=%s", port)} - if err := w.mounter.Mount(rootSource, tmpMount, "nfs", rootOpts); err != nil { - return nil, status.Errorf(codes.Internal, "NFS temp mount failed: %v", err) - } - defer func() { - if err := w.mounter.Unmount(tmpMount); err != nil { - klog.Warningf("Failed to unmount temp dir %s: %v", tmpMount, err) - } - }() - - dataDir := filepath.Join(tmpMount, "data") - if err := os.MkdirAll(dataDir, 0777); err != nil { - return nil, status.Errorf(codes.Internal, "failed to create /data subdir: %v", err) - } - - // Auto-migrate: move user files from root into /data (skip internal artifacts). - // Fail the publish if migration cannot complete to avoid hiding user data. - entries, err := os.ReadDir(tmpMount) - if err != nil { - return nil, status.Errorf(codes.Internal, "failed to read NFS root for migration (volume %s): %v", req.GetVolumeId(), err) - } - for _, entry := range entries { - name := entry.Name() - if name == "data" || name == "disk.img" || name == "lost+found" { - continue - } - src := filepath.Join(tmpMount, name) - dst := filepath.Join(dataDir, name) - if _, err := os.Stat(dst); err == nil { - continue // already exists in /data, skip - } - klog.Infof("Migrating %s to /data/%s for volume %s", name, name, req.GetVolumeId()) - if err := os.Rename(src, dst); err != nil { - if os.IsNotExist(err) { - continue // benign: concurrent publish already moved it - } - return nil, status.Errorf(codes.Internal, "failed to migrate %s for volume %s: %v", name, req.GetVolumeId(), err) - } - } - - // Mount only the /data subdir at the pod's target path. - dataSource := fmt.Sprintf("%s:%s/data", host, path) - klog.V(3).Infof("Mounting NFS %s at %s with options %v", dataSource, targetPath, mountOptions) - if err := w.mounter.Mount(dataSource, targetPath, "nfs", mountOptions); err != nil { - return nil, status.Errorf(codes.Internal, "NFS mount of %s at %s failed: %v", dataSource, targetPath, err) + klog.V(3).Infof("Mounting NFS %s at %s with options %v", source, targetPath, mountOptions) + if err := w.mounter.Mount(source, targetPath, "nfs", mountOptions); err != nil { + return nil, status.Errorf(codes.Internal, "NFS mount of %s at %s failed: %v", source, targetPath, err) } return &csi.NodePublishVolumeResponse{}, nil diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag deleted file mode 100644 index f49fffe6..00000000 --- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.30.tag +++ /dev/null @@ -1 +0,0 @@ -ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.30@sha256:f460ed1fd5a721aed423e6c3b8be0105d7f693cd86ad992d9c15fd4b27e58cec diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag deleted file mode 100644 index b5bdc79a..00000000 --- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.31.tag +++ /dev/null @@ -1 +0,0 @@ -ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.31@sha256:aaa2dfa8ee53ae26295f44d2491330f51412457bbe4aa6ba256297cc0bd8a0da diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag deleted file mode 100644 index ca285644..00000000 --- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.32.tag +++ /dev/null @@ -1 +0,0 @@ -ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.32@sha256:7acb4728ef6b9c0ff3344bf486bb00f2a083f2098452344a362242235013db01 diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag deleted file mode 100644 index bb58690a..00000000 --- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.33.tag +++ /dev/null @@ -1 +0,0 @@ -ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.33@sha256:a2024339ab9edb980a96b43ad2744b7aa31afaef0983ddbc6a546068b4cfa87a diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag b/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag deleted file mode 100644 index 36eed7a7..00000000 --- a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.34.tag +++ /dev/null @@ -1 +0,0 @@ -ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.34@sha256:97bcf946a5687889c6a421d14e5adece11f0978151b2165dc87b28f77f7607db diff --git a/packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag b/packages/apps/kubernetes/images/ubuntu-container-disk.tag similarity index 100% rename from packages/apps/kubernetes/images/ubuntu-container-disk-v1.35.tag rename to packages/apps/kubernetes/images/ubuntu-container-disk.tag diff --git a/packages/apps/kubernetes/templates/_helpers.tpl b/packages/apps/kubernetes/templates/_helpers.tpl index 40a8ae7a..36c06b64 100644 --- a/packages/apps/kubernetes/templates/_helpers.tpl +++ b/packages/apps/kubernetes/templates/_helpers.tpl @@ -49,52 +49,3 @@ Selector labels app.kubernetes.io/name: {{ include "kubernetes.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} - -{{/* -wait-for-kubeconfig init container shared by the control-plane-side -Deployments (cluster-autoscaler, kccm, kcsi-controller) that mount the -*-admin-kubeconfig Secret provisioned asynchronously by Kamaji. The -Secret volume is declared optional so kubelet does not FailedMount while -Kamaji is still bootstrapping; this container polls the mounted path and -exits only when super-admin.svc appears, which happens after kubelet's -optional-Secret refresh cycle. - -The 10m deadline stays strictly below the 15m HelmRelease -Install.Timeout set by cozystack-api for the Kubernetes kind (via the -release.cozystack.io/helm-install-timeout annotation) so the -CrashLoopBackOff surfaces before flux remediation fires and uninstalls -the Cluster CR. - -The default image lives in images/busybox.tag and points directly at -docker.io by digest (not mirrored to ghcr.io like the other .tag files -here): the payload is a one-shot sh loop and the digest pin makes the -pull immutable. Operators in air-gapped or rate-limited environments -can override it via .Values.images.waitForKubeconfig (any registry -reference kubelet can pull). When the value is empty the chart falls -back to the bundled digest pin, preserving the prior default. - -Call site owns the surrounding volumes block; the kubeconfig volume -must exist on the pod and mount at /etc/kubernetes/kubeconfig. -*/}} -{{- define "kubernetes.waitForAdminKubeconfig" -}} -- name: wait-for-kubeconfig - image: "{{ default (.Files.Get "images/busybox.tag" | trim) .Values.images.waitForKubeconfig }}" - command: - - sh - - -c - - | - set -eu - deadline=$(( $(date +%s) + 600 )) - until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do - if [ "$(date +%s)" -ge "$deadline" ]; then - echo "admin kubeconfig was not provisioned within 10m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2 - exit 1 - fi - echo "waiting for admin kubeconfig (provisioned by Kamaji, visible after kubelet Secret refresh)..." - sleep 5 - done - volumeMounts: - - name: kubeconfig - mountPath: /etc/kubernetes/kubeconfig - readOnly: true -{{- end }} diff --git a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml index 298d86db..a00e0155 100644 --- a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml +++ b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml @@ -1,14 +1,3 @@ -{{- /* - Gate the control-plane-side workloads on the parent tenant having an etcd - DataStore. Without it no KamajiControlPlane is ever created, Kamaji never - provisions -admin-kubeconfig, and rendering these Deployments would cause - the wait-for-kubeconfig init to CrashLoopBackOff indefinitely, consuming - the parent HelmRelease install timeout and triggering the very uninstall - remediation cycle this chart is supposed to avoid. Rendering them only - when $etcd is set keeps the HelmRelease Ready while flux retries on its - interval and picks up the DataStore as soon as the Tenant chart finishes. -*/}} -{{- if .Values._namespace.etcd }} --- apiVersion: apps/v1 kind: Deployment @@ -34,8 +23,6 @@ spec: - key: node-role.kubernetes.io/control-plane operator: Exists effect: "NoSchedule" - initContainers: - {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }} containers: - image: "{{ $.Files.Get "images/cluster-autoscaler.tag" | trim }}" name: cluster-autoscaler @@ -69,7 +56,6 @@ spec: name: cloud-config - secret: secretName: {{ .Release.Name }}-admin-kubeconfig - optional: true name: kubeconfig serviceAccountName: {{ .Release.Name }}-cluster-autoscaler terminationGracePeriodSeconds: 10 @@ -119,4 +105,3 @@ rules: - list - update - watch -{{- end }} diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml index e1494e64..b97af93e 100644 --- a/packages/apps/kubernetes/templates/cluster.yaml +++ b/packages/apps/kubernetes/templates/cluster.yaml @@ -1,15 +1,4 @@ {{- $etcd := .Values._namespace.etcd }} -{{- /* - When $etcd is empty, the parent Tenant application has not populated - _namespace.etcd in cozystack-values yet - either the operator forgot to - set etcd: true on an ancestor Tenant, or the Tenant HelmRelease is still - reconciling. Either way, rendering a KamajiControlPlane with an empty - dataStoreName would be rejected by Kamaji's admission webhook and the - HelmRelease would fail to install, triggering remediation. Instead, emit - a single ConfigMap as a user-visible status beacon and skip the rest so - flux marks the HelmRelease Ready and retries its 5m reconcile loop until - the Tenant chart catches up. -*/}} {{- $ingress := .Values._namespace.ingress }} {{- $host := .Values._namespace.host }} {{- $kubevirtmachinetemplateNames := list }} @@ -81,13 +70,11 @@ spec: memory: guest: {{ .group.resources.memory }} {{- end }} - resources: - {{- include "cozy-lib.resources.sanitize" (list (dict "ephemeral-storage" .group.ephemeralStorage) $) | nindent 14 }} evictionStrategy: External volumes: - name: system containerDisk: - image: "{{ $.Files.Get (printf "images/ubuntu-container-disk-%s.tag" $.Values.version) | trim }}" + image: "{{ $.Files.Get "images/ubuntu-container-disk.tag" | trim }}" - name: ephemeral emptyDisk: capacity: {{ .group.ephemeralStorage | default "20Gi" }} @@ -95,26 +82,6 @@ spec: - name: default pod: {} {{- end }} -{{- if not $etcd }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ .Release.Name }}-awaiting-etcd - namespace: {{ .Release.Namespace }} - labels: - app.kubernetes.io/managed-by: {{ .Release.Service }} - app.kubernetes.io/name: kubernetes - app.kubernetes.io/instance: {{ .Release.Name }} -data: - status: "awaiting-etcd" - message: | - No DataStore is available for this tenant Kubernetes cluster. The parent - Tenant application has not populated _namespace.etcd. Set spec.etcd: true - on an ancestor Tenant (usually tenant-root) and wait for its HelmRelease - to reconcile - this HelmRelease will pick up the DataStore on its next - 5m reconcile loop and provision the cluster. -{{- else }} --- apiVersion: cluster.x-k8s.io/v1beta1 kind: Cluster @@ -282,9 +249,6 @@ spec: joinConfiguration: nodeRegistration: kubeletExtraArgs: {} - # Ignore this for 1.31 - ignorePreflightErrors: - - FileExisting-conntrack discovery: bootstrapToken: apiServerEndpoint: {{ $.Release.Name }}.{{ $.Release.Namespace }}.svc:6443 @@ -435,4 +399,3 @@ metadata: spec: {{- .spec | toYaml | nindent 2 }} {{- end }} -{{- end }} diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml index de62104c..938b6d67 100644 --- a/packages/apps/kubernetes/templates/csi/deploy.yaml +++ b/packages/apps/kubernetes/templates/csi/deploy.yaml @@ -1,4 +1,3 @@ -{{- if .Values._namespace.etcd }} kind: Deployment apiVersion: apps/v1 metadata: @@ -25,8 +24,6 @@ spec: - key: node-role.kubernetes.io/control-plane operator: Exists effect: "NoSchedule" - initContainers: - {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }} containers: - name: csi-driver imagePullPolicy: Always @@ -237,6 +234,4 @@ spec: emptyDir: {} - secret: secretName: {{ .Release.Name }}-admin-kubeconfig - optional: true name: kubeconfig -{{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml index fd9dac7e..be07a8b9 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.addons.certManager.enabled .Values._namespace.etcd }} +{{- if .Values.addons.certManager.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml index 700b666e..6857581a 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml @@ -8,7 +8,7 @@ cert-manager: {{- end }} {{- end }} -{{- if and .Values.addons.certManager.enabled .Values._namespace.etcd }} +{{- if .Values.addons.certManager.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: diff --git a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml index d8c90cbf..d032f5b6 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml @@ -14,7 +14,6 @@ cilium: {{- end }} {{- end }} -{{- if .Values._namespace.etcd }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -56,4 +55,3 @@ spec: - name: {{ .Release.Name }}-gateway-api-crds namespace: {{ .Release.Namespace }} {{- end }} -{{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml index 0711a51d..bdb6c682 100644 --- a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml @@ -4,7 +4,6 @@ coredns: clusterIP: "10.95.0.10" {{- end }} -{{- if .Values._namespace.etcd }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -43,4 +42,3 @@ spec: {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/csi.yaml b/packages/apps/kubernetes/templates/helmreleases/csi.yaml index 109d78e1..dd2c69a6 100644 --- a/packages/apps/kubernetes/templates/helmreleases/csi.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/csi.yaml @@ -1,4 +1,3 @@ -{{- if .Values._namespace.etcd }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -40,4 +39,3 @@ spec: - name: {{ .Release.Name }} namespace: {{ .Release.Namespace }} {{- end }} -{{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml index 25fff01c..76499dfe 100644 --- a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.addons.fluxcd.enabled .Values._namespace.etcd }} +{{- if .Values.addons.fluxcd.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: diff --git a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml index b4172ed1..2bcc8d4d 100644 --- a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml @@ -1,4 +1,4 @@ -{{- if and $.Values.addons.gatewayAPI.enabled $.Values._namespace.etcd }} +{{- if $.Values.addons.gatewayAPI.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: diff --git a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml index 655dc868..5ef48912 100644 --- a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml @@ -1,12 +1,4 @@ -{{- define "cozystack.defaultGpuOperatorValues" -}} -{{- if .Values.addons.hami.enabled }} -gpu-operator: - devicePlugin: - enabled: false -{{- end }} -{{- end }} - -{{- if and .Values.addons.gpuOperator.enabled .Values._namespace.etcd }} +{{- if .Values.addons.gpuOperator.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -37,12 +29,9 @@ spec: force: true remediation: retries: -1 - {{- $defaults := fromYaml (include "cozystack.defaultGpuOperatorValues" .) }} - {{- $overrides := deepCopy (default (dict) .Values.addons.gpuOperator.valuesOverride) }} - {{- $merged := mergeOverwrite (default (dict) $defaults) $overrides }} - {{- if $merged }} + {{- with .Values.addons.gpuOperator.valuesOverride }} values: - {{- toYaml $merged | nindent 4 }} + {{- toYaml . | nindent 4 }} {{- end }} dependsOn: diff --git a/packages/apps/kubernetes/templates/helmreleases/hami.yaml b/packages/apps/kubernetes/templates/helmreleases/hami.yaml deleted file mode 100644 index f1538c7c..00000000 --- a/packages/apps/kubernetes/templates/helmreleases/hami.yaml +++ /dev/null @@ -1,49 +0,0 @@ -{{- if and .Values.addons.hami.enabled .Values._namespace.etcd }} -{{- if not .Values.addons.gpuOperator.enabled }} -{{- fail "addons.hami requires addons.gpuOperator to be enabled" }} -{{- end }} -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: {{ .Release.Name }}-hami - labels: - cozystack.io/repository: system - cozystack.io/target-cluster-name: {{ .Release.Name }} - sharding.fluxcd.io/key: tenants -spec: - releaseName: hami - chartRef: - kind: ExternalArtifact - name: cozystack-kubernetes-application-kubevirt-kubernetes-hami - namespace: cozy-system - kubeConfig: - secretRef: - name: {{ .Release.Name }}-admin-kubeconfig - key: super-admin.svc - targetNamespace: cozy-hami - storageNamespace: cozy-hami - interval: 5m - timeout: 10m - install: - createNamespace: true - remediation: - retries: -1 - upgrade: - force: true - remediation: - retries: -1 - {{- with .Values.addons.hami.valuesOverride }} - values: - {{- toYaml . | nindent 4 }} - {{- end }} - - dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - - name: {{ .Release.Name }}-cilium - namespace: {{ .Release.Namespace }} - - name: {{ .Release.Name }}-gpu-operator - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml index 6e2183d3..5cafff90 100644 --- a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml @@ -20,7 +20,7 @@ ingress-nginx: node-role.kubernetes.io/ingress-nginx: "" {{- end }} -{{- if and .Values.addons.ingressNginx.enabled .Values._namespace.etcd }} +{{- if .Values.addons.ingressNginx.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: diff --git a/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml b/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml index 3e6f9660..3cc81a14 100644 --- a/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml @@ -1,4 +1,3 @@ -{{- if .Values._namespace.etcd }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -37,4 +36,3 @@ spec: namespace: {{ .Release.Namespace }} - name: {{ .Release.Name }}-prometheus-operator-crds namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml index a811f7dd..602f7efb 100644 --- a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml @@ -1,6 +1,6 @@ {{- $targetTenant := .Values._namespace.monitoring }} {{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }} -{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }} +{{- if .Values.addons.monitoringAgents.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -73,8 +73,8 @@ spec: [OUTPUT] Name http Match kube.* - Host vlinsert-generic.{{ $targetTenant }}.svc.{{ $clusterDomain }} - port 9481 + Host vlogs-generic.{{ $targetTenant }}.svc.{{ $clusterDomain }} + port 9428 compress gzip uri /insert/jsonline?_stream_fields=stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date format json_lines diff --git a/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml index 3038a058..600a7994 100644 --- a/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml @@ -1,4 +1,3 @@ -{{- if .Values._namespace.etcd }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -32,4 +31,3 @@ spec: - name: {{ .Release.Name }} namespace: {{ .Release.Namespace }} {{- end }} -{{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/velero.yaml b/packages/apps/kubernetes/templates/helmreleases/velero.yaml index 781b9c49..ad236d53 100644 --- a/packages/apps/kubernetes/templates/helmreleases/velero.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/velero.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.addons.velero.enabled .Values._namespace.etcd }} +{{- if .Values.addons.velero.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: diff --git a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml index 55a5faac..a3b7a9b4 100644 --- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }} +{{- if .Values.addons.monitoringAgents.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: diff --git a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml index 74fb5a39..178df3e3 100644 --- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml @@ -24,7 +24,7 @@ vertical-pod-autoscaler: memory: 1600Mi {{- end }} -{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }} +{{- if .Values.addons.monitoringAgents.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: diff --git a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml index 7302f8f5..99744277 100644 --- a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }} +{{- if .Values.addons.monitoringAgents.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: diff --git a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml index d50fd93c..025f01b7 100644 --- a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml @@ -1,4 +1,3 @@ -{{- if .Values._namespace.etcd }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -34,4 +33,3 @@ spec: - name: {{ .Release.Name }} namespace: {{ .Release.Namespace }} {{- end }} -{{- end }} diff --git a/packages/apps/kubernetes/templates/kccm/manager.yaml b/packages/apps/kubernetes/templates/kccm/manager.yaml index bd9e2798..81426d4e 100644 --- a/packages/apps/kubernetes/templates/kccm/manager.yaml +++ b/packages/apps/kubernetes/templates/kccm/manager.yaml @@ -1,4 +1,3 @@ -{{- if .Values._namespace.etcd }} apiVersion: apps/v1 kind: Deployment metadata: @@ -23,8 +22,6 @@ spec: - key: node-role.kubernetes.io/control-plane operator: Exists effect: "NoSchedule" - initContainers: - {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }} containers: - name: kubevirt-cloud-controller-manager args: @@ -58,7 +55,5 @@ spec: name: cloud-config - secret: secretName: {{ .Release.Name }}-admin-kubeconfig - optional: true name: kubeconfig serviceAccountName: {{ .Release.Name }}-kccm -{{- end }} diff --git a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml deleted file mode 100644 index 507e00af..00000000 --- a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml +++ /dev/null @@ -1,155 +0,0 @@ -suite: admin-kubeconfig wait guards - -release: - name: test - namespace: tenant-root - -values: - - values-ci.yaml - -tests: - - it: cluster-autoscaler mounts admin-kubeconfig as optional - template: templates/cluster-autoscaler/deployment.yaml - documentSelector: - path: kind - value: Deployment - asserts: - - equal: - path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName - value: test-admin-kubeconfig - - equal: - path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.optional - value: true - - - it: cluster-autoscaler waits for admin-kubeconfig via initContainer - template: templates/cluster-autoscaler/deployment.yaml - documentSelector: - path: kind - value: Deployment - asserts: - - equal: - path: spec.template.spec.initContainers[0].name - value: wait-for-kubeconfig - - contains: - path: spec.template.spec.initContainers[0].volumeMounts - content: - name: kubeconfig - mountPath: /etc/kubernetes/kubeconfig - readOnly: true - - - it: kccm mounts admin-kubeconfig as optional - template: templates/kccm/manager.yaml - documentSelector: - path: kind - value: Deployment - asserts: - - equal: - path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName - value: test-admin-kubeconfig - - equal: - path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.optional - value: true - - - it: kccm waits for admin-kubeconfig via initContainer - template: templates/kccm/manager.yaml - documentSelector: - path: kind - value: Deployment - asserts: - - equal: - path: spec.template.spec.initContainers[0].name - value: wait-for-kubeconfig - - contains: - path: spec.template.spec.initContainers[0].volumeMounts - content: - name: kubeconfig - mountPath: /etc/kubernetes/kubeconfig - readOnly: true - - - it: csi controller mounts admin-kubeconfig as optional - template: templates/csi/deploy.yaml - documentSelector: - path: kind - value: Deployment - asserts: - - equal: - path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName - value: test-admin-kubeconfig - - equal: - path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.optional - value: true - - - it: csi controller waits for admin-kubeconfig via initContainer - template: templates/csi/deploy.yaml - documentSelector: - path: kind - value: Deployment - asserts: - - equal: - path: spec.template.spec.initContainers[0].name - value: wait-for-kubeconfig - - contains: - path: spec.template.spec.initContainers[0].volumeMounts - content: - name: kubeconfig - mountPath: /etc/kubernetes/kubeconfig - readOnly: true - - - it: wait-for-kubeconfig defaults to bundled busybox digest pin - template: templates/cluster-autoscaler/deployment.yaml - documentSelector: - path: kind - value: Deployment - asserts: - - matchRegex: - path: spec.template.spec.initContainers[0].image - pattern: '^docker\.io/library/busybox:[^@]+@sha256:[0-9a-f]{64}$' - - - it: wait-for-kubeconfig honours images.waitForKubeconfig override - template: templates/cluster-autoscaler/deployment.yaml - documentSelector: - path: kind - value: Deployment - set: - images: - waitForKubeconfig: "registry.example.test/library/busybox:1.37.0@sha256:0000000000000000000000000000000000000000000000000000000000000000" - asserts: - - equal: - path: spec.template.spec.initContainers[0].image - value: "registry.example.test/library/busybox:1.37.0@sha256:0000000000000000000000000000000000000000000000000000000000000000" - - - it: cluster.yaml renders and wires dataStoreName when tenant has etcd - template: templates/cluster.yaml - documentSelector: - path: kind - value: KamajiControlPlane - asserts: - - equal: - path: spec.dataStoreName - value: tenant-root - - - it: cluster.yaml skips Cluster resources when tenant has no etcd DataStore - # Must NOT fail rendering - the parent Tenant chart populates - # _namespace.etcd asynchronously, so rendering failures here would cause - # flux install remediation on every cold bootstrap. Instead, emit only a - # ConfigMap status beacon so the HelmRelease reports Ready while flux - # retries on its interval until the DataStore appears. - template: templates/cluster.yaml - set: - _namespace: - etcd: "" - monitoring: "" - ingress: "" - seaweedfs: "" - host: "" - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ConfigMap - - equal: - path: metadata.name - value: test-awaiting-etcd - - equal: - path: data.status - value: awaiting-etcd diff --git a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml deleted file mode 100644 index 44528470..00000000 --- a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml +++ /dev/null @@ -1,99 +0,0 @@ -suite: GPU Operator HelmRelease HAMi integration tests -templates: - - templates/helmreleases/gpu-operator.yaml -values: - - values-ci.yaml -tests: - - it: should disable devicePlugin when hami is enabled - set: - addons: - gpuOperator: - enabled: true - valuesOverride: {} - hami: - enabled: true - valuesOverride: {} - asserts: - - equal: - path: spec.values.gpu-operator.devicePlugin.enabled - value: false - - - it: should not have values when hami is disabled and no overrides - set: - addons: - gpuOperator: - enabled: true - valuesOverride: {} - hami: - enabled: false - valuesOverride: {} - asserts: - - notExists: - path: spec.values - - - it: should apply hami defaults when valuesOverride key is omitted - set: - addons: - gpuOperator: - enabled: true - hami: - enabled: true - asserts: - - equal: - path: spec.values.gpu-operator.devicePlugin.enabled - value: false - - - it: should allow user overrides to merge with hami defaults - set: - addons: - gpuOperator: - enabled: true - valuesOverride: - gpu-operator: - driver: - enabled: false - hami: - enabled: true - valuesOverride: {} - asserts: - - equal: - path: spec.values.gpu-operator.devicePlugin.enabled - value: false - - equal: - path: spec.values.gpu-operator.driver.enabled - value: false - - - it: should let user explicitly override devicePlugin.enabled to true with hami enabled - set: - addons: - gpuOperator: - enabled: true - valuesOverride: - gpu-operator: - devicePlugin: - enabled: true - driver: - enabled: false - hami: - enabled: true - valuesOverride: {} - asserts: - - equal: - path: spec.values.gpu-operator.devicePlugin.enabled - value: true - - equal: - path: spec.values.gpu-operator.driver.enabled - value: false - - - it: should not render when gpuOperator is disabled - set: - addons: - gpuOperator: - enabled: false - valuesOverride: {} - hami: - enabled: false - valuesOverride: {} - asserts: - - hasDocuments: - count: 0 diff --git a/packages/apps/kubernetes/tests/hami_test.yaml b/packages/apps/kubernetes/tests/hami_test.yaml deleted file mode 100644 index 27f7c75b..00000000 --- a/packages/apps/kubernetes/tests/hami_test.yaml +++ /dev/null @@ -1,153 +0,0 @@ -suite: HAMi HelmRelease tests -templates: - - templates/helmreleases/hami.yaml -values: - - values-ci.yaml -tests: - - it: should not render when hami is disabled - set: - addons: - hami: - enabled: false - valuesOverride: {} - gpuOperator: - enabled: true - valuesOverride: {} - asserts: - - hasDocuments: - count: 0 - - - it: should render HelmRelease when hami is enabled - set: - addons: - hami: - enabled: true - valuesOverride: {} - gpuOperator: - enabled: true - valuesOverride: {} - asserts: - - hasDocuments: - count: 1 - - isKind: - of: HelmRelease - - - it: should fail when gpuOperator is not enabled - set: - addons: - hami: - enabled: true - valuesOverride: {} - gpuOperator: - enabled: false - valuesOverride: {} - asserts: - - failedTemplate: - errorMessage: "addons.hami requires addons.gpuOperator to be enabled" - - - it: should have correct metadata labels - set: - addons: - hami: - enabled: true - valuesOverride: {} - gpuOperator: - enabled: true - valuesOverride: {} - asserts: - - equal: - path: metadata.labels["cozystack.io/repository"] - value: system - - equal: - path: metadata.labels["sharding.fluxcd.io/key"] - value: tenants - - - it: should use ExternalArtifact chartRef - set: - addons: - hami: - enabled: true - valuesOverride: {} - gpuOperator: - enabled: true - valuesOverride: {} - asserts: - - equal: - path: spec.chartRef.kind - value: ExternalArtifact - - equal: - path: spec.chartRef.namespace - value: cozy-system - - - it: should target cozy-hami namespace - set: - addons: - hami: - enabled: true - valuesOverride: {} - gpuOperator: - enabled: true - valuesOverride: {} - asserts: - - equal: - path: spec.targetNamespace - value: cozy-hami - - equal: - path: spec.storageNamespace - value: cozy-hami - - - it: should depend on gpu-operator and cilium - release: - name: test - namespace: test-ns - set: - addons: - hami: - enabled: true - valuesOverride: {} - gpuOperator: - enabled: true - valuesOverride: {} - asserts: - - contains: - path: spec.dependsOn - content: - name: test-cilium - namespace: test-ns - - contains: - path: spec.dependsOn - content: - name: test-gpu-operator - namespace: test-ns - - - it: should not render spec.values when valuesOverride is empty - set: - addons: - hami: - enabled: true - valuesOverride: {} - gpuOperator: - enabled: true - valuesOverride: {} - asserts: - - hasDocuments: - count: 1 - - notExists: - path: spec.values - - - it: should pass through valuesOverride - set: - addons: - hami: - enabled: true - valuesOverride: - hami: - devicePlugin: - deviceSplitCount: 5 - gpuOperator: - enabled: true - valuesOverride: {} - asserts: - - equal: - path: spec.values.hami.devicePlugin.deviceSplitCount - value: 5 diff --git a/packages/apps/kubernetes/tests/values-ci-no-etcd.yaml b/packages/apps/kubernetes/tests/values-ci-no-etcd.yaml deleted file mode 100644 index c7c8196f..00000000 --- a/packages/apps/kubernetes/tests/values-ci-no-etcd.yaml +++ /dev/null @@ -1,9 +0,0 @@ -_namespace: - etcd: "" - monitoring: "" - ingress: "" - seaweedfs: "" - host: "" -_cluster: - cluster-domain: cozy.local -nodeGroups: null diff --git a/packages/apps/kubernetes/tests/values-ci.yaml b/packages/apps/kubernetes/tests/values-ci.yaml deleted file mode 100644 index 13365e8c..00000000 --- a/packages/apps/kubernetes/tests/values-ci.yaml +++ /dev/null @@ -1,9 +0,0 @@ -_namespace: - etcd: tenant-root - monitoring: "" - ingress: "" - seaweedfs: "" - host: "" -_cluster: - cluster-domain: cozy.local -nodeGroups: null diff --git a/packages/apps/kubernetes/values.schema.json b/packages/apps/kubernetes/values.schema.json index a43deaec..15f600a8 100644 --- a/packages/apps/kubernetes/values.schema.json +++ b/packages/apps/kubernetes/values.schema.json @@ -2,142 +2,6 @@ "title": "Chart Values", "type": "object", "properties": { - "storageClass": { - "description": "StorageClass used to store the data.", - "type": "string", - "default": "replicated" - }, - "nodeGroups": { - "description": "Worker nodes configuration map.", - "type": "object", - "default": { - "md0": { - "ephemeralStorage": "20Gi", - "gpus": [], - "instanceType": "u1.medium", - "maxReplicas": 10, - "minReplicas": 0, - "resources": {}, - "roles": [ - "ingress-nginx" - ] - } - }, - "additionalProperties": { - "type": "object", - "required": [ - "ephemeralStorage", - "instanceType", - "maxReplicas", - "minReplicas", - "resources" - ], - "properties": { - "ephemeralStorage": { - "description": "Ephemeral storage size.", - "default": "20Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "gpus": { - "description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).", - "type": "array", - "items": { - "type": "object", - "required": [ - "name" - ], - "properties": { - "name": { - "description": "Name of GPU, such as \"nvidia.com/AD102GL_L40S\".", - "type": "string" - } - } - } - }, - "instanceType": { - "description": "Virtual machine instance type.", - "type": "string", - "default": "u1.medium" - }, - "maxReplicas": { - "description": "Maximum number of replicas.", - "type": "integer", - "default": 10 - }, - "minReplicas": { - "description": "Minimum number of replicas.", - "type": "integer", - "default": 0 - }, - "resources": { - "description": "CPU and memory resources for each worker node.", - "type": "object", - "properties": { - "cpu": { - "description": "CPU available.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Memory (RAM) available.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "roles": { - "description": "List of node roles.", - "type": "array", - "items": { - "type": "string" - } - } - } - } - }, - "version": { - "description": "Kubernetes major.minor version to deploy", - "type": "string", - "default": "v1.35", - "enum": [ - "v1.35", - "v1.34", - "v1.33", - "v1.32", - "v1.31", - "v1.30" - ] - }, - "host": { - "description": "External hostname for Kubernetes cluster. Defaults to `\u003ccluster-name\u003e.\u003ctenant-host\u003e` if empty.", - "type": "string", - "default": "" - }, "addons": { "description": "Cluster addons configuration.", "type": "object", @@ -149,7 +13,6 @@ "fluxcd", "gatewayAPI", "gpuOperator", - "hami", "ingressNginx", "monitoringAgents", "velero", @@ -269,28 +132,6 @@ } } }, - "hami": { - "description": "HAMi GPU virtualization middleware.", - "type": "object", - "default": {}, - "required": [ - "enabled", - "valuesOverride" - ], - "properties": { - "enabled": { - "description": "Enable HAMi (requires GPU Operator).", - "type": "boolean", - "default": false - }, - "valuesOverride": { - "description": "Custom Helm values overrides.", - "type": "object", - "default": {}, - "x-kubernetes-preserve-unknown-fields": true - } - } - }, "ingressNginx": { "description": "Ingress-NGINX controller.", "type": "object", @@ -654,17 +495,141 @@ } } }, - "images": { - "description": "Optional image overrides for air-gapped or rate-limited registries.", + "host": { + "description": "External hostname for Kubernetes cluster. Defaults to `\u003ccluster-name\u003e.\u003ctenant-host\u003e` if empty.", + "type": "string", + "default": "" + }, + "nodeGroups": { + "description": "Worker nodes configuration map.", "type": "object", - "default": {}, - "properties": { - "waitForKubeconfig": { - "description": "Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.", - "type": "string", - "default": "" + "default": { + "md0": { + "ephemeralStorage": "20Gi", + "gpus": [], + "instanceType": "u1.medium", + "maxReplicas": 10, + "minReplicas": 0, + "resources": {}, + "roles": [ + "ingress-nginx" + ] + } + }, + "additionalProperties": { + "type": "object", + "required": [ + "ephemeralStorage", + "instanceType", + "maxReplicas", + "minReplicas", + "resources" + ], + "properties": { + "ephemeralStorage": { + "description": "Ephemeral storage size.", + "default": "20Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "gpus": { + "description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).", + "type": "array", + "items": { + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "description": "Name of GPU, such as \"nvidia.com/AD102GL_L40S\".", + "type": "string" + } + } + } + }, + "instanceType": { + "description": "Virtual machine instance type.", + "type": "string", + "default": "u1.medium" + }, + "maxReplicas": { + "description": "Maximum number of replicas.", + "type": "integer", + "default": 10 + }, + "minReplicas": { + "description": "Minimum number of replicas.", + "type": "integer", + "default": 0 + }, + "resources": { + "description": "CPU and memory resources for each worker node.", + "type": "object", + "properties": { + "cpu": { + "description": "CPU available.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "memory": { + "description": "Memory (RAM) available.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, + "roles": { + "description": "List of node roles.", + "type": "array", + "items": { + "type": "string" + } + } } } + }, + "storageClass": { + "description": "StorageClass used to store the data.", + "type": "string", + "default": "replicated" + }, + "version": { + "description": "Kubernetes major.minor version to deploy", + "type": "string", + "default": "v1.35", + "enum": [ + "v1.35", + "v1.34", + "v1.33", + "v1.32", + "v1.31", + "v1.30" + ] } } -} +} \ No newline at end of file diff --git a/packages/apps/kubernetes/values.yaml b/packages/apps/kubernetes/values.yaml index d609476c..a67b5d69 100644 --- a/packages/apps/kubernetes/values.yaml +++ b/packages/apps/kubernetes/values.yaml @@ -94,10 +94,6 @@ host: "" ## @field {bool} enabled - Enable FluxCD. ## @field {object} valuesOverride - Custom Helm values overrides. -## @typedef {struct} HAMiAddon - HAMi GPU virtualization middleware. -## @field {bool} enabled - Enable HAMi (requires GPU Operator). -## @field {object} valuesOverride - Custom Helm values overrides. - ## @typedef {struct} MonitoringAgentsAddon - Monitoring agents (Fluent Bit, VMAgents). ## @field {bool} enabled - Enable monitoring agents. ## @field {object} valuesOverride - Custom Helm values overrides. @@ -118,7 +114,6 @@ host: "" ## @field {GatewayAPIAddon} gatewayAPI - Gateway API addon. ## @field {IngressNginxAddon} ingressNginx - Ingress-NGINX controller. ## @field {GPUOperatorAddon} gpuOperator - NVIDIA GPU Operator. -## @field {HAMiAddon} hami - HAMi GPU virtualization middleware. ## @field {FluxCDAddon} fluxcd - FluxCD GitOps operator. ## @field {MonitoringAgentsAddon} monitoringAgents - Monitoring agents. ## @field {VerticalPodAutoscalerAddon} verticalPodAutoscaler - Vertical Pod Autoscaler. @@ -142,9 +137,6 @@ addons: gpuOperator: enabled: false valuesOverride: {} - hami: - enabled: false - valuesOverride: {} fluxcd: enabled: false valuesOverride: {} @@ -205,10 +197,3 @@ controlPlane: server: resources: {} resourcesPreset: "micro" - -## @typedef {struct} Images - Optional image overrides for chart-internal helpers. -## @field {string} [waitForKubeconfig] - Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag. - -## @param {Images} images - Optional image overrides for air-gapped or rate-limited registries. -images: - waitForKubeconfig: "" diff --git a/packages/apps/mariadb/Makefile b/packages/apps/mariadb/Makefile index 9833f302..e8f02703 100644 --- a/packages/apps/mariadb/Makefile +++ b/packages/apps/mariadb/Makefile @@ -4,7 +4,7 @@ include ../../../hack/common-envs.mk include ../../../hack/package.mk generate: - cozyvalues-gen -m 'mariadb' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/mariadb/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh update: diff --git a/packages/apps/mariadb/README.md b/packages/apps/mariadb/README.md index 9d97dc5f..bb3ea8ac 100644 --- a/packages/apps/mariadb/README.md +++ b/packages/apps/mariadb/README.md @@ -15,7 +15,7 @@ This managed service is controlled by mariadb-operator, ensuring efficient manag ### How to switch master/slave replica ```bash -kubectl edit mariadb +kubectl edit mariadb ``` update: @@ -54,11 +54,11 @@ more details: - **Replication can't be finished with various errors** - **Replication can't be finished in case if `binlog` purged** - Until `mariadbbackup` is not used to bootstrap a node by mariadb-operator (this feature is not implemented yet), follow these manual steps to fix it: + Until `mariadbbackup` is not used to bootstrap a node by mariadb-operator (this feature is not inmplemented yet), follow these manual steps to fix it: https://github.com/mariadb-operator/mariadb-operator/issues/141#issuecomment-1804760231 -- **Corrupted indices** - Sometimes some indices can be corrupted on master replica, you can recover them from slave: +- **Corrupted indicies** + Sometimes some indecies can be corrupted on master replica, you can recover them from slave: ```bash mysqldump -h -P 3306 -u -p --column-statistics=0 ~/tmp/fix-table.sql diff --git a/packages/apps/mariadb/templates/backup-cronjob.yaml b/packages/apps/mariadb/templates/backup-cronjob.yaml index ddb237cd..97b52208 100644 --- a/packages/apps/mariadb/templates/backup-cronjob.yaml +++ b/packages/apps/mariadb/templates/backup-cronjob.yaml @@ -13,6 +13,9 @@ spec: jobTemplate: spec: backoffLimit: 2 + template: + spec: + restartPolicy: OnFailure template: metadata: annotations: @@ -41,7 +44,7 @@ spec: name: {{ .Release.Name }} key: root-password - name: MYSQL_HOST - value: "{{ .Release.Name }}-{{ if eq (int .Values.replicas) 1 }}primary{{ else }}secondary{{ end }}" + value: {{ .Release.Name }}-secondary - name: AWS_ACCESS_KEY_ID valueFrom: secretKeyRef: diff --git a/packages/apps/mariadb/templates/mariadb.yaml b/packages/apps/mariadb/templates/mariadb.yaml index d3d5e636..8a530134 100644 --- a/packages/apps/mariadb/templates/mariadb.yaml +++ b/packages/apps/mariadb/templates/mariadb.yaml @@ -29,11 +29,13 @@ spec: - {{ .Release.Name }} topologyKey: "kubernetes.io/hostname" + {{- if gt (int .Values.replicas) 1 }} replication: enabled: true #primary: # podIndex: 0 # automaticFailover: true + {{- end }} podMetadata: labels: @@ -63,6 +65,9 @@ spec: metadata: labels: app.kubernetes.io/instance: {{ $.Release.Name }} + {{- if and .Values.external (eq (int .Values.replicas) 1) }} + type: LoadBalancer + {{- end }} storage: size: {{ .Values.size }} resizeInUseVolumes: true @@ -71,7 +76,7 @@ spec: storageClassName: {{ . }} {{- end }} - {{- if .Values.external }} + {{- if and .Values.external (gt (int .Values.replicas) 1) }} primaryService: type: LoadBalancer {{- end }} diff --git a/packages/apps/mariadb/templates/workloadmonitor.yaml b/packages/apps/mariadb/templates/workloadmonitor.yaml index 36cb59f0..b69139bf 100644 --- a/packages/apps/mariadb/templates/workloadmonitor.yaml +++ b/packages/apps/mariadb/templates/workloadmonitor.yaml @@ -3,8 +3,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }} - labels: - workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }} spec: replicas: {{ .Values.replicas }} minReplicas: 1 diff --git a/packages/apps/mariadb/values.schema.json b/packages/apps/mariadb/values.schema.json index 49df40f0..31c56378 100644 --- a/packages/apps/mariadb/values.schema.json +++ b/packages/apps/mariadb/values.schema.json @@ -2,6 +2,98 @@ "title": "Chart Values", "type": "object", "properties": { + "backup": { + "description": "Backup configuration.", + "type": "object", + "default": {}, + "required": [ + "cleanupStrategy", + "enabled", + "resticPassword", + "s3AccessKey", + "s3Bucket", + "s3Region", + "s3SecretKey", + "schedule" + ], + "properties": { + "cleanupStrategy": { + "description": "Retention strategy for cleaning up old backups.", + "type": "string", + "default": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m" + }, + "enabled": { + "description": "Enable regular backups (default: false).", + "type": "boolean", + "default": false + }, + "resticPassword": { + "description": "Password for Restic backup encryption.", + "type": "string", + "default": "\u003cpassword\u003e" + }, + "s3AccessKey": { + "description": "Access key for S3 authentication.", + "type": "string", + "default": "\u003cyour-access-key\u003e" + }, + "s3Bucket": { + "description": "S3 bucket used for storing backups.", + "type": "string", + "default": "s3.example.org/mariadb-backups" + }, + "s3Region": { + "description": "AWS S3 region where backups are stored.", + "type": "string", + "default": "us-east-1" + }, + "s3SecretKey": { + "description": "Secret key for S3 authentication.", + "type": "string", + "default": "\u003cyour-secret-key\u003e" + }, + "schedule": { + "description": "Cron schedule for automated backups.", + "type": "string", + "default": "0 2 * * *" + } + } + }, + "databases": { + "description": "Databases configuration map.", + "type": "object", + "default": {}, + "additionalProperties": { + "type": "object", + "properties": { + "roles": { + "description": "Roles assigned to users.", + "type": "object", + "properties": { + "admin": { + "description": "List of users with admin privileges.", + "type": "array", + "items": { + "type": "string" + } + }, + "readonly": { + "description": "List of users with read-only privileges.", + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + }, + "external": { + "description": "Enable external access from outside the cluster.", + "type": "boolean", + "default": false + }, "replicas": { "description": "Number of MariaDB replicas.", "type": "integer", @@ -73,22 +165,6 @@ "type": "string", "default": "" }, - "external": { - "description": "Enable external access from outside the cluster.", - "type": "boolean", - "default": false - }, - "version": { - "description": "MariaDB major.minor version to deploy", - "type": "string", - "default": "v11.8", - "enum": [ - "v11.8", - "v11.4", - "v10.11", - "v10.6" - ] - }, "users": { "description": "Users configuration map.", "type": "object", @@ -111,92 +187,16 @@ } } }, - "databases": { - "description": "Databases configuration map.", - "type": "object", - "default": {}, - "additionalProperties": { - "type": "object", - "properties": { - "roles": { - "description": "Roles assigned to users.", - "type": "object", - "properties": { - "admin": { - "description": "List of users with admin privileges.", - "type": "array", - "items": { - "type": "string" - } - }, - "readonly": { - "description": "List of users with read-only privileges.", - "type": "array", - "items": { - "type": "string" - } - } - } - } - } - } - }, - "backup": { - "description": "Backup configuration.", - "type": "object", - "default": {}, - "required": [ - "cleanupStrategy", - "enabled", - "resticPassword", - "s3AccessKey", - "s3Bucket", - "s3Region", - "s3SecretKey", - "schedule" - ], - "properties": { - "cleanupStrategy": { - "description": "Retention strategy for cleaning up old backups.", - "type": "string", - "default": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m" - }, - "enabled": { - "description": "Enable regular backups (default: false).", - "type": "boolean", - "default": false - }, - "resticPassword": { - "description": "Password for Restic backup encryption.", - "type": "string", - "default": "\u003cpassword\u003e" - }, - "s3AccessKey": { - "description": "Access key for S3 authentication.", - "type": "string", - "default": "\u003cyour-access-key\u003e" - }, - "s3Bucket": { - "description": "S3 bucket used for storing backups.", - "type": "string", - "default": "s3.example.org/mariadb-backups" - }, - "s3Region": { - "description": "AWS S3 region where backups are stored.", - "type": "string", - "default": "us-east-1" - }, - "s3SecretKey": { - "description": "Secret key for S3 authentication.", - "type": "string", - "default": "\u003cyour-secret-key\u003e" - }, - "schedule": { - "description": "Cron schedule for automated backups.", - "type": "string", - "default": "0 2 * * *" - } - } + "version": { + "description": "MariaDB major.minor version to deploy", + "type": "string", + "default": "v11.8", + "enum": [ + "v11.8", + "v11.4", + "v10.11", + "v10.6" + ] } } -} +} \ No newline at end of file diff --git a/packages/apps/mongodb/Makefile b/packages/apps/mongodb/Makefile index 37f30ccc..9440c3fd 100644 --- a/packages/apps/mongodb/Makefile +++ b/packages/apps/mongodb/Makefile @@ -3,7 +3,7 @@ include ../../../hack/package.mk .PHONY: generate update generate: - cozyvalues-gen -m 'mongodb' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/mongodb/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh update: diff --git a/packages/apps/mongodb/templates/mongodb.yaml b/packages/apps/mongodb/templates/mongodb.yaml index 9273e506..67969758 100644 --- a/packages/apps/mongodb/templates/mongodb.yaml +++ b/packages/apps/mongodb/templates/mongodb.yaml @@ -169,8 +169,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ .Release.Name }} - labels: - workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }} spec: {{- if .Values.sharding }} {{- $totalReplicas := 0 }} diff --git a/packages/apps/mongodb/values.schema.json b/packages/apps/mongodb/values.schema.json index 2d077cfc..3a66d60d 100644 --- a/packages/apps/mongodb/values.schema.json +++ b/packages/apps/mongodb/values.schema.json @@ -2,6 +2,112 @@ "title": "Chart Values", "type": "object", "properties": { + "backup": { + "description": "Backup configuration.", + "type": "object", + "default": {}, + "required": [ + "enabled" + ], + "properties": { + "destinationPath": { + "description": "Destination path for backups (e.g. s3://bucket/path/).", + "type": "string", + "default": "s3://bucket/path/to/folder/" + }, + "enabled": { + "description": "Enable regular backups.", + "type": "boolean", + "default": false + }, + "endpointURL": { + "description": "S3 endpoint URL for uploads.", + "type": "string", + "default": "http://minio-gateway-service:9000" + }, + "retentionPolicy": { + "description": "Retention policy (e.g. \"30d\").", + "type": "string", + "default": "30d" + }, + "s3AccessKey": { + "description": "Access key for S3 authentication.", + "type": "string", + "default": "" + }, + "s3SecretKey": { + "description": "Secret key for S3 authentication.", + "type": "string", + "default": "" + }, + "schedule": { + "description": "Cron schedule for automated backups.", + "type": "string", + "default": "0 2 * * *" + } + } + }, + "bootstrap": { + "description": "Bootstrap configuration.", + "type": "object", + "default": {}, + "required": [ + "backupName", + "enabled" + ], + "properties": { + "backupName": { + "description": "Name of backup to restore from.", + "type": "string", + "default": "" + }, + "enabled": { + "description": "Whether to restore from a backup.", + "type": "boolean", + "default": false + }, + "recoveryTime": { + "description": "Timestamp for point-in-time recovery; empty means latest.", + "type": "string", + "default": "" + } + } + }, + "databases": { + "description": "Databases configuration map.", + "type": "object", + "default": {}, + "additionalProperties": { + "type": "object", + "properties": { + "roles": { + "description": "Roles assigned to users.", + "type": "object", + "properties": { + "admin": { + "description": "List of users with admin privileges (readWrite + dbAdmin).", + "type": "array", + "items": { + "type": "string" + } + }, + "readonly": { + "description": "List of users with read-only privileges.", + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + }, + "external": { + "description": "Enable external access from outside the cluster.", + "type": "boolean", + "default": false + }, "replicas": { "description": "Number of MongoDB replicas in replica set.", "type": "integer", @@ -54,40 +160,6 @@ "2xlarge" ] }, - "size": { - "description": "Persistent Volume Claim size available for application data.", - "default": "10Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "storageClass": { - "description": "StorageClass used to store the data.", - "type": "string", - "default": "" - }, - "external": { - "description": "Enable external access from outside the cluster.", - "type": "boolean", - "default": false - }, - "version": { - "description": "MongoDB major version to deploy.", - "type": "string", - "default": "v8", - "enum": [ - "v8", - "v7", - "v6" - ] - }, "sharding": { "description": "Enable sharded cluster mode. When disabled, deploys a replica set.", "type": "boolean", @@ -171,6 +243,25 @@ } } }, + "size": { + "description": "Persistent Volume Claim size available for application data.", + "default": "10Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "storageClass": { + "description": "StorageClass used to store the data.", + "type": "string", + "default": "" + }, "users": { "description": "Users configuration map.", "type": "object", @@ -185,106 +276,15 @@ } } }, - "databases": { - "description": "Databases configuration map.", - "type": "object", - "default": {}, - "additionalProperties": { - "type": "object", - "properties": { - "roles": { - "description": "Roles assigned to users.", - "type": "object", - "properties": { - "admin": { - "description": "List of users with admin privileges (readWrite + dbAdmin).", - "type": "array", - "items": { - "type": "string" - } - }, - "readonly": { - "description": "List of users with read-only privileges.", - "type": "array", - "items": { - "type": "string" - } - } - } - } - } - } - }, - "backup": { - "description": "Backup configuration.", - "type": "object", - "default": {}, - "required": [ - "enabled" - ], - "properties": { - "destinationPath": { - "description": "Destination path for backups (e.g. s3://bucket/path/).", - "type": "string", - "default": "s3://bucket/path/to/folder/" - }, - "enabled": { - "description": "Enable regular backups.", - "type": "boolean", - "default": false - }, - "endpointURL": { - "description": "S3 endpoint URL for uploads.", - "type": "string", - "default": "http://minio-gateway-service:9000" - }, - "retentionPolicy": { - "description": "Retention policy (e.g. \"30d\").", - "type": "string", - "default": "30d" - }, - "s3AccessKey": { - "description": "Access key for S3 authentication.", - "type": "string", - "default": "" - }, - "s3SecretKey": { - "description": "Secret key for S3 authentication.", - "type": "string", - "default": "" - }, - "schedule": { - "description": "Cron schedule for automated backups.", - "type": "string", - "default": "0 2 * * *" - } - } - }, - "bootstrap": { - "description": "Bootstrap configuration.", - "type": "object", - "default": {}, - "required": [ - "backupName", - "enabled" - ], - "properties": { - "backupName": { - "description": "Name of backup to restore from.", - "type": "string", - "default": "" - }, - "enabled": { - "description": "Whether to restore from a backup.", - "type": "boolean", - "default": false - }, - "recoveryTime": { - "description": "Timestamp for point-in-time recovery; empty means latest.", - "type": "string", - "default": "" - } - } + "version": { + "description": "MongoDB major version to deploy.", + "type": "string", + "default": "v8", + "enum": [ + "v8", + "v7", + "v6" + ] } } -} +} \ No newline at end of file diff --git a/packages/apps/nats/Makefile b/packages/apps/nats/Makefile index 29f6f9bc..d1cfda8e 100644 --- a/packages/apps/nats/Makefile +++ b/packages/apps/nats/Makefile @@ -1,5 +1,5 @@ include ../../../hack/package.mk generate: - cozyvalues-gen -m 'nats' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/nats/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh diff --git a/packages/apps/nats/templates/workloadmonitor.yaml b/packages/apps/nats/templates/workloadmonitor.yaml index cb20b4a6..43d64a46 100644 --- a/packages/apps/nats/templates/workloadmonitor.yaml +++ b/packages/apps/nats/templates/workloadmonitor.yaml @@ -3,8 +3,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }} - labels: - workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }} spec: replicas: {{ .Values.replicas }} minReplicas: 1 diff --git a/packages/apps/nats/values.schema.json b/packages/apps/nats/values.schema.json index 605c8752..3ef5fef7 100644 --- a/packages/apps/nats/values.schema.json +++ b/packages/apps/nats/values.schema.json @@ -2,6 +2,60 @@ "title": "Chart Values", "type": "object", "properties": { + "config": { + "description": "NATS configuration.", + "type": "object", + "default": {}, + "properties": { + "merge": { + "description": "Additional configuration to merge into NATS config.", + "type": "object", + "default": {}, + "x-kubernetes-preserve-unknown-fields": true + }, + "resolver": { + "description": "Additional resolver configuration to merge into NATS config.", + "type": "object", + "default": {}, + "x-kubernetes-preserve-unknown-fields": true + } + } + }, + "external": { + "description": "Enable external access from outside the cluster.", + "type": "boolean", + "default": false + }, + "jetstream": { + "description": "Jetstream configuration.", + "type": "object", + "default": {}, + "required": [ + "enabled", + "size" + ], + "properties": { + "enabled": { + "description": "Enable or disable Jetstream for persistent messaging in NATS.", + "type": "boolean", + "default": true + }, + "size": { + "description": "Jetstream persistent storage size.", + "default": "10Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, "replicas": { "description": "Number of replicas.", "type": "integer", @@ -59,11 +113,6 @@ "type": "string", "default": "" }, - "external": { - "description": "Enable external access from outside the cluster.", - "type": "boolean", - "default": false - }, "users": { "description": "Users configuration map.", "type": "object", @@ -77,55 +126,6 @@ } } } - }, - "jetstream": { - "description": "Jetstream configuration.", - "type": "object", - "default": {}, - "required": [ - "enabled", - "size" - ], - "properties": { - "enabled": { - "description": "Enable or disable Jetstream for persistent messaging in NATS.", - "type": "boolean", - "default": true - }, - "size": { - "description": "Jetstream persistent storage size.", - "default": "10Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "config": { - "description": "NATS configuration.", - "type": "object", - "default": {}, - "properties": { - "merge": { - "description": "Additional configuration to merge into NATS config.", - "type": "object", - "default": {}, - "x-kubernetes-preserve-unknown-fields": true - }, - "resolver": { - "description": "Additional resolver configuration to merge into NATS config.", - "type": "object", - "default": {}, - "x-kubernetes-preserve-unknown-fields": true - } - } } } -} +} \ No newline at end of file diff --git a/packages/apps/openbao/Makefile b/packages/apps/openbao/Makefile index b9530139..d1cfda8e 100644 --- a/packages/apps/openbao/Makefile +++ b/packages/apps/openbao/Makefile @@ -1,5 +1,5 @@ include ../../../hack/package.mk generate: - cozyvalues-gen -m 'openbao' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/openbao/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh diff --git a/packages/apps/openbao/templates/workloadmonitor.yaml b/packages/apps/openbao/templates/workloadmonitor.yaml index 56f9ec8e..0a9acf76 100644 --- a/packages/apps/openbao/templates/workloadmonitor.yaml +++ b/packages/apps/openbao/templates/workloadmonitor.yaml @@ -3,8 +3,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }} - labels: - workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }} spec: replicas: {{ .Values.replicas }} minReplicas: 1 diff --git a/packages/apps/openbao/values.schema.json b/packages/apps/openbao/values.schema.json index 9b32ddd6..b48f28a6 100644 --- a/packages/apps/openbao/values.schema.json +++ b/packages/apps/openbao/values.schema.json @@ -2,6 +2,11 @@ "title": "Chart Values", "type": "object", "properties": { + "external": { + "description": "Enable external access from outside the cluster.", + "type": "boolean", + "default": false + }, "replicas": { "description": "Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas \u003e 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.", "type": "integer", @@ -73,15 +78,10 @@ "type": "string", "default": "" }, - "external": { - "description": "Enable external access from outside the cluster.", - "type": "boolean", - "default": false - }, "ui": { "description": "Enable the OpenBAO web UI.", "type": "boolean", "default": true } } -} +} \ No newline at end of file diff --git a/packages/apps/opensearch/.helmignore b/packages/apps/opensearch/.helmignore deleted file mode 100644 index 0e8a0eb3..00000000 --- a/packages/apps/opensearch/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/packages/apps/opensearch/Chart.yaml b/packages/apps/opensearch/Chart.yaml deleted file mode 100644 index 8abefadf..00000000 --- a/packages/apps/opensearch/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: opensearch -description: Managed OpenSearch service -icon: /logos/opensearch.svg -type: application -version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process -appVersion: "2.11.1" diff --git a/packages/apps/opensearch/Makefile b/packages/apps/opensearch/Makefile deleted file mode 100644 index 1781661f..00000000 --- a/packages/apps/opensearch/Makefile +++ /dev/null @@ -1,11 +0,0 @@ -include ../../../hack/package.mk - -.PHONY: generate update - -generate: - cozyvalues-gen -m 'opensearch' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/opensearch/types.go - ../../../hack/update-crd.sh - -update: - hack/update-versions.sh - $(MAKE) generate diff --git a/packages/apps/opensearch/README.md b/packages/apps/opensearch/README.md deleted file mode 100644 index d968c665..00000000 --- a/packages/apps/opensearch/README.md +++ /dev/null @@ -1,60 +0,0 @@ -# Managed OpenSearch Service - -## Parameters - -### Common parameters - -| Name | Description | Type | Value | -| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------- | ------- | -| `replicas` | Number of OpenSearch nodes in the cluster. | `int` | `3` | -| `resources` | Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied. | `object` | `{}` | -| `resources.cpu` | CPU available to each node. | `quantity` | `""` | -| `resources.memory` | Memory (RAM) available to each node. | `quantity` | `""` | -| `resourcesPreset` | Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory. | `string` | `large` | -| `size` | Persistent Volume Claim size available for application data. | `quantity` | `10Gi` | -| `storageClass` | StorageClass used to store the data. | `string` | `""` | -| `external` | Enable external access from outside the cluster. | `bool` | `false` | -| `topologySpreadPolicy` | How strictly to enforce pod distribution across nodes and zones. | `string` | `soft` | -| `version` | OpenSearch major version to deploy. | `string` | `v2` | - - -### Image configuration - -| Name | Description | Type | Value | -| ------------------- | -------------------------------------- | -------- | ----- | -| `images` | Container images used by the operator. | `object` | `{}` | -| `images.opensearch` | OpenSearch image. | `string` | `""` | - - -### Node roles configuration - -| Name | Description | Type | Value | -| ------------------ | ----------------------------- | -------- | ------- | -| `nodeRoles` | Node roles configuration. | `object` | `{}` | -| `nodeRoles.master` | Enable cluster_manager role. | `bool` | `true` | -| `nodeRoles.data` | Enable data role. | `bool` | `true` | -| `nodeRoles.ingest` | Enable ingest role. | `bool` | `true` | -| `nodeRoles.ml` | Enable machine learning role. | `bool` | `false` | - - -### Users configuration - -| Name | Description | Type | Value | -| ---------------------- | -------------------------------------------------- | ------------------- | ----- | -| `users` | Custom OpenSearch users configuration map. | `map[string]object` | `{}` | -| `users[name].password` | Password for the user (auto-generated if omitted). | `string` | `""` | -| `users[name].roles` | List of OpenSearch roles. | `[]string` | `[]` | - - -### OpenSearch Dashboards configuration - -| Name | Description | Type | Value | -| ----------------------------- | ----------------------------------------------------- | ---------- | -------- | -| `dashboards` | OpenSearch Dashboards configuration. | `object` | `{}` | -| `dashboards.enabled` | Enable OpenSearch Dashboards deployment. | `bool` | `false` | -| `dashboards.replicas` | Number of Dashboards replicas. | `int` | `1` | -| `dashboards.resources` | Explicit CPU and memory configuration for Dashboards. | `object` | `{}` | -| `dashboards.resources.cpu` | CPU available to each node. | `quantity` | `""` | -| `dashboards.resources.memory` | Memory (RAM) available to each node. | `quantity` | `""` | -| `dashboards.resourcesPreset` | Default sizing preset for Dashboards. | `string` | `medium` | - diff --git a/packages/apps/opensearch/charts/cozy-lib b/packages/apps/opensearch/charts/cozy-lib deleted file mode 120000 index e1813509..00000000 --- a/packages/apps/opensearch/charts/cozy-lib +++ /dev/null @@ -1 +0,0 @@ -../../../library/cozy-lib \ No newline at end of file diff --git a/packages/apps/opensearch/files/versions.yaml b/packages/apps/opensearch/files/versions.yaml deleted file mode 100644 index be39fc80..00000000 --- a/packages/apps/opensearch/files/versions.yaml +++ /dev/null @@ -1,5 +0,0 @@ -# OpenSearch version mapping (major version -> image tag) -# Auto-generated by hack/update-versions.sh - do not edit manually -v3: "3.0.0" -v2: "2.11.1" -v1: "1.3.20" diff --git a/packages/apps/opensearch/hack/update-versions.sh b/packages/apps/opensearch/hack/update-versions.sh deleted file mode 100755 index b2c4c946..00000000 --- a/packages/apps/opensearch/hack/update-versions.sh +++ /dev/null @@ -1,53 +0,0 @@ -#!/usr/bin/env bash - -set -o errexit -set -o nounset -set -o pipefail - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -OPENSEARCH_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" -VERSIONS_FILE="${OPENSEARCH_DIR}/files/versions.yaml" - -# Supported major versions (newest first) -SUPPORTED_MAJOR_VERSIONS="3 2 1" - -echo "Supported major versions: $SUPPORTED_MAJOR_VERSIONS" - -# Check if skopeo is installed -if ! command -v skopeo &> /dev/null; then - echo "Error: skopeo is not installed. Please install skopeo and try again." >&2 - exit 1 -fi - -# Check if jq is installed -if ! command -v jq &> /dev/null; then - echo "Error: jq is not installed. Please install jq and try again." >&2 - exit 1 -fi - -# Get available image tags from Docker Hub -IMAGE="docker.io/opensearchproject/opensearch" -echo "Fetching available image tags from registry..." -TAGS=$(skopeo list-tags "docker://${IMAGE}" | jq -r '.Tags[]') - -echo "# OpenSearch version mapping (major version -> image tag)" > "${VERSIONS_FILE}" -echo "# Auto-generated by hack/update-versions.sh - do not edit manually" >> "${VERSIONS_FILE}" - -for MAJOR in $SUPPORTED_MAJOR_VERSIONS; do - # Find the latest stable release for this major version - LATEST=$(echo "$TAGS" \ - | grep -E "^${MAJOR}\.[0-9]+\.[0-9]+$" \ - | sort -t. -k1,1n -k2,2n -k3,3n \ - | tail -1) - - if [ -n "$LATEST" ]; then - echo "v${MAJOR}: latest tag is ${LATEST}" - echo "v${MAJOR}: \"${LATEST}\"" >> "${VERSIONS_FILE}" - else - echo "WARNING: No stable release found for major version ${MAJOR}" >&2 - fi -done - -echo "" -echo "Updated ${VERSIONS_FILE}:" -cat "${VERSIONS_FILE}" diff --git a/packages/apps/opensearch/logos/opensearch.svg b/packages/apps/opensearch/logos/opensearch.svg deleted file mode 100644 index 345fdd0a..00000000 --- a/packages/apps/opensearch/logos/opensearch.svg +++ /dev/null @@ -1,11 +0,0 @@ - - - - - - - - - - - diff --git a/packages/apps/opensearch/templates/.gitkeep b/packages/apps/opensearch/templates/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/packages/apps/opensearch/templates/_versions.tpl b/packages/apps/opensearch/templates/_versions.tpl deleted file mode 100644 index 4eae4163..00000000 --- a/packages/apps/opensearch/templates/_versions.tpl +++ /dev/null @@ -1,13 +0,0 @@ -{{/* -Version mapping helper -Loads version mapping from files/versions.yaml and returns the full version for a given major version -*/}} -{{- define "opensearch.versionMap" -}} -{{- $versions := .Files.Get "files/versions.yaml" | fromYaml -}} -{{- $version := .Values.version | default "v2" -}} -{{- if hasKey $versions $version -}} -{{- index $versions $version -}} -{{- else -}} -{{- fail (printf "Invalid version '%s'. Available versions: %s" $version (keys $versions | join ", ")) -}} -{{- end -}} -{{- end -}} diff --git a/packages/apps/opensearch/templates/dashboard-resourcemap.yaml b/packages/apps/opensearch/templates/dashboard-resourcemap.yaml deleted file mode 100644 index 91dbf8cb..00000000 --- a/packages/apps/opensearch/templates/dashboard-resourcemap.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ .Release.Name }}-dashboard-resources -rules: -- apiGroups: - - "" - resources: - - services - resourceNames: - - {{ .Release.Name }} - - {{ .Release.Name }}-external - {{- if .Values.dashboards.enabled }} - - {{ .Release.Name }}-dashboards - - {{ .Release.Name }}-dashboards-external - {{- end }} - verbs: ["get", "list", "watch"] -- apiGroups: - - "" - resources: - - secrets - resourceNames: - - {{ .Release.Name }}-credentials - verbs: ["get", "list", "watch"] -- apiGroups: - - cozystack.io - resources: - - workloadmonitors - resourceNames: - - {{ .Release.Name }} - verbs: ["get", "list", "watch"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-dashboard-resources -subjects: -{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }} -roleRef: - kind: Role - name: {{ .Release.Name }}-dashboard-resources - apiGroup: rbac.authorization.k8s.io diff --git a/packages/apps/opensearch/templates/external-svc.yaml b/packages/apps/opensearch/templates/external-svc.yaml deleted file mode 100644 index f28626ab..00000000 --- a/packages/apps/opensearch/templates/external-svc.yaml +++ /dev/null @@ -1,39 +0,0 @@ -{{- if .Values.external }} -{{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }} ---- -apiVersion: v1 -kind: Service -metadata: - name: {{ .Release.Name }}-external - annotations: - external-dns.alpha.kubernetes.io/hostname: {{ .Release.Name }}.{{ .Release.Namespace }}.{{ $clusterDomain }} -spec: - type: LoadBalancer - selector: - opster.io/opensearch-cluster: {{ .Release.Name }} - opster.io/opensearch-nodepool: nodes - ports: - - name: https - port: 9200 - targetPort: 9200 - protocol: TCP -{{- if .Values.dashboards.enabled }} ---- -apiVersion: v1 -kind: Service -metadata: - name: {{ .Release.Name }}-dashboards-external - annotations: - external-dns.alpha.kubernetes.io/hostname: {{ .Release.Name }}-dashboards.{{ .Release.Namespace }}.{{ $clusterDomain }} -spec: - type: LoadBalancer - selector: - opster.io/opensearch-cluster: {{ .Release.Name }} - app.kubernetes.io/component: dashboards - ports: - - name: https - port: 5601 - targetPort: 5601 - protocol: TCP -{{- end }} -{{- end }} diff --git a/packages/apps/opensearch/templates/opensearch.yaml b/packages/apps/opensearch/templates/opensearch.yaml deleted file mode 100644 index 836a3d4b..00000000 --- a/packages/apps/opensearch/templates/opensearch.yaml +++ /dev/null @@ -1,105 +0,0 @@ -{{- $topologyMode := .Values.topologySpreadPolicy | default "soft" }} -{{- $whenUnsatisfiable := "ScheduleAnyway" }} -{{- if eq $topologyMode "hard" }} -{{- $whenUnsatisfiable = "DoNotSchedule" }} -{{- end }} ---- -apiVersion: opensearch.opster.io/v1 -kind: OpenSearchCluster -metadata: - name: {{ .Release.Name }} -spec: - general: - serviceName: {{ .Release.Name }} - version: {{ include "opensearch.versionMap" $ }} - httpPort: 9200 - setVMMaxMapCount: true - drainDataNodes: true - {{- if gt (len .Values.images.opensearch) 0 }} - image: {{ .Values.images.opensearch }} - {{- end }} - bootstrap: - resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 6 }} - security: - tls: - transport: - generate: true - perNode: true - http: - generate: true - config: - securityConfigSecret: - name: {{ .Release.Name }}-security-config - adminCredentialsSecret: - name: {{ .Release.Name }}-admin-credentials - {{- if .Values.dashboards.enabled }} - dashboards: - enable: true - version: {{ include "opensearch.versionMap" $ }} - replicas: {{ .Values.dashboards.replicas | default 1 }} - tls: - enable: true - generate: true - resources: {{- include "cozy-lib.resources.defaultingSanitize" (list (.Values.dashboards.resourcesPreset | default "medium") .Values.dashboards.resources $) | nindent 6 }} - {{- end }} - nodePools: - - component: nodes - replicas: {{ .Values.replicas }} - diskSize: {{ .Values.size }} - persistence: - pvc: - accessModes: - - ReadWriteOnce - {{- if .Values.storageClass }} - storageClass: {{ .Values.storageClass }} - {{- else if eq (int .Values.replicas) 1 }} - storageClass: replicated - {{- else }} - storageClass: local - {{- end }} - resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 8 }} - {{- if not (or .Values.nodeRoles.master .Values.nodeRoles.data .Values.nodeRoles.ingest .Values.nodeRoles.ml) }} - {{- fail "At least one node role must be enabled (master, data, ingest, or ml)" }} - {{- end }} - roles: - {{- if .Values.nodeRoles.master }} - - cluster_manager - {{- end }} - {{- if .Values.nodeRoles.data }} - - data - {{- end }} - {{- if .Values.nodeRoles.ingest }} - - ingest - {{- end }} - {{- if .Values.nodeRoles.ml }} - - ml - {{- end }} - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: {{ $whenUnsatisfiable }} - labelSelector: - matchLabels: - opster.io/opensearch-cluster: {{ .Release.Name }} - - maxSkew: 1 - topologyKey: topology.kubernetes.io/zone - whenUnsatisfiable: {{ $whenUnsatisfiable }} - labelSelector: - matchLabels: - opster.io/opensearch-cluster: {{ .Release.Name }} ---- -# WorkloadMonitor tracks OpenSearch pods -apiVersion: cozystack.io/v1alpha1 -kind: WorkloadMonitor -metadata: - name: {{ .Release.Name }} - labels: - workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }} -spec: - replicas: {{ .Values.replicas }} - minReplicas: 1 - kind: opensearch - type: opensearch - selector: - opster.io/opensearch-cluster: {{ .Release.Name }} - version: {{ .Chart.Version }} diff --git a/packages/apps/opensearch/templates/security.yaml b/packages/apps/opensearch/templates/security.yaml deleted file mode 100644 index d10d353a..00000000 --- a/packages/apps/opensearch/templates/security.yaml +++ /dev/null @@ -1,120 +0,0 @@ -{{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }} -{{- $existingAdminCreds := lookup "v1" "Secret" .Release.Namespace (printf "%s-admin-credentials" .Release.Name) }} -{{- $existingSecurityConfig := lookup "v1" "Secret" .Release.Namespace (printf "%s-security-config" .Release.Name) }} -{{- $password := randAlphaNum 32 }} -{{- if and $existingAdminCreds (hasKey $existingAdminCreds.data "password") }} -{{- $password = index $existingAdminCreds.data "password" | b64dec }} -{{- end }} ---- -# Admin credentials for the OpenSearch operator (referenced by adminCredentialsSecret) -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-admin-credentials - labels: - app.kubernetes.io/name: opensearch - app.kubernetes.io/instance: {{ .Release.Name }} -type: Opaque -stringData: - username: admin - password: {{ $password | quote }} ---- -# Security plugin configuration (referenced by securityConfigSecret) -# On upgrades, the existing secret is preserved to avoid bcrypt hash regeneration -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-security-config - labels: - app.kubernetes.io/name: opensearch - app.kubernetes.io/instance: {{ .Release.Name }} -type: Opaque -{{- if and $existingSecurityConfig (hasKey $existingSecurityConfig.data "internal_users.yml") }} -data: - {{- range $key, $val := $existingSecurityConfig.data }} - {{ $key }}: {{ $val }} - {{- end }} -{{- else }} -stringData: - config.yml: | - --- - _meta: - type: "config" - config_version: 2 - config: - dynamic: - http: - anonymous_auth_enabled: false - authc: - basic_internal_auth_domain: - description: "Authenticate via HTTP Basic against internal users database" - http_enabled: true - transport_enabled: true - order: 0 - http_authenticator: - type: basic - challenge: true - authentication_backend: - type: internal - - internal_users.yml: | - --- - _meta: - type: "internalusers" - config_version: 2 - admin: - hash: {{ htpasswd "admin" $password | trimPrefix "admin:" | quote }} - reserved: true - backend_roles: - - "admin" - description: "Admin user" - - roles.yml: | - --- - _meta: - type: "roles" - config_version: 2 - - roles_mapping.yml: | - --- - _meta: - type: "rolesmapping" - config_version: 2 - all_access: - reserved: false - backend_roles: - - "admin" - - action_groups.yml: | - --- - _meta: - type: "actiongroups" - config_version: 2 - - tenants.yml: | - --- - _meta: - type: "tenants" - config_version: 2 -{{- end }} ---- -# User-facing credentials with connection URI -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-credentials - labels: - app.kubernetes.io/name: opensearch - app.kubernetes.io/instance: {{ .Release.Name }} -type: Opaque -stringData: - username: admin - password: {{ $password | quote }} - host: {{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }} - port: "9200" - uri: https://admin:{{ $password | urlquery }}@{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}:9200 - {{- if .Values.dashboards.enabled }} - dashboards-host: {{ .Release.Name }}-dashboards.{{ .Release.Namespace }}.svc.{{ $clusterDomain }} - dashboards-port: "5601" - dashboards-uri: https://admin:{{ $password | urlquery }}@{{ .Release.Name }}-dashboards.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}:5601 - {{- end }} diff --git a/packages/apps/opensearch/templates/users.yaml b/packages/apps/opensearch/templates/users.yaml deleted file mode 100644 index 1d326206..00000000 --- a/packages/apps/opensearch/templates/users.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- range $username, $user := .Values.users }} -{{- $existingSecret := lookup "v1" "Secret" $.Release.Namespace (printf "%s-user-%s" $.Release.Name $username) }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ $.Release.Name }}-user-{{ $username }} - labels: - opensearch.opster.io/credentials: "true" -type: kubernetes.io/basic-auth -stringData: - username: {{ $username | quote }} - {{- if $user.password }} - password: {{ $user.password | quote }} - {{- else if and $existingSecret (hasKey $existingSecret.data "password") }} - password: {{ index $existingSecret.data "password" | b64dec | quote }} - {{- else }} - password: {{ randAlphaNum 16 | quote }} - {{- end }} - roles: {{ $user.roles | default (list "readall") | join "," | quote }} -{{- end }} diff --git a/packages/apps/opensearch/tests/opensearch_test.yaml b/packages/apps/opensearch/tests/opensearch_test.yaml deleted file mode 100644 index 2959ec18..00000000 --- a/packages/apps/opensearch/tests/opensearch_test.yaml +++ /dev/null @@ -1,532 +0,0 @@ -suite: opensearch CR tests - -templates: - - templates/opensearch.yaml - -tests: - ################### - # Basic rendering # - ################### - - - it: renders OpenSearchCluster and WorkloadMonitor - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - hasDocuments: - count: 2 - - isKind: - of: OpenSearchCluster - documentIndex: 0 - - isKind: - of: WorkloadMonitor - documentIndex: 1 - - - it: sets correct CR name - release: - name: my-opensearch - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: metadata.name - value: my-opensearch - documentIndex: 0 - - ################## - # Version # - ################## - - - it: defaults to version 2.11.1 - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.general.version - value: "2.11.1" - documentIndex: 0 - - - it: sets version 3.0.0 when v3 selected - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - version: v3 - asserts: - - equal: - path: spec.general.version - value: "3.0.0" - documentIndex: 0 - - - it: sets version 1.3.20 when v1 selected - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - version: v1 - asserts: - - equal: - path: spec.general.version - value: "1.3.20" - documentIndex: 0 - - ##################### - # General # - ##################### - - - it: sets drainDataNodes to true - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.general.drainDataNodes - value: true - documentIndex: 0 - - - it: sets httpPort to 9200 - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.general.httpPort - value: 9200 - documentIndex: 0 - - ##################### - # Security # - ##################### - - - it: always includes security section with TLS - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.security.tls.transport.generate - value: true - documentIndex: 0 - - equal: - path: spec.security.tls.transport.perNode - value: true - documentIndex: 0 - - equal: - path: spec.security.tls.http.generate - value: true - documentIndex: 0 - - - it: references security config secret - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.security.config.securityConfigSecret.name - value: test-os-security-config - documentIndex: 0 - - - it: references admin credentials secret - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.security.config.adminCredentialsSecret.name - value: test-os-admin-credentials - documentIndex: 0 - - - it: does not disable security plugin - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - notExists: - path: spec.general.additionalConfig - documentIndex: 0 - - ##################### - # Node Pools # - ##################### - - - it: sets default replica count to 3 - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.nodePools[0].replicas - value: 3 - documentIndex: 0 - - - it: sets replica count from values - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - replicas: 5 - asserts: - - equal: - path: spec.nodePools[0].replicas - value: 5 - documentIndex: 0 - - ##################### - # Node Roles # - ##################### - - - it: enables default node roles - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - contains: - path: spec.nodePools[0].roles - content: cluster_manager - documentIndex: 0 - - contains: - path: spec.nodePools[0].roles - content: data - documentIndex: 0 - - contains: - path: spec.nodePools[0].roles - content: ingest - documentIndex: 0 - - - it: disables master role when configured - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - nodeRoles: - master: false - data: true - ingest: true - ml: false - asserts: - - notContains: - path: spec.nodePools[0].roles - content: cluster_manager - documentIndex: 0 - - - it: fails when all node roles are disabled - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - nodeRoles: - master: false - data: false - ingest: false - ml: false - asserts: - - failedTemplate: - errorMessage: "At least one node role must be enabled (master, data, ingest, or ml)" - - - it: enables ml role when configured - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - nodeRoles: - master: true - data: true - ingest: true - ml: true - asserts: - - contains: - path: spec.nodePools[0].roles - content: ml - documentIndex: 0 - - ########################### - # Topology Spread Policy # - ########################### - - - it: uses soft topology spread by default (ScheduleAnyway) - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.nodePools[0].topologySpreadConstraints[0].whenUnsatisfiable - value: ScheduleAnyway - documentIndex: 0 - - equal: - path: spec.nodePools[0].topologySpreadConstraints[1].whenUnsatisfiable - value: ScheduleAnyway - documentIndex: 0 - - - it: uses hard topology spread when configured (DoNotSchedule) - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - topologySpreadPolicy: hard - asserts: - - equal: - path: spec.nodePools[0].topologySpreadConstraints[0].whenUnsatisfiable - value: DoNotSchedule - documentIndex: 0 - - equal: - path: spec.nodePools[0].topologySpreadConstraints[1].whenUnsatisfiable - value: DoNotSchedule - documentIndex: 0 - - - it: sets correct topology keys - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.nodePools[0].topologySpreadConstraints[0].topologyKey - value: kubernetes.io/hostname - documentIndex: 0 - - equal: - path: spec.nodePools[0].topologySpreadConstraints[1].topologyKey - value: topology.kubernetes.io/zone - documentIndex: 0 - - ##################### - # Storage # - ##################### - - - it: sets accessModes to ReadWriteOnce - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - contains: - path: spec.nodePools[0].persistence.pvc.accessModes - content: ReadWriteOnce - documentIndex: 0 - - - it: sets storage size from values - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - size: 50Gi - asserts: - - equal: - path: spec.nodePools[0].diskSize - value: 50Gi - documentIndex: 0 - - - it: uses local storageClass when replicas > 1 and no storageClass - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - storageClass: "" - replicas: 3 - asserts: - - equal: - path: spec.nodePools[0].persistence.pvc.storageClass - value: local - documentIndex: 0 - - - it: uses replicated storageClass when single replica and no storageClass - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - storageClass: "" - replicas: 1 - asserts: - - equal: - path: spec.nodePools[0].persistence.pvc.storageClass - value: replicated - documentIndex: 0 - - - it: uses custom storageClass when provided - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - storageClass: fast-ssd - asserts: - - equal: - path: spec.nodePools[0].persistence.pvc.storageClass - value: fast-ssd - documentIndex: 0 - - ##################### - # Dashboards # - ##################### - - - it: does not render dashboards when disabled - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - dashboards: - enabled: false - replicas: 1 - resourcesPreset: "medium" - resources: {} - asserts: - - notExists: - path: spec.dashboards - documentIndex: 0 - - - it: renders dashboards when enabled - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - dashboards: - enabled: true - replicas: 1 - resourcesPreset: "medium" - resources: {} - asserts: - - equal: - path: spec.dashboards.enable - value: true - documentIndex: 0 - - equal: - path: spec.dashboards.replicas - value: 1 - documentIndex: 0 - - equal: - path: spec.dashboards.tls.enable - value: true - documentIndex: 0 - - equal: - path: spec.dashboards.tls.generate - value: true - documentIndex: 0 - - ########################### - # WorkloadMonitor # - ########################### - - - it: creates WorkloadMonitor with correct metadata - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: metadata.name - value: test-os - documentIndex: 1 - - equal: - path: spec.kind - value: opensearch - documentIndex: 1 - - equal: - path: spec.type - value: opensearch - documentIndex: 1 - - - it: sets replicas in WorkloadMonitor - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - replicas: 5 - asserts: - - equal: - path: spec.replicas - value: 5 - documentIndex: 1 - - - it: sets minReplicas to 1 - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.minReplicas - value: 1 - documentIndex: 1 - - - it: sets correct selector labels - release: - name: mydb - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: spec.selector["opster.io/opensearch-cluster"] - value: mydb - documentIndex: 1 diff --git a/packages/apps/opensearch/tests/security_test.yaml b/packages/apps/opensearch/tests/security_test.yaml deleted file mode 100644 index cd8740d9..00000000 --- a/packages/apps/opensearch/tests/security_test.yaml +++ /dev/null @@ -1,207 +0,0 @@ -suite: security secrets tests - -templates: - - templates/security.yaml - -tests: - ################### - # Basic rendering # - ################### - - - it: renders three secrets (admin-credentials, security-config, credentials) - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - hasDocuments: - count: 3 - - ########################### - # Admin credentials # - ########################### - - - it: sets admin-credentials secret name - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: metadata.name - value: test-os-admin-credentials - documentIndex: 0 - - - it: sets admin username - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: stringData.username - value: admin - documentIndex: 0 - - - it: generates a 32-char alphanumeric password - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - matchRegex: - path: stringData.password - pattern: "^[a-zA-Z0-9]{32}$" - documentIndex: 0 - - ########################### - # Security config # - ########################### - - - it: sets security-config secret name - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: metadata.name - value: test-os-security-config - documentIndex: 1 - - - it: includes config.yml with basic auth - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - exists: - path: stringData["config.yml"] - documentIndex: 1 - - - it: includes internal_users.yml with bcrypt hash - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - matchRegex: - path: stringData["internal_users.yml"] - pattern: "hash:.*\\$2a\\$" - documentIndex: 1 - - - it: includes roles_mapping.yml - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - exists: - path: stringData["roles_mapping.yml"] - documentIndex: 1 - - ########################### - # User-facing credentials # - ########################### - - - it: sets credentials secret name - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: metadata.name - value: test-os-credentials - documentIndex: 2 - - - it: sets correct host and port - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - equal: - path: stringData.host - value: test-os.tenant-test.svc.cozy.local - documentIndex: 2 - - equal: - path: stringData.port - value: "9200" - documentIndex: 2 - - - it: sets https URI with credentials - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - asserts: - - matchRegex: - path: stringData.uri - pattern: "^https://admin:[a-zA-Z0-9]{32}@test-os\\.tenant-test\\.svc\\.cozy\\.local:9200$" - documentIndex: 2 - - - it: does not include dashboards fields when dashboards disabled - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - dashboards: - enabled: false - replicas: 1 - resourcesPreset: "medium" - resources: {} - asserts: - - notExists: - path: stringData.dashboards-host - documentIndex: 2 - - - it: includes dashboards fields when dashboards enabled - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - dashboards: - enabled: true - replicas: 1 - resourcesPreset: "medium" - resources: {} - asserts: - - equal: - path: stringData.dashboards-host - value: test-os-dashboards.tenant-test.svc.cozy.local - documentIndex: 2 - - equal: - path: stringData.dashboards-port - value: "5601" - documentIndex: 2 - - matchRegex: - path: stringData.dashboards-uri - pattern: "^https://admin:[a-zA-Z0-9]{32}@test-os-dashboards\\.tenant-test\\.svc\\.cozy\\.local:5601$" - documentIndex: 2 diff --git a/packages/apps/opensearch/tests/users_test.yaml b/packages/apps/opensearch/tests/users_test.yaml deleted file mode 100644 index f6b4990e..00000000 --- a/packages/apps/opensearch/tests/users_test.yaml +++ /dev/null @@ -1,176 +0,0 @@ -suite: users secrets tests - -templates: - - templates/users.yaml - -tests: - ################### - # Basic rendering # - ################### - - - it: does not render secrets when no users defined - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: {} - asserts: - - hasDocuments: - count: 0 - - - it: renders one secret per user - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: - user1: - roles: - - readall - user2: - roles: - - all_access - asserts: - - hasDocuments: - count: 2 - - ##################### - # Secret metadata # - ##################### - - - it: sets correct secret name - release: - name: my-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: - myuser: - roles: - - readall - asserts: - - equal: - path: metadata.name - value: my-os-user-myuser - - - it: sets opensearch credentials label - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: - myuser: - roles: - - readall - asserts: - - equal: - path: metadata.labels["opensearch.opster.io/credentials"] - value: "true" - - - it: uses basic-auth secret type - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: - myuser: - roles: - - readall - asserts: - - equal: - path: type - value: kubernetes.io/basic-auth - - ##################### - # Secret data # - ##################### - - - it: sets username in secret - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: - testuser: - roles: - - readall - asserts: - - equal: - path: stringData.username - value: testuser - - - it: uses provided password - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: - myuser: - password: mysecretpassword - roles: - - readall - asserts: - - equal: - path: stringData.password - value: mysecretpassword - - - it: generates password when not provided - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: - myuser: - roles: - - readall - asserts: - - matchRegex: - path: stringData.password - pattern: "^[a-zA-Z0-9]{16}$" - - - it: sets roles as comma-separated string - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: - myuser: - roles: - - readall - - reporting_user - - monitoring_user - asserts: - - equal: - path: stringData.roles - value: "readall,reporting_user,monitoring_user" - - - it: defaults to readall role when no roles specified - release: - name: test-os - namespace: tenant-test - set: - _cluster: - cluster-domain: cozy.local - users: - myuser: {} - asserts: - - equal: - path: stringData.roles - value: "readall" diff --git a/packages/apps/opensearch/values.schema.json b/packages/apps/opensearch/values.schema.json deleted file mode 100644 index 04b530ba..00000000 --- a/packages/apps/opensearch/values.schema.json +++ /dev/null @@ -1,239 +0,0 @@ -{ - "title": "Chart Values", - "type": "object", - "properties": { - "replicas": { - "description": "Number of OpenSearch nodes in the cluster.", - "type": "integer", - "default": 3 - }, - "resources": { - "description": "Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "CPU available to each node.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Memory (RAM) available to each node.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "resourcesPreset": { - "description": "Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.", - "type": "string", - "default": "large", - "enum": [ - "nano", - "micro", - "small", - "medium", - "large", - "xlarge", - "2xlarge" - ] - }, - "size": { - "description": "Persistent Volume Claim size available for application data.", - "default": "10Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "storageClass": { - "description": "StorageClass used to store the data.", - "type": "string", - "default": "" - }, - "external": { - "description": "Enable external access from outside the cluster.", - "type": "boolean", - "default": false - }, - "topologySpreadPolicy": { - "description": "How strictly to enforce pod distribution across nodes and zones.", - "type": "string", - "default": "soft", - "enum": [ - "soft", - "hard" - ] - }, - "version": { - "description": "OpenSearch major version to deploy.", - "type": "string", - "default": "v2", - "enum": [ - "v3", - "v2", - "v1" - ] - }, - "images": { - "description": "Container images used by the operator.", - "type": "object", - "default": {}, - "required": [ - "opensearch" - ], - "properties": { - "opensearch": { - "description": "OpenSearch image.", - "type": "string", - "default": "" - } - } - }, - "nodeRoles": { - "description": "Node roles configuration.", - "type": "object", - "default": {}, - "required": [ - "data", - "ingest", - "master", - "ml" - ], - "properties": { - "data": { - "description": "Enable data role.", - "type": "boolean", - "default": true - }, - "ingest": { - "description": "Enable ingest role.", - "type": "boolean", - "default": true - }, - "master": { - "description": "Enable cluster_manager role.", - "type": "boolean", - "default": true - }, - "ml": { - "description": "Enable machine learning role.", - "type": "boolean", - "default": false - } - } - }, - "users": { - "description": "Custom OpenSearch users configuration map.", - "type": "object", - "default": {}, - "additionalProperties": { - "type": "object", - "properties": { - "password": { - "description": "Password for the user (auto-generated if omitted).", - "type": "string" - }, - "roles": { - "description": "List of OpenSearch roles.", - "type": "array", - "items": { - "type": "string" - } - } - } - } - }, - "dashboards": { - "description": "OpenSearch Dashboards configuration.", - "type": "object", - "default": {}, - "required": [ - "enabled", - "replicas", - "resourcesPreset" - ], - "properties": { - "enabled": { - "description": "Enable OpenSearch Dashboards deployment.", - "type": "boolean", - "default": false - }, - "replicas": { - "description": "Number of Dashboards replicas.", - "type": "integer", - "default": 1 - }, - "resources": { - "description": "Explicit CPU and memory configuration for Dashboards.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "CPU available to each node.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Memory (RAM) available to each node.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "resourcesPreset": { - "description": "Default sizing preset for Dashboards.", - "type": "string", - "default": "medium", - "enum": [ - "nano", - "micro", - "small", - "medium", - "large", - "xlarge", - "2xlarge" - ] - } - } - } - } -} diff --git a/packages/apps/opensearch/values.yaml b/packages/apps/opensearch/values.yaml deleted file mode 100644 index 8de805e3..00000000 --- a/packages/apps/opensearch/values.yaml +++ /dev/null @@ -1,111 +0,0 @@ -## -## @section Common parameters -## - -## @typedef {struct} Resources - Explicit CPU and memory configuration for each OpenSearch node. -## @field {quantity} [cpu] - CPU available to each node. -## @field {quantity} [memory] - Memory (RAM) available to each node. - -## @enum {string} ResourcesPreset - Default sizing preset. -## @value nano -## @value micro -## @value small -## @value medium -## @value large -## @value xlarge -## @value 2xlarge - -## @param {int} replicas - Number of OpenSearch nodes in the cluster. -replicas: 3 - -## @param {Resources} [resources] - Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied. -resources: {} - -## @param {ResourcesPreset} resourcesPreset="large" - Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory. -resourcesPreset: "large" - -## @param {quantity} size - Persistent Volume Claim size available for application data. -size: 10Gi - -## @param {string} storageClass - StorageClass used to store the data. -storageClass: "" - -## @param {bool} external - Enable external access from outside the cluster. -external: false - -## @enum {string} TopologySpreadPolicy - Pod distribution policy across nodes/zones. -## @value soft - Best-effort distribution (ScheduleAnyway) - pods may be scheduled on same node if needed -## @value hard - Strict distribution (DoNotSchedule) - pods will not schedule if spread cannot be achieved - -## @param {TopologySpreadPolicy} topologySpreadPolicy="soft" - How strictly to enforce pod distribution across nodes and zones. -topologySpreadPolicy: "soft" - -## -## @enum {string} Version -## @value v3 -## @value v2 -## @value v1 - -## @param {Version} version - OpenSearch major version to deploy. -version: v2 - -## -## @section Image configuration -## - -## @typedef {struct} Images - Container image configuration. -## @field {string} opensearch - OpenSearch image. - -## @param {Images} images - Container images used by the operator. -images: - opensearch: "" - -## -## @section Node roles configuration -## - -## @typedef {struct} NodeRoles - OpenSearch node roles. -## @field {bool} master - Enable cluster_manager role. -## @field {bool} data - Enable data role. -## @field {bool} ingest - Enable ingest role. -## @field {bool} ml - Enable machine learning role. - -## @param {NodeRoles} nodeRoles - Node roles configuration. -nodeRoles: - master: true - data: true - ingest: true - ml: false - -## -## @section Users configuration -## - -## @typedef {struct} User - User configuration. -## @field {string} [password] - Password for the user (auto-generated if omitted). -## @field {[]string} roles - List of OpenSearch roles. - -## @param {map[string]User} users - Custom OpenSearch users configuration map. -users: {} -## Example: -## users: -## myuser: -## roles: -## - all_access - -## -## @section OpenSearch Dashboards configuration -## - -## @typedef {struct} Dashboards - OpenSearch Dashboards deployment configuration. -## @field {bool} enabled - Enable OpenSearch Dashboards deployment. -## @field {int} replicas - Number of Dashboards replicas. -## @field {Resources} [resources] - Explicit CPU and memory configuration for Dashboards. -## @field {ResourcesPreset} resourcesPreset - Default sizing preset for Dashboards. - -## @param {Dashboards} dashboards - OpenSearch Dashboards configuration. -dashboards: - enabled: false - replicas: 1 - resources: {} - resourcesPreset: "medium" diff --git a/packages/apps/postgres/Makefile b/packages/apps/postgres/Makefile index dff0b9c6..aa9b0ccc 100644 --- a/packages/apps/postgres/Makefile +++ b/packages/apps/postgres/Makefile @@ -1,7 +1,7 @@ include ../../../hack/package.mk generate: - cozyvalues-gen -m 'postgresql' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/postgresql/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh update: diff --git a/packages/apps/postgres/README.md b/packages/apps/postgres/README.md index 4cda7284..5a550f7a 100644 --- a/packages/apps/postgres/README.md +++ b/packages/apps/postgres/README.md @@ -133,13 +133,12 @@ See: ### Bootstrap (recovery) parameters -| Name | Description | Type | Value | -| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | -| `bootstrap` | Bootstrap configuration. | `object` | `{}` | -| `bootstrap.enabled` | Whether to restore from a backup. | `bool` | `false` | -| `bootstrap.recoveryTime` | Timestamp (RFC3339) for point-in-time recovery; empty means latest. | `string` | `""` | -| `bootstrap.oldName` | Previous cluster name before deletion. | `string` | `""` | -| `bootstrap.serverName` | Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name. | `string` | `""` | +| Name | Description | Type | Value | +| ------------------------ | ------------------------------------------------------------------- | -------- | ------- | +| `bootstrap` | Bootstrap configuration. | `object` | `{}` | +| `bootstrap.enabled` | Whether to restore from a backup. | `bool` | `false` | +| `bootstrap.recoveryTime` | Timestamp (RFC3339) for point-in-time recovery; empty means latest. | `string` | `""` | +| `bootstrap.oldName` | Previous cluster name before deletion. | `string` | `""` | ## Parameter examples and reference diff --git a/packages/apps/postgres/templates/db.yaml b/packages/apps/postgres/templates/db.yaml index 2cdaec1d..7557c436 100644 --- a/packages/apps/postgres/templates/db.yaml +++ b/packages/apps/postgres/templates/db.yaml @@ -32,9 +32,6 @@ spec: - name: {{ .Values.bootstrap.oldName }} barmanObjectStore: destinationPath: {{ .Values.backup.destinationPath }} - {{- if .Values.bootstrap.serverName }} - serverName: {{ .Values.bootstrap.serverName }} - {{- end }} endpointURL: {{ .Values.backup.endpointURL }} s3Credentials: accessKeyId: @@ -87,8 +84,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }} - labels: - workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }} spec: replicas: {{ .Values.replicas }} minReplicas: 1 diff --git a/packages/apps/postgres/templates/init-script.yaml b/packages/apps/postgres/templates/init-script.yaml index 500d54d4..80f7c4c7 100644 --- a/packages/apps/postgres/templates/init-script.yaml +++ b/packages/apps/postgres/templates/init-script.yaml @@ -66,38 +66,6 @@ stringData: EOT done - echo "== delete databases" - MANAGED_DBS=$(psql -v ON_ERROR_STOP=1 -t -A -c "SELECT datname FROM pg_database d JOIN pg_shdescription s ON d.oid = s.objoid WHERE s.description = 'database managed by helm'") - DEFINED_DBS="{{ join " " (keys .Values.databases) }}" - DELETE_DBS=$(for db in $MANAGED_DBS; do case " $DEFINED_DBS " in *" $db "*) :;; *) echo $db;; esac; done) - - echo "databases to delete: $DELETE_DBS" - for db in $DELETE_DBS; do - psql -v ON_ERROR_STOP=1 --echo-all -c "DROP DATABASE IF EXISTS \"$db\" WITH (FORCE);" - done - - echo "== delete orphaned managed roles" - MANAGED_ROLES=$(psql -v ON_ERROR_STOP=1 -t -A -c "SELECT rolname FROM pg_roles r JOIN pg_shdescription s ON r.oid = s.objoid WHERE s.description = 'role managed by helm'") - DEFINED_ROLES="{{ range $database, $d := .Values.databases }}{{ $database }}_admin {{ $database }}_readonly {{ end }}" - DELETE_ROLES=$(for role in $MANAGED_ROLES; do case " $DEFINED_ROLES " in *" $role "*) :;; *) echo $role;; esac; done) - - echo "roles to delete: $DELETE_ROLES" - for role in $DELETE_ROLES; do - psql -v ON_ERROR_STOP=1 --echo-all <@ ### Common parameters -| Name | Description | Type | Value | -| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- | -| `external` | Enable external access from outside the cluster. | `bool` | `false` | -| `externalMethod` | Method to pass through traffic to the VM. | `string` | `PortList` | -| `externalPorts` | Ports to forward from outside the cluster. | `[]int` | `[22]` | -| `externalAllowICMP` | Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect. | `bool` | `true` | -| `runStrategy` | Requested running state of the VirtualMachineInstance | `string` | `Always` | -| `instanceType` | Virtual Machine instance type. | `string` | `u1.medium` | -| `instanceProfile` | Virtual Machine preferences profile. | `string` | `ubuntu` | -| `disks` | List of disks to attach. | `[]object` | `[]` | -| `disks[i].name` | Disk name. | `string` | `""` | -| `disks[i].bus` | Disk bus type (e.g. "sata"). | `string` | `""` | -| `networks` | Networks to attach the VM to. | `[]object` | `[]` | -| `networks[i].name` | Network attachment name. | `string` | `""` | -| `subnets` | Deprecated: use networks instead. | `[]object` | `[]` | -| `subnets[i].name` | Network attachment name. | `string` | `""` | -| `gpus` | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM). | `[]object` | `[]` | -| `gpus[i].name` | The name of the GPU resource to attach. | `string` | `""` | -| `cpuModel` | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map | `string` | `""` | -| `resources` | Resource configuration for the virtual machine. | `object` | `{}` | -| `resources.cpu` | Number of CPU cores allocated. | `quantity` | `""` | -| `resources.memory` | Amount of memory allocated. | `quantity` | `""` | -| `resources.sockets` | Number of CPU sockets (vCPU topology). | `quantity` | `""` | -| `sshKeys` | List of SSH public keys for authentication. | `[]string` | `[]` | -| `cloudInit` | Cloud-init user data. | `string` | `""` | -| `cloudInitSeed` | Seed string to generate SMBIOS UUID for the VM. | `string` | `""` | +| Name | Description | Type | Value | +| ------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- | +| `external` | Enable external access from outside the cluster. | `bool` | `false` | +| `externalMethod` | Method to pass through traffic to the VM. | `string` | `PortList` | +| `externalPorts` | Ports to forward from outside the cluster. | `[]int` | `[22]` | +| `runStrategy` | Requested running state of the VirtualMachineInstance | `string` | `Always` | +| `instanceType` | Virtual Machine instance type. | `string` | `u1.medium` | +| `instanceProfile` | Virtual Machine preferences profile. | `string` | `ubuntu` | +| `disks` | List of disks to attach. | `[]object` | `[]` | +| `disks[i].name` | Disk name. | `string` | `""` | +| `disks[i].bus` | Disk bus type (e.g. "sata"). | `string` | `""` | +| `subnets` | Additional subnets | `[]object` | `[]` | +| `subnets[i].name` | Subnet name | `string` | `""` | +| `gpus` | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM). | `[]object` | `[]` | +| `gpus[i].name` | The name of the GPU resource to attach. | `string` | `""` | +| `cpuModel` | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map | `string` | `""` | +| `resources` | Resource configuration for the virtual machine. | `object` | `{}` | +| `resources.cpu` | Number of CPU cores allocated. | `quantity` | `""` | +| `resources.memory` | Amount of memory allocated. | `quantity` | `""` | +| `resources.sockets` | Number of CPU sockets (vCPU topology). | `quantity` | `""` | +| `sshKeys` | List of SSH public keys for authentication. | `[]string` | `[]` | +| `cloudInit` | Cloud-init user data. | `string` | `""` | +| `cloudInitSeed` | Seed string to generate SMBIOS UUID for the VM. | `string` | `""` | ## U Series diff --git a/packages/apps/vm-instance/templates/service.yaml b/packages/apps/vm-instance/templates/service.yaml index cfeffa81..b12f7612 100644 --- a/packages/apps/vm-instance/templates/service.yaml +++ b/packages/apps/vm-instance/templates/service.yaml @@ -7,12 +7,8 @@ metadata: apps.cozystack.io/user-service: "true" {{- include "virtual-machine.labels" . | nindent 4 }} {{- if .Values.external }} - service.kubernetes.io/service-proxy-name: "cozy-proxy" annotations: - networking.cozystack.io/wholeIP: {{ ternary "true" "false" (eq .Values.externalMethod "WholeIP") | quote }} - {{- if eq .Values.externalMethod "PortList" }} - networking.cozystack.io/allowICMP: {{ ternary "true" "false" (ne .Values.externalAllowICMP false) | quote }} - {{- end }} + networking.cozystack.io/wholeIP: "true" {{- end }} spec: type: {{ ternary "LoadBalancer" "ClusterIP" .Values.external }} diff --git a/packages/apps/vm-instance/templates/vm.yaml b/packages/apps/vm-instance/templates/vm.yaml index 55f278c1..0a7eb7c5 100644 --- a/packages/apps/vm-instance/templates/vm.yaml +++ b/packages/apps/vm-instance/templates/vm.yaml @@ -7,7 +7,6 @@ {{- if and (not .Values.instanceType) (not (and .Values.resources .Values.resources.cpu .Values.resources.sockets .Values.resources.memory)) }} {{- fail "Either instanceType or resources (cpu, sockets, memory) must be specified" }} {{- end }} -{{- $networks := .Values.networks | default .Values.subnets }} apiVersion: kubevirt.io/v1 kind: VirtualMachine @@ -87,10 +86,12 @@ spec: interfaces: - name: default bridge: {} - {{- range $i, $net := $networks }} - - name: {{ $net.name }} + {{- if .Values.subnets }} + {{- range $i, $subnet := .Values.subnets }} + - name: {{ $subnet.name }} bridge: {} {{- end }} + {{- end }} machine: type: "" {{- with .Values.sshKeys }} @@ -122,8 +123,10 @@ spec: networks: - name: default pod: {} - {{- range $i, $net := $networks }} - - name: {{ $net.name }} + {{- if .Values.subnets }} + {{- range $i, $subnet := .Values.subnets }} + - name: {{ $subnet.name }} multus: - networkName: {{ $.Release.Namespace }}/{{ $net.name }} + networkName: {{ $.Release.Namespace }}/{{ $subnet.name }} + {{- end }} {{- end }} diff --git a/packages/apps/vm-instance/values.schema.json b/packages/apps/vm-instance/values.schema.json index 01bd30a9..0788c879 100644 --- a/packages/apps/vm-instance/values.schema.json +++ b/packages/apps/vm-instance/values.schema.json @@ -2,6 +2,42 @@ "title": "Chart Values", "type": "object", "properties": { + "cloudInit": { + "description": "Cloud-init user data.", + "type": "string", + "default": "" + }, + "cloudInitSeed": { + "description": "Seed string to generate SMBIOS UUID for the VM.", + "type": "string", + "default": "" + }, + "cpuModel": { + "description": "Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map", + "type": "string", + "default": "" + }, + "disks": { + "description": "List of disks to attach.", + "type": "array", + "default": [], + "items": { + "type": "object", + "required": [ + "name" + ], + "properties": { + "bus": { + "description": "Disk bus type (e.g. \"sata\").", + "type": "string" + }, + "name": { + "description": "Disk name.", + "type": "string" + } + } + } + }, "external": { "description": "Enable external access from outside the cluster.", "type": "boolean", @@ -26,27 +62,22 @@ "type": "integer" } }, - "externalAllowICMP": { - "description": "Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.", - "type": "boolean", - "default": true - }, - "runStrategy": { - "description": "Requested running state of the VirtualMachineInstance", - "type": "string", - "default": "Always", - "enum": [ - "Always", - "Halted", - "Manual", - "RerunOnFailure", - "Once" - ] - }, - "instanceType": { - "description": "Virtual Machine instance type.", - "type": "string", - "default": "u1.medium" + "gpus": { + "description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).", + "type": "array", + "default": [], + "items": { + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "description": "The name of the GPU resource to attach.", + "type": "string" + } + } + } }, "instanceProfile": { "description": "Virtual Machine preferences profile.", @@ -98,76 +129,10 @@ "" ] }, - "disks": { - "description": "List of disks to attach.", - "type": "array", - "default": [], - "items": { - "type": "object", - "required": [ - "name" - ], - "properties": { - "bus": { - "description": "Disk bus type (e.g. \"sata\").", - "type": "string" - }, - "name": { - "description": "Disk name.", - "type": "string" - } - } - } - }, - "networks": { - "description": "Networks to attach the VM to.", - "type": "array", - "default": [], - "items": { - "type": "object", - "properties": { - "name": { - "description": "Network attachment name.", - "type": "string" - } - } - } - }, - "subnets": { - "description": "Deprecated: use networks instead.", - "type": "array", - "default": [], - "items": { - "type": "object", - "properties": { - "name": { - "description": "Network attachment name.", - "type": "string" - } - } - } - }, - "gpus": { - "description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).", - "type": "array", - "default": [], - "items": { - "type": "object", - "required": [ - "name" - ], - "properties": { - "name": { - "description": "The name of the GPU resource to attach.", - "type": "string" - } - } - } - }, - "cpuModel": { - "description": "Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map", + "instanceType": { + "description": "Virtual Machine instance type.", "type": "string", - "default": "" + "default": "u1.medium" }, "resources": { "description": "Resource configuration for the virtual machine.", @@ -215,6 +180,18 @@ } } }, + "runStrategy": { + "description": "Requested running state of the VirtualMachineInstance", + "type": "string", + "default": "Always", + "enum": [ + "Always", + "Halted", + "Manual", + "RerunOnFailure", + "Once" + ] + }, "sshKeys": { "description": "List of SSH public keys for authentication.", "type": "array", @@ -223,15 +200,19 @@ "type": "string" } }, - "cloudInit": { - "description": "Cloud-init user data.", - "type": "string", - "default": "" - }, - "cloudInitSeed": { - "description": "Seed string to generate SMBIOS UUID for the VM.", - "type": "string", - "default": "" + "subnets": { + "description": "Additional subnets", + "type": "array", + "default": [], + "items": { + "type": "object", + "properties": { + "name": { + "description": "Subnet name", + "type": "string" + } + } + } } } } diff --git a/packages/apps/vm-instance/values.yaml b/packages/apps/vm-instance/values.yaml index 92e399c2..d5ed5679 100644 --- a/packages/apps/vm-instance/values.yaml +++ b/packages/apps/vm-instance/values.yaml @@ -10,8 +10,8 @@ ## @field {string} name - Disk name. ## @field {string} [bus] - Disk bus type (e.g. "sata"). -## @typedef {struct} Network - Network to attach the VM to. -## @field {string} [name] - Network attachment name. +## @typedef {struct} Subnet - Additional subnets +## @field {string} [name] - Subnet name ## @typedef {struct} GPU - GPU device configuration. ## @field {string} name - The name of the GPU resource to attach. @@ -31,9 +31,6 @@ externalMethod: PortList externalPorts: - 22 -## @param {bool} externalAllowICMP - Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect. -externalAllowICMP: true - ## @enum {string} RunStrategy - Requested running state of the VirtualMachineInstance ## @value Always - VMI should always be running ## @value Halted - VMI should never be running @@ -58,15 +55,13 @@ disks: [] ## - name: example-data ## bus: sata -## @param {[]Network} networks - Networks to attach the VM to. -networks: [] +## @param {[]Subnet} subnets - Additional subnets +subnets: [] ## Example: -## networks: +## subnets: ## - name: subnet-84dbec17 ## - name: subnet-aa8896b5 - -## @param {[]Network} subnets - Deprecated: use networks instead. -subnets: [] +## - name: subnet-e9b97196 ## @param {[]GPU} gpus - List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM). gpus: [] diff --git a/packages/apps/vpc/Makefile b/packages/apps/vpc/Makefile index 2f0c193f..ea4f5d1b 100644 --- a/packages/apps/vpc/Makefile +++ b/packages/apps/vpc/Makefile @@ -1,7 +1,7 @@ include ../../../hack/package.mk generate: - cozyvalues-gen -m 'vpc' -v values.yaml -s values.schema.json -g ../../../api/apps/v1alpha1/vpc/types.go + cozyvalues-gen -v values.yaml -s values.schema.json ../../../hack/update-crd.sh update: diff --git a/packages/apps/vpc/templates/vpc.yaml b/packages/apps/vpc/templates/vpc.yaml index 784c181b..6c0d2249 100644 --- a/packages/apps/vpc/templates/vpc.yaml +++ b/packages/apps/vpc/templates/vpc.yaml @@ -15,34 +15,6 @@ spec: enableExternal: false namespaces: - {{ .Release.Namespace }} -{{- if .Values.peers }} - vpcPeerings: -{{- range .Values.peers }} -{{- $remoteRelease := printf "virtualprivatecloud-%s" .vpcName }} -{{- $remoteVpcId := printf "vpc-%s" (printf "%s/%s" .tenantNamespace $remoteRelease | sha256sum | trunc 6) }} -{{- $sorted := list $vpcId $remoteVpcId | sortAlpha }} -{{- $pairKey := join "/" $sorted }} -{{- $pairHash := sha256sum $pairKey }} -{{- $byte0 := int (include "cozy-lib.strings.hexToInt" (substr 0 2 $pairHash)) }} -{{- $byte1 := int (include "cozy-lib.strings.hexToInt" (substr 2 4 $pairHash)) }} -{{- $oct3 := int (add (mod $byte0 254) 1) }} -{{- $base4 := int (mul (mod $byte1 64) 4) }} -{{- if eq $vpcId (index $sorted 0) }} - - remoteVpc: {{ $remoteVpcId }} - localConnectIP: {{ printf "169.254.%d.%d" $oct3 (int (add $base4 1)) }} -{{- else }} - - remoteVpc: {{ $remoteVpcId }} - localConnectIP: {{ printf "169.254.%d.%d" $oct3 (int (add $base4 2)) }} -{{- end }} -{{- end }} -{{- end }} -{{- if .Values.routes }} - staticRoutes: -{{- range .Values.routes }} - - cidr: {{ .cidr | quote }} - nextHopIP: {{ .nextHopIP | quote }} -{{- end }} -{{- end }} {{- range .Values.subnets }} {{- $subnetId := print "subnet-" (print $.Release.Namespace "/" $vpcId "/" .name | sha256sum | trunc 8) }} @@ -98,12 +70,6 @@ data: {{ .name }}.ID: {{ print "subnet-" (print $.Release.Namespace "/" $vpcId "/" .name | sha256sum | trunc 8) }} {{ .name }}.CIDR: {{ .cidr }} {{- end }} - {{- range .Values.peers }} - {{- $remoteRelease := printf "virtualprivatecloud-%s" .vpcName }} - {{- $remoteVpcId := printf "vpc-%s" (printf "%s/%s" .tenantNamespace $remoteRelease | sha256sum | trunc 6) }} - peer.{{ .tenantNamespace }}.{{ .vpcName }}.vpcId: {{ $remoteVpcId | quote }} - peer.{{ .tenantNamespace }}.{{ .vpcName }}.tenantNamespace: {{ .tenantNamespace | quote }} - {{- end }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding diff --git a/packages/apps/vpc/values.schema.json b/packages/apps/vpc/values.schema.json index b25b46ed..a975d2d7 100644 --- a/packages/apps/vpc/values.schema.json +++ b/packages/apps/vpc/values.schema.json @@ -22,50 +22,6 @@ } } } - }, - "peers": { - "description": "VPC peering connections (bidirectional declaration required)", - "type": "array", - "default": [], - "items": { - "type": "object", - "required": [ - "tenantNamespace", - "vpcName" - ], - "properties": { - "tenantNamespace": { - "description": "Namespace of the remote tenant", - "type": "string" - }, - "vpcName": { - "description": "Logical name of the remote VPC (without \"virtualprivatecloud-\" prefix)", - "type": "string" - } - } - } - }, - "routes": { - "description": "Static routes for the VPC", - "type": "array", - "default": [], - "items": { - "type": "object", - "required": [ - "cidr", - "nextHopIP" - ], - "properties": { - "cidr": { - "description": "Destination CIDR", - "type": "string" - }, - "nextHopIP": { - "description": "Next hop IP address", - "type": "string" - } - } - } } } -} +} \ No newline at end of file diff --git a/packages/apps/vpc/values.yaml b/packages/apps/vpc/values.yaml index 8bd27589..3af8b26b 100644 --- a/packages/apps/vpc/values.yaml +++ b/packages/apps/vpc/values.yaml @@ -14,25 +14,3 @@ subnets: [] ## cidr: "172.16.0.0/24" ## - name: mysubnet1 ## cidr: "172.16.1.0/24" - -## @typedef {struct} Peer - VPC peering target -## @field {string} vpcName - Logical name of the remote VPC (without "virtualprivatecloud-" prefix) -## @field {string} tenantNamespace - Namespace of the remote tenant - -## @param {[]Peer} peers - VPC peering connections (bidirectional declaration required) -peers: [] -## Example: -## peers: -## - vpcName: "other-vpc" -## tenantNamespace: "tenant-other" - -## @typedef {struct} Route - Static route entry -## @field {string} cidr - Destination CIDR -## @field {string} nextHopIP - Next hop IP address - -## @param {[]Route} routes - Static routes for the VPC -routes: [] -## Example: -## routes: -## - cidr: "172.16.1.0/24" -## nextHopIP: "10.0.0.1" diff --git a/packages/apps/vpn/Makefile b/packages/apps/vpn/Makefile index d0b8412f..d1cfda8e 100644 --- a/packages/apps/vpn/Makefile +++ b/packages/apps/vpn/Makefile @@ -1,5 +1,5 @@ include ../../../hack/package.mk generate: - cozyvalues-gen -m 'vpn' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/vpn/types.go + cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh diff --git a/packages/apps/vpn/templates/workloadmonitor.yaml b/packages/apps/vpn/templates/workloadmonitor.yaml index 7fc1ec7a..a75f7940 100644 --- a/packages/apps/vpn/templates/workloadmonitor.yaml +++ b/packages/apps/vpn/templates/workloadmonitor.yaml @@ -2,8 +2,6 @@ apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: name: {{ $.Release.Name }} - labels: - workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }} spec: replicas: {{ .Values.replicas }} minReplicas: 1 diff --git a/packages/apps/vpn/values.schema.json b/packages/apps/vpn/values.schema.json index abfd7b52..14e85262 100644 --- a/packages/apps/vpn/values.schema.json +++ b/packages/apps/vpn/values.schema.json @@ -2,6 +2,24 @@ "title": "Chart Values", "type": "object", "properties": { + "external": { + "description": "Enable external access from outside the cluster.", + "type": "boolean", + "default": false + }, + "externalIPs": { + "description": "List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.", + "type": "array", + "default": [], + "items": { + "type": "string" + } + }, + "host": { + "description": "Host used to substitute into generated URLs.", + "type": "string", + "default": "" + }, "replicas": { "description": "Number of VPN server replicas.", "type": "integer", @@ -54,16 +72,6 @@ "2xlarge" ] }, - "external": { - "description": "Enable external access from outside the cluster.", - "type": "boolean", - "default": false - }, - "host": { - "description": "Host used to substitute into generated URLs.", - "type": "string", - "default": "" - }, "users": { "description": "Users configuration map.", "type": "object", @@ -77,14 +85,6 @@ } } } - }, - "externalIPs": { - "description": "List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.", - "type": "array", - "default": [], - "items": { - "type": "string" - } } } -} +} \ No newline at end of file diff --git a/packages/core/installer/Makefile b/packages/core/installer/Makefile index a661bed4..7038bb9c 100644 --- a/packages/core/installer/Makefile +++ b/packages/core/installer/Makefile @@ -31,7 +31,6 @@ image-operator: image-packages: mkdir -p ../../../_out/assets images - echo $$(git rev-parse HEAD; git diff HEAD; git ls-files --others --exclude-standard) | shasum -a 256 > ../platform/.build-revision flux push artifact \ oci://$(REGISTRY)/cozystack-packages:$(call settag,$(TAG)) \ --path=../../../packages \ diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml index eef691ea..fe1bc662 100644 --- a/packages/core/installer/values.yaml +++ b/packages/core/installer/values.yaml @@ -1,9 +1,9 @@ cozystackOperator: # Deployment variant: talos, generic, hosted variant: talos - image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.3.0@sha256:62574f12486bb40c901cf5ed484cca264405ce5810196d86555cbb27cce1ba48 + image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.1.7@sha256:cac3ed524881459a70b1b2384feacc045674e2b6390b695b959a01022b469642 platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages' - platformSourceRef: 'digest=sha256:a0b9ef938446b3132d3d22ad2262beb1027c48c9037b6c2346fdc2f19acd3036' + platformSourceRef: 'digest=sha256:bda5caa46b06dab270ef2416fc2468c79e6df8c40532de0b8e6172e72a7e5f44' # Generic variant configuration (only used when cozystackOperator.variant=generic) cozystack: # Kubernetes API server host (IP only, no protocol/port) diff --git a/packages/core/platform/images/migrations/migrations/35 b/packages/core/platform/images/migrations/migrations/35 deleted file mode 100755 index a7471180..00000000 --- a/packages/core/platform/images/migrations/migrations/35 +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh -# Migration 35 --> 36 -# Add helm.sh/resource-policy=keep annotation to existing VLogs resources -# so they are preserved when the monitoring helm release upgrades to VLCluster. -# Users will need to manually verify the new cluster is working, then optionally -# migrate historical data and delete old VLogs resources. - -set -euo pipefail - -VLOGS=$(kubectl get vlogs.operator.victoriametrics.com --all-namespaces --output jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null || true) -for resource in $VLOGS; do - NS="${resource%%/*}" - NAME="${resource##*/}" - echo "Adding keep annotation to VLogs/$NAME in $NS" - kubectl annotate vlogs.operator.victoriametrics.com --namespace "$NS" "$NAME" \ - helm.sh/resource-policy=keep \ - --overwrite -done - -kubectl create configmap --namespace cozy-system cozystack-version \ - --from-literal=version=36 --dry-run=client --output yaml | kubectl apply --filename - diff --git a/packages/core/platform/images/migrations/migrations/36 b/packages/core/platform/images/migrations/migrations/36 deleted file mode 100755 index 0f0a94dd..00000000 --- a/packages/core/platform/images/migrations/migrations/36 +++ /dev/null @@ -1,22 +0,0 @@ -#!/bin/sh -# Migration 36 --> 37 -# -# Copy spec.subnets to spec.networks in VMInstance resources. -# The old "subnets" field is kept intact because migrations run before -# the new CRD is applied; removing it now would lose data. - -set -e - -if ! kubectl get crd vminstances.apps.cozystack.io >/dev/null 2>&1; then - echo "VMInstance CRD not found, skipping migration" -else -kubectl get vminstances.apps.cozystack.io -A -o json | jq -r ' - .items[] - | select(.spec.subnets != null and (.spec.subnets | length) > 0) - | select(.spec.networks == null or (.spec.networks | length) == 0) - | "kubectl -n \(.metadata.namespace) patch vminstances.apps.cozystack.io \(.metadata.name) --type=json -p '\''[{\"op\":\"add\",\"path\":\"/spec/networks\",\"value\":\(.spec.subnets|tojson)}]'\''" -' | sh -ex -fi - -# Write version to cozystack-version config -kubectl create configmap -n cozy-system cozystack-version --from-literal=version=37 --dry-run=client -o yaml | kubectl apply -f- diff --git a/packages/core/platform/images/migrations/migrations/37 b/packages/core/platform/images/migrations/migrations/37 deleted file mode 100755 index 856da262..00000000 --- a/packages/core/platform/images/migrations/migrations/37 +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# Migration 37 --> 38 -# Pin PostgreSQL image to 17.7-standard-trixie for system databases. -# -# This migration updates the imageName for all CNPG clusters belonging to -# system components (keycloak-db, grafana-db, alerta-db, seaweedfs-db, and -# harbor's dynamically-named DB): -# - If imageName is not set: pins to 17.7-standard-trixie -# - If imageName has any PG 17 tag: forces 17.7-standard-trixie -# - If imageName has a bare version tag (e.g. :18.1): appends -standard-trixie -# -# NOTE: This migration ONLY updates system CNPG Cluster resources (clusters.postgresql.cnpg.io), -# NOT user-created Postgres applications. - -set -euo pipefail - -TARGET_IMAGE="ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" - -# Static system database names -STATIC_DB_NAMES="keycloak-db grafana-db alerta-db seaweedfs-db" - -echo "=== Updating PostgreSQL images for system databases ===" -echo "Target image: $TARGET_IMAGE" - -# Fetch all CNPG clusters with their name, namespace, imageName, and Helm release annotation in one call -ALL_CLUSTERS=$(kubectl get clusters.postgresql.cnpg.io -A \ - -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.spec.imageName}{"\t"}{.metadata.annotations.meta\.helm\.sh/release-name}{"\n"}{end}' 2>/dev/null || true) - -while IFS=$'\t' read -r NAMESPACE CLUSTER_NAME CURRENT_IMAGE HELM_RELEASE; do - [ -z "$NAMESPACE" ] && continue - - # Check if cluster name matches one of the static system databases - MATCH=false - for db_name in $STATIC_DB_NAMES; do - if [ "$CLUSTER_NAME" = "$db_name" ]; then - MATCH=true - break - fi - done - - # For harbor: match clusters ending with -db whose Helm release ends with -system - if [ "$MATCH" = false ] && [[ "$CLUSTER_NAME" == *-db ]] && [[ "$HELM_RELEASE" == *-system ]]; then - MATCH=true - fi - - if [ "$MATCH" = false ]; then - continue - fi - - PATCH_IMAGE="" - - if [ -z "$CURRENT_IMAGE" ]; then - # imageName not set — pin to target - PATCH_IMAGE="$TARGET_IMAGE" - echo "PATCH $NAMESPACE/$CLUSTER_NAME: imageName not set, setting to $PATCH_IMAGE" - elif [[ "$CURRENT_IMAGE" =~ :17\. ]]; then - # Any PG 17 image — force to the pinned 17.7-standard-trixie - PATCH_IMAGE="$TARGET_IMAGE" - echo "PATCH $NAMESPACE/$CLUSTER_NAME: PG 17 detected, $CURRENT_IMAGE -> $PATCH_IMAGE" - elif [[ "$CURRENT_IMAGE" =~ :[0-9]+\.[0-9]+$ ]]; then - # Bare version tag for other majors (e.g. :18.1) — append -standard-trixie suffix - PATCH_IMAGE="${CURRENT_IMAGE}-standard-trixie" - echo "PATCH $NAMESPACE/$CLUSTER_NAME: bare tag detected, $CURRENT_IMAGE -> $PATCH_IMAGE" - else - echo "SKIP $NAMESPACE/$CLUSTER_NAME: imageName already set to $CURRENT_IMAGE" - continue - fi - - kubectl patch clusters.postgresql.cnpg.io -n "$NAMESPACE" "$CLUSTER_NAME" \ - --type=merge \ - --patch "{\"spec\":{\"imageName\":\"${PATCH_IMAGE}\"}}" -done <<< "$ALL_CLUSTERS" - -echo "=== PostgreSQL image update completed ===" - -# Stamp version -kubectl create configmap -n cozy-system cozystack-version \ - --from-literal=version=38 --dry-run=client -o yaml | kubectl apply -f- diff --git a/packages/core/platform/images/migrations/migrations/38 b/packages/core/platform/images/migrations/migrations/38 deleted file mode 100755 index 59536cb1..00000000 --- a/packages/core/platform/images/migrations/migrations/38 +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/sh -# Migration 38 --> 39 -# Rename DataVolumes/PVCs in cozy-public from vm-image- to vm-default-images-. -# -# The vm-disk package previously looked up golden images with the prefix "vm-image-". -# The new vm-default-images package uses the prefix "vm-default-images-". -# This migration renames any existing DataVolumes so that live vm-disk resources -# continue to resolve their source PVC after upgrade. - -set -euo pipefail - -NAMESPACE="cozy-public" - -# Skip if CDI DataVolume CRD is not installed -if ! kubectl api-resources --api-group=cdi.kubevirt.io -o name 2>/dev/null | grep -q '^datavolumes\.'; then - echo "CDI DataVolume CRD not found, skipping rename" - kubectl create configmap -n cozy-system cozystack-version \ - --from-literal=version=39 --dry-run=client -o yaml | kubectl apply -f- - exit 0 -fi - -# Find DataVolumes whose name starts with "vm-image-" -DVNAMES=$(kubectl get datavolumes.cdi.kubevirt.io -n "$NAMESPACE" \ - -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null \ - | grep '^vm-image-' || true) - -if [ -z "$DVNAMES" ]; then - echo "No vm-image-* DataVolumes found in $NAMESPACE, nothing to rename" -else - for DVNAME in $DVNAMES; do - NEWNAME="vm-default-images-${DVNAME#vm-image-}" - echo "Renaming DataVolume $DVNAME -> $NEWNAME in namespace $NAMESPACE" - - # Export existing DV spec, swap name, and apply as new object - kubectl get datavolumes.cdi.kubevirt.io -n "$NAMESPACE" "$DVNAME" -o json \ - | jq --arg new "$NEWNAME" ' - del(.metadata.resourceVersion, .metadata.uid, .metadata.creationTimestamp, - .metadata.generation, .metadata.selfLink, .metadata.managedFields, - .status) - | .metadata.name = $new - ' \ - | kubectl apply -f - - - # Delete the old DataVolume - kubectl delete datavolumes.cdi.kubevirt.io -n "$NAMESPACE" "$DVNAME" --ignore-not-found=true - echo "Renamed $DVNAME -> $NEWNAME" - done -fi - -# Stamp version -kubectl create configmap -n cozy-system cozystack-version \ - --from-literal=version=39 --dry-run=client -o yaml | kubectl apply -f- diff --git a/packages/core/platform/sources/backupstrategy-controller.yaml b/packages/core/platform/sources/backupstrategy-controller.yaml index b86c5c0d..3647e8dc 100644 --- a/packages/core/platform/sources/backupstrategy-controller.yaml +++ b/packages/core/platform/sources/backupstrategy-controller.yaml @@ -18,5 +18,5 @@ spec: path: system/backupstrategy-controller install: privileged: true - namespace: cozy-backup-controller + namespace: cozy-backupstrategy-controller releaseName: backupstrategy-controller diff --git a/packages/core/platform/sources/cozystack-scheduler.yaml b/packages/core/platform/sources/cozystack-scheduler.yaml deleted file mode 100644 index 52e85a4f..00000000 --- a/packages/core/platform/sources/cozystack-scheduler.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -apiVersion: cozystack.io/v1alpha1 -kind: PackageSource -metadata: - name: cozystack.cozystack-scheduler -spec: - sourceRef: - kind: OCIRepository - name: cozystack-packages - namespace: cozy-system - path: / - variants: - - name: default - components: - - name: cozystack-scheduler - path: system/cozystack-scheduler - install: - namespace: kube-system - releaseName: cozystack-scheduler - - name: linstor - dependsOn: - - cozystack.linstor-scheduler - components: - - name: cozystack-scheduler - path: system/cozystack-scheduler - valuesFiles: - - values-linstor.yaml - install: - namespace: kube-system - releaseName: cozystack-scheduler diff --git a/packages/core/platform/sources/external-dns-application.yaml b/packages/core/platform/sources/external-dns-application.yaml deleted file mode 100644 index 0a37dc52..00000000 --- a/packages/core/platform/sources/external-dns-application.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -apiVersion: cozystack.io/v1alpha1 -kind: PackageSource -metadata: - name: cozystack.external-dns-application -spec: - sourceRef: - kind: OCIRepository - name: cozystack-packages - namespace: cozy-system - path: / - variants: - - name: default - dependsOn: - - cozystack.networking - libraries: - - name: cozy-lib - path: library/cozy-lib - components: - - name: external-dns-system - path: system/external-dns - - name: external-dns - path: extra/external-dns - libraries: ["cozy-lib"] - - name: external-dns-rd - path: system/external-dns-rd - install: - namespace: cozy-system - releaseName: external-dns-rd diff --git a/packages/core/platform/sources/hami.yaml b/packages/core/platform/sources/hami.yaml deleted file mode 100644 index 0184e405..00000000 --- a/packages/core/platform/sources/hami.yaml +++ /dev/null @@ -1,24 +0,0 @@ ---- -apiVersion: cozystack.io/v1alpha1 -kind: PackageSource -metadata: - name: cozystack.hami -spec: - sourceRef: - kind: OCIRepository - name: cozystack-packages - namespace: cozy-system - path: / - variants: - - name: default - dependsOn: - - cozystack.gpu-operator - components: - - name: hami - path: system/hami - valuesFiles: - - values.yaml - install: - privileged: true - namespace: cozy-hami - releaseName: hami diff --git a/packages/core/platform/sources/kubernetes-application.yaml b/packages/core/platform/sources/kubernetes-application.yaml index 088383ad..9787cb19 100644 --- a/packages/core/platform/sources/kubernetes-application.yaml +++ b/packages/core/platform/sources/kubernetes-application.yaml @@ -52,8 +52,6 @@ spec: path: system/cilium - name: kubernetes-gpu-operator path: system/gpu-operator - - name: kubernetes-hami - path: system/hami - name: kubernetes-vertical-pod-autoscaler path: system/vertical-pod-autoscaler - name: kubernetes-prometheus-operator-crds diff --git a/packages/core/platform/sources/linstor-gui.yaml b/packages/core/platform/sources/linstor-gui.yaml deleted file mode 100644 index 005e1fb7..00000000 --- a/packages/core/platform/sources/linstor-gui.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -apiVersion: cozystack.io/v1alpha1 -kind: PackageSource -metadata: - name: cozystack.linstor-gui -spec: - sourceRef: - kind: OCIRepository - name: cozystack-packages - namespace: cozy-system - path: / - variants: - - name: default - dependsOn: - - cozystack.linstor - components: - - name: linstor-gui - path: system/linstor-gui - install: - namespace: cozy-linstor - releaseName: linstor-gui diff --git a/packages/core/platform/sources/networking.yaml b/packages/core/platform/sources/networking.yaml index bece76f8..8e8485b3 100644 --- a/packages/core/platform/sources/networking.yaml +++ b/packages/core/platform/sources/networking.yaml @@ -66,7 +66,6 @@ spec: path: system/cilium valuesFiles: - values.yaml - - values-apparmor.yaml install: privileged: true namespace: cozy-cilium @@ -118,7 +117,6 @@ spec: path: system/cilium valuesFiles: - values.yaml - - values-apparmor.yaml - values-kubeovn.yaml install: privileged: true diff --git a/packages/core/platform/sources/opensearch-application.yaml b/packages/core/platform/sources/opensearch-application.yaml deleted file mode 100644 index 19358c21..00000000 --- a/packages/core/platform/sources/opensearch-application.yaml +++ /dev/null @@ -1,28 +0,0 @@ ---- -apiVersion: cozystack.io/v1alpha1 -kind: PackageSource -metadata: - name: cozystack.opensearch-application -spec: - sourceRef: - kind: OCIRepository - name: cozystack-packages - namespace: cozy-system - path: / - variants: - - name: default - dependsOn: - - cozystack.networking - - cozystack.opensearch-operator - libraries: - - name: cozy-lib - path: library/cozy-lib - components: - - name: opensearch - path: apps/opensearch - libraries: ["cozy-lib"] - - name: opensearch-rd - path: system/opensearch-rd - install: - namespace: cozy-system - releaseName: opensearch-rd diff --git a/packages/core/platform/sources/opensearch-operator.yaml b/packages/core/platform/sources/opensearch-operator.yaml deleted file mode 100644 index 21dd7a43..00000000 --- a/packages/core/platform/sources/opensearch-operator.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: cozystack.io/v1alpha1 -kind: PackageSource -metadata: - name: cozystack.opensearch-operator -spec: - sourceRef: - kind: OCIRepository - name: cozystack-packages - namespace: cozy-system - path: / - variants: - - name: default - dependsOn: - - cozystack.networking - - cozystack.prometheus-operator-crds - components: - - name: opensearch-operator - path: system/opensearch-operator - install: - namespace: cozy-opensearch-operator - releaseName: opensearch-operator diff --git a/packages/core/platform/sources/vm-default-images.yaml b/packages/core/platform/sources/vm-default-images.yaml deleted file mode 100644 index 16cd6a94..00000000 --- a/packages/core/platform/sources/vm-default-images.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: cozystack.io/v1alpha1 -kind: PackageSource -metadata: - name: cozystack.vm-default-images -spec: - sourceRef: - kind: OCIRepository - name: cozystack-packages - namespace: cozy-system - path: / - variants: - - name: default - dependsOn: - - cozystack.networking - - cozystack.kubevirt-cdi - components: - - name: vm-default-images - path: system/vm-default-images - install: - namespace: cozy-system - releaseName: vm-default-images diff --git a/packages/core/platform/templates/apps.yaml b/packages/core/platform/templates/apps.yaml index 6e1ae25a..96415325 100644 --- a/packages/core/platform/templates/apps.yaml +++ b/packages/core/platform/templates/apps.yaml @@ -26,20 +26,15 @@ stringData: oidc-enabled: {{ .Values.authentication.oidc.enabled | quote }} oidc-insecure-skip-verify: {{ .Values.authentication.oidc.insecureSkipVerify | quote }} extra-keycloak-redirect-uri-for-dashboard: {{ index .Values.authentication.oidc.keycloakExtraRedirectUri | quote }} - keycloak-internal-url: {{ .Values.authentication.oidc.keycloakInternalUrl | quote }} expose-services: {{ .Values.publishing.exposedServices | join "," | quote }} expose-ingress: {{ .Values.publishing.ingressName | quote }} expose-external-ips: {{ .Values.publishing.externalIPs | join "," | quote }} - expose-mode: {{ .Values.publishing.exposure | default "externalIPs" | quote }} cluster-domain: {{ .Values.networking.clusterDomain | quote }} api-server-endpoint: {{ .Values.publishing.apiServerEndpoint | quote }} {{- with .Values.branding }} branding: {{- . | toYaml | nindent 8 }} {{- end }} - cpu-allocation-ratio: {{ .Values.resources.cpuAllocationRatio | quote }} - memory-allocation-ratio: {{ .Values.resources.memoryAllocationRatio | quote }} - ephemeral-storage-allocation-ratio: {{ .Values.resources.ephemeralStorageAllocationRatio | quote }} {{- with .Values.scheduling }} scheduling: {{- . | toYaml | nindent 8 }} diff --git a/packages/core/platform/templates/bundles/iaas.yaml b/packages/core/platform/templates/bundles/iaas.yaml index 66ec98b2..41dc5181 100644 --- a/packages/core/platform/templates/bundles/iaas.yaml +++ b/packages/core/platform/templates/bundles/iaas.yaml @@ -2,15 +2,9 @@ {{- fail "bundles.iaas.enabled can only be true when bundles.system.variant is 'isp-full' or 'isp-full-generic'" }} {{- end }} {{- if and .Values.bundles.iaas.enabled (or (eq .Values.bundles.system.variant "isp-full") (eq .Values.bundles.system.variant "isp-full-generic")) }} -{{- $kubevirtComponents := dict -}} -{{- if .Values.resources.cpuAllocationRatio -}} -{{- $_ := set $kubevirtComponents "kubevirt" (dict "values" (dict "cpuAllocationRatio" (.Values.resources.cpuAllocationRatio | int))) -}} -{{- end -}} -{{include "cozystack.platform.package" (list "cozystack.kubevirt" "default" $ $kubevirtComponents) }} +{{include "cozystack.platform.package.default" (list "cozystack.kubevirt" $) }} {{include "cozystack.platform.package.default" (list "cozystack.kubevirt-cdi" $) }} -{{include "cozystack.platform.package.optional.default" (list "cozystack.vm-default-images" $) }} {{include "cozystack.platform.package.optional.default" (list "cozystack.gpu-operator" $) }} -{{include "cozystack.platform.package.optional.default" (list "cozystack.hami" $) }} {{include "cozystack.platform.package.default" (list "cozystack.kamaji" $) }} {{include "cozystack.platform.package.default" (list "cozystack.capi-operator" $) }} {{include "cozystack.platform.package.default" (list "cozystack.capi-provider-bootstrap-kubeadm" $) }} diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml index 6c587c82..c24726ef 100644 --- a/packages/core/platform/templates/bundles/system.yaml +++ b/packages/core/platform/templates/bundles/system.yaml @@ -25,12 +25,10 @@ {{include "cozystack.platform.package" (list "cozystack.networking" "kubeovn-cilium" $ $networkingComponents) }} {{include "cozystack.platform.system.common-packages" $ }} {{include "cozystack.platform.package.default" (list "cozystack.linstor" $) }} -{{include "cozystack.platform.package" (list "cozystack.cozystack-scheduler" "linstor" $) }} {{- end }} {{- if eq .Values.bundles.system.variant "isp-hosted" }} {{include "cozystack.platform.package" (list "cozystack.networking" "noop" $) }} -{{include "cozystack.platform.package.default" (list "cozystack.cozystack-scheduler" $) }} {{- end }} {{- if eq .Values.bundles.system.variant "isp-full-generic" }} @@ -72,12 +70,15 @@ "SVC_CIDR" $svcCIDR "JOIN_CIDR" $joinCIDR -}} {{- $kubeovnDict := dict "ipv4" $kubeovnIpv4 -}} -{{- /* Set MASTER_NODES: explicit value or empty (let kube-ovn discover nodes by label) */ -}} +{{- /* Set MASTER_NODES: explicit value > parsed from apiServerEndpoint > empty (use helm lookup) */ -}} {{- $masterNodes := .Values.networking.kubeovn.MASTER_NODES -}} +{{- if and (not $masterNodes) $apiServerEndpoint -}} +{{- $masterNodes = $apiHost -}} +{{- end -}} {{- if $masterNodes -}} {{- $_ := set $kubeovnDict "MASTER_NODES" $masterNodes -}} {{- end -}} -{{- /* For generic k8s (k3s), control-plane label has value "true" */ -}} +{{- /* For generic k8s (k3s, kubeadm), control-plane label has value "true" */ -}} {{- $_ := set $kubeovnDict "MASTER_NODES_LABEL" "node-role.kubernetes.io/control-plane=true" -}} {{- $kubeovnValues := dict "kube-ovn" $kubeovnDict -}} {{- $_ := set $networkingComponents "kubeovn" (dict "values" $kubeovnValues) -}} @@ -94,7 +95,6 @@ {{- /* Pass talos.enabled: false to linstor for generic Linux */ -}} {{- $linstorComponents := dict "linstor" (dict "values" (dict "talos" (dict "enabled" false))) -}} {{include "cozystack.platform.package" (list "cozystack.linstor" "default" $ $linstorComponents) }} -{{include "cozystack.platform.package" (list "cozystack.cozystack-scheduler" "linstor" $) }} {{- end }} # Cozystack Engine @@ -105,6 +105,9 @@ {{- /* cozystack-api DaemonSet */ -}} {{- $apiValues := dict "cozystackAPI" (dict "nodeSelector" $genericNodeSelector) -}} {{- $_ := set $cozystackEngineComponents "cozystack-api" (dict "values" $apiValues) -}} +{{- /* lineage-controller-webhook DaemonSet */ -}} +{{- $lineageValues := dict "lineageControllerWebhook" (dict "nodeSelector" $genericNodeSelector) -}} +{{- $_ := set $cozystackEngineComponents "lineage-controller-webhook" (dict "values" $lineageValues) -}} {{- end -}} {{- if .Values.authentication.oidc.enabled }} {{include "cozystack.platform.package" (list "cozystack.cozystack-engine" "oidc" $ $cozystackEngineComponents) }} @@ -130,6 +133,7 @@ {{include "cozystack.platform.package.default" (list "cozystack.cozystack-basics" $) }} {{include "cozystack.platform.package.default" (list "cozystack.backupstrategy-controller" $) }} {{include "cozystack.platform.package.default" (list "cozystack.backup-controller" $) }} +{{include "cozystack.platform.package.optional.default" (list "cozystack.velero" $) }} {{include "cozystack.platform.package.default" (list "cozystack.vertical-pod-autoscaler" $) }} {{include "cozystack.platform.package.default" (list "cozystack.metrics-server" $) }} {{- $monitoringAgentsComponents := dict "monitoring-agents" (dict "values" (dict "global" (dict "target" "tenant-root"))) -}} @@ -145,10 +149,7 @@ {{include "cozystack.platform.package.optional.default" (list "cozystack.nfs-driver" $) }} {{include "cozystack.platform.package.optional.default" (list "cozystack.telepresence" $) }} {{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns" $) }} -{{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns-application" $) }} {{include "cozystack.platform.package.optional.default" (list "cozystack.external-secrets-operator" $) }} -{{include "cozystack.platform.package.optional.default" (list "cozystack.velero" $) }} -{{include "cozystack.platform.package.optional.default" (list "cozystack.linstor-gui" $) }} {{- if has "cozystack.bootbox" (default (list) .Values.bundles.enabledPackages) }} {{include "cozystack.platform.package.default" (list "cozystack.bootbox-application" $) }} {{include "cozystack.platform.package.default" (list "cozystack.bootbox" $) }} diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml index 605e23bc..dd197b84 100644 --- a/packages/core/platform/values.yaml +++ b/packages/core/platform/values.yaml @@ -5,8 +5,8 @@ sourceRef: path: / migrations: enabled: false - image: ghcr.io/cozystack/cozystack/platform-migrations:v1.3.0@sha256:555e4b76421361805a84bc9088b01b23a9c4a9430bd8ebd2db82ef9677d7008c - targetVersion: 39 + image: ghcr.io/cozystack/cozystack/platform-migrations:v1.1.7@sha256:bcbe612879cecd2ae1cef91dfff6d34d009c2f7de6592145c04a2d6d21b28f4b + targetVersion: 35 # Bundle deployment configuration bundles: system: @@ -45,41 +45,6 @@ publishing: - cdi-uploadproxy apiServerEndpoint: "" # example: "https://api.example.org" externalIPs: [] - # Exposure mode for the ingress-nginx Service. When "externalIPs" (current - # default) is selected, the Service is created as ClusterIP with - # Service.spec.externalIPs set from publishing.externalIPs. When - # "loadBalancer" is selected, the Service is type: LoadBalancer and a - # CiliumLoadBalancerIPPool makes those same addresses allocatable via LB IPAM. - # - # Service.spec.externalIPs is deprecated upstream in Kubernetes v1.36 - # (KEP-5707). The AllowServiceExternalIPs feature gate is expected to default - # to false around v1.40 and the implementation removed around v1.43 — switch - # to "loadBalancer" before upgrading past v1.40. - # - # Caveats for the "loadBalancer" mode: - # - publishing.externalIPs must contain at least one non-empty address, - # otherwise the chart render fails with an explicit error (a LoadBalancer - # Service without a pool would sit in forever). - # - The ingress-nginx Service is created with externalTrafficPolicy: Local - # to preserve the client source IP. Traffic arriving on a node that does - # not host an ingress-nginx pod is dropped, so the external IP must be - # routed to a node that runs the ingress pod (floating IP / keepalived / - # upstream router / podAntiAffinity). - # - Cilium does NOT announce the IP on its own unless L2 announcements or - # BGP are enabled in the Cilium values (disabled by default in Cozystack). - # This mode assumes the operator already routes the externalIPs to a - # cluster node; enabling announcements is out of scope for this setting. - # - Switching this value on a running cluster causes the ingress-nginx - # Service to be recreated (the HelmRelease has upgrade.force: true and - # the Service kind changes between ClusterIP and LoadBalancer). Expect a - # brief interruption of ingress traffic during the flip. - # - # Scope: this setting only controls the ingress-nginx Service. Other - # cozystack components that currently write Service.spec.externalIPs directly - # (e.g. the vpn app at packages/apps/vpn/templates/service.yaml) are NOT - # migrated by flipping this value and must be addressed separately before - # the AllowServiceExternalIPs feature gate flips to off in ~v1.40. - exposure: externalIPs # "externalIPs" or "loadBalancer" certificates: solver: http01 # "http01" or "dns01" issuerName: letsencrypt-prod @@ -89,11 +54,6 @@ authentication: enabled: false insecureSkipVerify: false keycloakExtraRedirectUri: "" - # Internal URL to access KeyCloak realm for backend-to-backend requests (bypasses external DNS). - # When set, oauth2-proxy uses --skip-oidc-discovery and routes all backend calls (token, jwks, - # userinfo, logout) through this URL while keeping browser redirects on the external URL. - # Example: http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy - keycloakInternalUrl: "" # Pod scheduling configuration scheduling: globalAppTopologySpreadConstraints: "" diff --git a/packages/core/talos/images/talos/profiles/initramfs.yaml b/packages/core/talos/images/talos/profiles/initramfs.yaml index 182fb3e8..20bc27d3 100644 --- a/packages/core/talos/images/talos/profiles/initramfs.yaml +++ b/packages/core/talos/images/talos/profiles/initramfs.yaml @@ -3,24 +3,24 @@ arch: amd64 platform: metal secureboot: false -version: v1.12.6 +version: v1.12.1 input: kernel: path: /usr/install/amd64/vmlinuz initramfs: path: /usr/install/amd64/initramfs.xz baseInstaller: - imageRef: "ghcr.io/siderolabs/installer:v1.12.6" + imageRef: "ghcr.io/siderolabs/installer:v1.12.1" systemExtensions: - - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7 - - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd - - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231 - - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65 - - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2 - - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2 - - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab - - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3 - - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1 + - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe + - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599 + - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb + - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7 + - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed + - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a + - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326 + - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86 + - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246 output: kind: initramfs imageOptions: {} diff --git a/packages/core/talos/images/talos/profiles/installer.yaml b/packages/core/talos/images/talos/profiles/installer.yaml index c56c1d32..b219e012 100644 --- a/packages/core/talos/images/talos/profiles/installer.yaml +++ b/packages/core/talos/images/talos/profiles/installer.yaml @@ -3,24 +3,24 @@ arch: amd64 platform: metal secureboot: false -version: v1.12.6 +version: v1.12.1 input: kernel: path: /usr/install/amd64/vmlinuz initramfs: path: /usr/install/amd64/initramfs.xz baseInstaller: - imageRef: "ghcr.io/siderolabs/installer:v1.12.6" + imageRef: "ghcr.io/siderolabs/installer:v1.12.1" systemExtensions: - - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7 - - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd - - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231 - - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65 - - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2 - - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2 - - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab - - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3 - - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1 + - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe + - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599 + - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb + - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7 + - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed + - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a + - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326 + - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86 + - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246 output: kind: installer imageOptions: {} diff --git a/packages/core/talos/images/talos/profiles/iso.yaml b/packages/core/talos/images/talos/profiles/iso.yaml index 25fc336a..5773c6a6 100644 --- a/packages/core/talos/images/talos/profiles/iso.yaml +++ b/packages/core/talos/images/talos/profiles/iso.yaml @@ -3,24 +3,24 @@ arch: amd64 platform: metal secureboot: false -version: v1.12.6 +version: v1.12.1 input: kernel: path: /usr/install/amd64/vmlinuz initramfs: path: /usr/install/amd64/initramfs.xz baseInstaller: - imageRef: "ghcr.io/siderolabs/installer:v1.12.6" + imageRef: "ghcr.io/siderolabs/installer:v1.12.1" systemExtensions: - - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7 - - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd - - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231 - - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65 - - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2 - - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2 - - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab - - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3 - - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1 + - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe + - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599 + - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb + - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7 + - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed + - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a + - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326 + - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86 + - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246 output: kind: iso imageOptions: {} diff --git a/packages/core/talos/images/talos/profiles/kernel.yaml b/packages/core/talos/images/talos/profiles/kernel.yaml index d0153bf8..2f80bbda 100644 --- a/packages/core/talos/images/talos/profiles/kernel.yaml +++ b/packages/core/talos/images/talos/profiles/kernel.yaml @@ -3,24 +3,24 @@ arch: amd64 platform: metal secureboot: false -version: v1.12.6 +version: v1.12.1 input: kernel: path: /usr/install/amd64/vmlinuz initramfs: path: /usr/install/amd64/initramfs.xz baseInstaller: - imageRef: "ghcr.io/siderolabs/installer:v1.12.6" + imageRef: "ghcr.io/siderolabs/installer:v1.12.1" systemExtensions: - - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7 - - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd - - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231 - - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65 - - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2 - - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2 - - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab - - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3 - - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1 + - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe + - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599 + - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb + - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7 + - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed + - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a + - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326 + - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86 + - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246 output: kind: kernel imageOptions: {} diff --git a/packages/core/talos/images/talos/profiles/metal.yaml b/packages/core/talos/images/talos/profiles/metal.yaml index 579cc333..d460e0d8 100644 --- a/packages/core/talos/images/talos/profiles/metal.yaml +++ b/packages/core/talos/images/talos/profiles/metal.yaml @@ -3,24 +3,24 @@ arch: amd64 platform: metal secureboot: false -version: v1.12.6 +version: v1.12.1 input: kernel: path: /usr/install/amd64/vmlinuz initramfs: path: /usr/install/amd64/initramfs.xz baseInstaller: - imageRef: "ghcr.io/siderolabs/installer:v1.12.6" + imageRef: "ghcr.io/siderolabs/installer:v1.12.1" systemExtensions: - - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7 - - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd - - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231 - - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65 - - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2 - - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2 - - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab - - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3 - - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1 + - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe + - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599 + - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb + - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7 + - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed + - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a + - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326 + - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86 + - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246 output: kind: image imageOptions: { diskSize: 1306525696, diskFormat: raw } diff --git a/packages/core/talos/images/talos/profiles/nocloud.yaml b/packages/core/talos/images/talos/profiles/nocloud.yaml index 24ad7f3c..3dfb37f7 100644 --- a/packages/core/talos/images/talos/profiles/nocloud.yaml +++ b/packages/core/talos/images/talos/profiles/nocloud.yaml @@ -3,24 +3,24 @@ arch: amd64 platform: nocloud secureboot: false -version: v1.12.6 +version: v1.12.1 input: kernel: path: /usr/install/amd64/vmlinuz initramfs: path: /usr/install/amd64/initramfs.xz baseInstaller: - imageRef: "ghcr.io/siderolabs/installer:v1.12.6" + imageRef: "ghcr.io/siderolabs/installer:v1.12.1" systemExtensions: - - imageRef: ghcr.io/siderolabs/amd-ucode:20260309@sha256:716cd5350f77e7b10eebef88d8abdd0c32f2d929acd2bceac7ea33c0aac3b1a7 - - imageRef: ghcr.io/siderolabs/amdgpu:20260309-v1.12.6@sha256:64c7cbcde57a69742c76e3899385f5cd6af1238b0aba094962197fd4098838bd - - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20260309@sha256:b17b87d9a20c806cf186e95ab351b771ffd622a35afcbd41eb07d4642680a231 - - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20260309@sha256:eee55c66cb23fe93380b83909af2cd4ede970205b861c0aa147404c88e8c7f65 - - imageRef: ghcr.io/siderolabs/i915:20260309-v1.12.6@sha256:6d150e23b2ca98ed34fca2b0510bc97e912f95839926bf6e02c55952e15387c2 - - imageRef: ghcr.io/siderolabs/intel-ucode:20260227@sha256:6112f6426a7081727545f7c33dcf2a89ff672494847b180380b4c58f3544a7b2 - - imageRef: ghcr.io/siderolabs/qlogic-firmware:20260309@sha256:b97cfde1e252412ba594a16302a3505f80aee1f105e2aa76b3bdf3b9dcc56cab - - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.6@sha256:f524139c5be4626d7f2b6bd47745ce93648f3f1ab2b681fb00f8ab97ec2c19a3 - - imageRef: ghcr.io/siderolabs/zfs:2.4.1-v1.12.6@sha256:059d39f1d2d6dde263dbd8062207d0aa68805bb0748c087494791c7f985b87d1 + - imageRef: ghcr.io/siderolabs/amd-ucode:20251125@sha256:aa2c684933d28cf10ef785f0d94f91d6d098e164374114648867cf81c2b585fe + - imageRef: ghcr.io/siderolabs/amdgpu:20251125-v1.12.1@sha256:b73aba10ac51cd0d74a6c45210ccee3f6b7d2d97f9b3151d0563b11aa0727599 + - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20251125@sha256:fe33c69c471a8d097c58ab9e5e1e099c3c6e5bb785e74f6f135fdbd71c3b0feb + - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20251125@sha256:01458f60448e166eeb641ee989b941725cbe6759e10afe2251c6d1b1ca5ba1b7 + - imageRef: ghcr.io/siderolabs/i915:20251125-v1.12.1@sha256:fb89c85a04ecb85abaec9d400e03a1628bf68aef3580e98f340cbe8920a6e4ed + - imageRef: ghcr.io/siderolabs/intel-ucode:20251111@sha256:51b7d1c31cb82f340a96228f1870b1e829e8ed2dfeef6d39926975303736d26a + - imageRef: ghcr.io/siderolabs/qlogic-firmware:20251125@sha256:485ef0a0b58328ded511e9a76014c353da24bb147c8b2929068827e5f9a22326 + - imageRef: ghcr.io/siderolabs/drbd:9.2.16-v1.12.1@sha256:2c0dc35d5f3e1ac23de6eeee5554d9da010ac848a733a538c9568a9ccc782d86 + - imageRef: ghcr.io/siderolabs/zfs:2.4.0-v1.12.1@sha256:926f4cdaaa2cfad09f080eda5cfd08b8ba0bad083df3ca59e9764f4104539246 output: kind: image imageOptions: { diskSize: 1306525696, diskFormat: raw } diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml index 9d4bdd10..052df18f 100644 --- a/packages/core/testing/values.yaml +++ b/packages/core/testing/values.yaml @@ -1,2 +1,2 @@ e2e: - image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.3.0@sha256:0367a03b981df2a3ea13f411d4cb7869c2bf2c89c07d3d5c8971b9a28921ccef + image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.1.7@sha256:0367a03b981df2a3ea13f411d4cb7869c2bf2c89c07d3d5c8971b9a28921ccef diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag index f51c7675..5ad241c8 100644 --- a/packages/extra/bootbox/images/matchbox.tag +++ b/packages/extra/bootbox/images/matchbox.tag @@ -1 +1 @@ -ghcr.io/cozystack/cozystack/matchbox:v1.3.0@sha256:85b8e04bf6f0690612dd63e80475df269f4a436d16680f8a40f2860cf16e2f74 +ghcr.io/cozystack/cozystack/matchbox:v1.1.7@sha256:c184033a07b48c8c0519bcf1d31de3820730786b23b2f2d4deb9f56b1b62a49e diff --git a/packages/extra/bootbox/values.schema.json b/packages/extra/bootbox/values.schema.json index 8e243c12..994f47cd 100644 --- a/packages/extra/bootbox/values.schema.json +++ b/packages/extra/bootbox/values.schema.json @@ -2,19 +2,6 @@ "title": "Chart Values", "type": "object", "properties": { - "whitelistHTTP": { - "description": "Secure HTTP by enabling client networks whitelisting.", - "type": "boolean", - "default": true - }, - "whitelist": { - "description": "List of client networks.", - "type": "array", - "default": [], - "items": { - "type": "string" - } - }, "machines": { "description": "Configuration of physical machine instances.", "type": "array", @@ -91,6 +78,19 @@ } } } + }, + "whitelist": { + "description": "List of client networks.", + "type": "array", + "default": [], + "items": { + "type": "string" + } + }, + "whitelistHTTP": { + "description": "Secure HTTP by enabling client networks whitelisting.", + "type": "boolean", + "default": true } } -} +} \ No newline at end of file diff --git a/packages/extra/etcd/Makefile b/packages/extra/etcd/Makefile index 2b3ed61e..f37d6e1e 100644 --- a/packages/extra/etcd/Makefile +++ b/packages/extra/etcd/Makefile @@ -5,6 +5,3 @@ include ../../../hack/package.mk generate: cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh - -test: - helm unittest . diff --git a/packages/extra/etcd/templates/hook/job.yaml b/packages/extra/etcd/templates/hook/job.yaml new file mode 100644 index 00000000..3bf2f84b --- /dev/null +++ b/packages/extra/etcd/templates/hook/job.yaml @@ -0,0 +1,39 @@ +{{- $shouldUpdateCerts := true }} +{{- $configMap := lookup "v1" "ConfigMap" .Release.Namespace "etcd-deployed-version" }} +{{- if $configMap }} + {{- $deployedVersion := index $configMap "data" "version" }} + {{- if $deployedVersion | semverCompare ">= 2.6.1" }} + {{- $shouldUpdateCerts = false }} + {{- end }} +{{- end }} + +{{- if $shouldUpdateCerts }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: etcd-hook + annotations: + helm.sh/hook: post-upgrade + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded +spec: + template: + metadata: + labels: + policy.cozystack.io/allow-to-apiserver: "true" + spec: + serviceAccountName: etcd-hook + containers: + - name: kubectl + image: docker.io/alpine/k8s:1.33.4 + command: + - sh + args: + - -exc + - |- + kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-ca-tls etcd-peer-ca-tls + sleep 10 + kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-client-tls etcd-peer-tls etcd-server-tls + kubectl --namespace={{ .Release.Namespace }} delete pods --selector=app.kubernetes.io/instance=etcd,app.kubernetes.io/managed-by=etcd-operator,app.kubernetes.io/name=etcd,cozystack.io/service=etcd + restartPolicy: Never +{{- end }} diff --git a/packages/extra/etcd/templates/hook/role.yaml b/packages/extra/etcd/templates/hook/role.yaml new file mode 100644 index 00000000..327eeadb --- /dev/null +++ b/packages/extra/etcd/templates/hook/role.yaml @@ -0,0 +1,26 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + annotations: + helm.sh/hook: post-upgrade + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + name: etcd-hook +rules: +- apiGroups: + - "" + resources: + - secrets + - pods + verbs: + - get + - list + - watch + - delete +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch diff --git a/packages/extra/etcd/templates/hook/rolebinding.yaml b/packages/extra/etcd/templates/hook/rolebinding.yaml new file mode 100644 index 00000000..0ee0ffd1 --- /dev/null +++ b/packages/extra/etcd/templates/hook/rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: etcd-hook + annotations: + helm.sh/hook: post-upgrade + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: etcd-hook +subjects: + - kind: ServiceAccount + name: etcd-hook + namespace: {{ .Release.Namespace | quote }} diff --git a/packages/extra/etcd/templates/hook/serviceaccount.yaml b/packages/extra/etcd/templates/hook/serviceaccount.yaml new file mode 100644 index 00000000..552fb5fc --- /dev/null +++ b/packages/extra/etcd/templates/hook/serviceaccount.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: etcd-hook + annotations: + helm.sh/hook: post-upgrade + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded diff --git a/packages/extra/etcd/templates/version.yaml b/packages/extra/etcd/templates/version.yaml new file mode 100644 index 00000000..cc9375bb --- /dev/null +++ b/packages/extra/etcd/templates/version.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: etcd-deployed-version +data: + version: {{ .Chart.Version }} diff --git a/packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml b/packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml deleted file mode 100644 index 0e4f5aa3..00000000 --- a/packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml +++ /dev/null @@ -1,34 +0,0 @@ -suite: etcd chart does not ship a destructive post-upgrade cert-regeneration hook - -release: - name: etcd - namespace: tenant-root - -templates: - - templates/check-release-name.yaml - - templates/dashboard-resourcemap.yaml - - templates/datastore.yaml - - templates/etcd-defrag.yaml - - templates/hook/job.yaml - - templates/podscrape.yaml - - templates/prometheus-rules.yaml - - templates/version.yaml - -tests: - - it: renders no Job named etcd-hook - documentSelector: - path: metadata.name - value: etcd-hook - skipEmptyTemplates: true - asserts: - - hasDocuments: - count: 0 - - - it: renders no ConfigMap named etcd-deployed-version - documentSelector: - path: metadata.name - value: etcd-deployed-version - skipEmptyTemplates: true - asserts: - - hasDocuments: - count: 0 diff --git a/packages/extra/etcd/values.schema.json b/packages/extra/etcd/values.schema.json index 3c66664c..0f696c57 100644 --- a/packages/extra/etcd/values.schema.json +++ b/packages/extra/etcd/values.schema.json @@ -2,25 +2,6 @@ "title": "Chart Values", "type": "object", "properties": { - "size": { - "description": "Persistent Volume size.", - "default": "4Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "storageClass": { - "description": "StorageClass used to store the data.", - "type": "string", - "default": "" - }, "replicas": { "description": "Number of etcd replicas.", "type": "integer", @@ -60,6 +41,25 @@ "x-kubernetes-int-or-string": true } } + }, + "size": { + "description": "Persistent Volume size.", + "default": "4Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "storageClass": { + "description": "StorageClass used to store the data.", + "type": "string", + "default": "" } } -} +} \ No newline at end of file diff --git a/packages/extra/external-dns/Chart.yaml b/packages/extra/external-dns/Chart.yaml deleted file mode 100644 index d9788a41..00000000 --- a/packages/extra/external-dns/Chart.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v2 -name: external-dns -description: External DNS for automatic DNS record management -icon: /logos/external-dns.svg -type: application -version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process diff --git a/packages/extra/external-dns/Makefile b/packages/extra/external-dns/Makefile deleted file mode 100644 index 8b8fbc2f..00000000 --- a/packages/extra/external-dns/Makefile +++ /dev/null @@ -1,7 +0,0 @@ -NAME=external-dns - -include ../../../hack/package.mk - -generate: - cozyvalues-gen -v values.yaml -s values.schema.json -r README.md - ../../../hack/update-crd.sh diff --git a/packages/extra/external-dns/README.md b/packages/extra/external-dns/README.md deleted file mode 100644 index 027182c1..00000000 --- a/packages/extra/external-dns/README.md +++ /dev/null @@ -1,88 +0,0 @@ -# External DNS - -## Parameters - -### Common parameters - -| Name | Description | Type | Value | -| ------------------ | ---------------------------------------------------------------------------------- | ---------- | ------------- | -| `provider` | DNS provider name. | `string` | `{}` | -| `domainFilters` | List of domains this external-dns instance can manage. | `[]string` | `[]` | -| `policy` | How DNS records are synchronized. | `string` | `upsert-only` | -| `extraArgs` | Extra arguments for external-dns. | `[]string` | `[]` | -| `gatewayAPI` | Enable Gateway API HTTPRoute as a source for DNS records. | `bool` | `false` | -| `annotationPrefix` | Custom annotation prefix for external-dns (useful for running multiple instances). | `string` | `""` | - - -### Cloudflare - -| Name | Description | Type | Value | -| ------------ | -------------------------------- | -------- | ----------------------------------------------------------- | -| `cloudflare` | Cloudflare provider credentials. | `object` | `{"apiEmail":"","apiKey":"","apiToken":"","proxied":false}` | - - -### AWS - -| Name | Description | Type | Value | -| ----- | --------------------------------- | -------- | ------------------------------------------------------------------- | -| `aws` | AWS Route53 provider credentials. | `object` | `{"accessKeyId":"","region":"","secretAccessKey":"","zoneType":""}` | - - -### Azure - -| Name | Description | Type | Value | -| ------- | ------------------------------- | -------- | ---------------------------------------------------------------------------------------------- | -| `azure` | Azure DNS provider credentials. | `object` | `{"aadClientId":"","aadClientSecret":"","resourceGroup":"","subscriptionId":"","tenantId":""}` | - - -### Google - -| Name | Description | Type | Value | -| -------- | -------------------------------------- | -------- | --------------------------------------- | -| `google` | Google Cloud DNS provider credentials. | `object` | `{"project":"","serviceAccountKey":""}` | - - -### DigitalOcean - -| Name | Description | Type | Value | -| -------------- | -------------------------------------- | -------- | -------------- | -| `digitalocean` | DigitalOcean DNS provider credentials. | `object` | `{"token":""}` | - - -### Linode - -| Name | Description | Type | Value | -| -------- | -------------------------------- | -------- | -------------- | -| `linode` | Linode DNS provider credentials. | `object` | `{"token":""}` | - - -### OVH - -| Name | Description | Type | Value | -| ----- | ----------------------------- | -------- | ----------------------------------------------------------------------------- | -| `ovh` | OVH DNS provider credentials. | `object` | `{"applicationKey":"","applicationSecret":"","consumerKey":"","endpoint":""}` | - - -### Exoscale - -| Name | Description | Type | Value | -| ---------- | ---------------------------------- | -------- | ------------------------------ | -| `exoscale` | Exoscale DNS provider credentials. | `object` | `{"apiKey":"","apiSecret":""}` | - - -### GoDaddy - -| Name | Description | Type | Value | -| --------- | --------------------------------- | -------- | ------------------------------ | -| `godaddy` | GoDaddy DNS provider credentials. | `object` | `{"apiKey":"","apiSecret":""}` | - - -### Resources - -| Name | Description | Type | Value | -| ------------------ | -------------------------------------------------------------------------------------------------------- | ---------- | ------ | -| `resources` | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object` | `{}` | -| `resources.cpu` | CPU available to each replica. | `quantity` | `""` | -| `resources.memory` | Memory (RAM) available to each replica. | `quantity` | `""` | -| `resourcesPreset` | Default sizing preset used when `resources` is omitted. | `string` | `nano` | - diff --git a/packages/extra/external-dns/charts/cozy-lib b/packages/extra/external-dns/charts/cozy-lib deleted file mode 120000 index e1813509..00000000 --- a/packages/extra/external-dns/charts/cozy-lib +++ /dev/null @@ -1 +0,0 @@ -../../../library/cozy-lib \ No newline at end of file diff --git a/packages/extra/external-dns/config.json b/packages/extra/external-dns/config.json deleted file mode 100644 index b2f956f3..00000000 --- a/packages/extra/external-dns/config.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "comments": { - "format": "##" - }, - "tags": { - "param": "@param", - "section": "@section", - "descriptionStart": "@descriptionStart", - "descriptionEnd": "@descriptionEnd", - "skip": "@skip", - "extra": "@extra" - }, - "modifiers": { - "array": "array", - "object": "object", - "string": "string", - "nullable": "nullable", - "default": "default" - }, - "regexp": { - "paramsSectionTitle": "Parameters" - } -} diff --git a/packages/extra/external-dns/logos/external-dns.svg b/packages/extra/external-dns/logos/external-dns.svg deleted file mode 100644 index b22ad8c4..00000000 --- a/packages/extra/external-dns/logos/external-dns.svg +++ /dev/null @@ -1,20 +0,0 @@ - - - - - - - - - - - - - - - - - - - - diff --git a/packages/extra/external-dns/templates/dashboard-resourcemap.yaml b/packages/extra/external-dns/templates/dashboard-resourcemap.yaml deleted file mode 100644 index edd96b74..00000000 --- a/packages/extra/external-dns/templates/dashboard-resourcemap.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ .Release.Name }}-dashboard-resources -rules: -- apiGroups: - - helm.toolkit.fluxcd.io - resources: - - helmreleases - resourceNames: - - {{ .Release.Name }} - verbs: ["get", "list", "watch"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-dashboard-resources -subjects: -{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "admin" .Release.Namespace) }} -roleRef: - kind: Role - name: {{ .Release.Name }}-dashboard-resources - apiGroup: rbac.authorization.k8s.io diff --git a/packages/extra/external-dns/templates/external-dns.yaml b/packages/extra/external-dns/templates/external-dns.yaml deleted file mode 100644 index cdfb8901..00000000 --- a/packages/extra/external-dns/templates/external-dns.yaml +++ /dev/null @@ -1,169 +0,0 @@ -{{- if not .Values.provider }} -{{- fail "provider is required: set it to one of cloudflare, aws, azure, google, digitalocean, linode, ovh, exoscale, godaddy, inmemory" }} -{{- end }} -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: {{ .Release.Name }}-system - labels: - app.kubernetes.io/instance: {{ .Release.Name }}-system - app.kubernetes.io/managed-by: {{ .Release.Service }} -spec: - chartRef: - kind: ExternalArtifact - name: cozystack-external-dns-application-default-external-dns-system - namespace: cozy-system - interval: 5m - timeout: 10m - install: - remediation: - retries: -1 - upgrade: - force: true - remediation: - retries: -1 - values: - external-dns: - namespaced: true - txtOwnerId: {{ .Release.Namespace | quote }} - policy: {{ .Values.policy | quote }} - {{- if .Values.annotationPrefix }} - annotationPrefix: {{ .Values.annotationPrefix | quote }} - {{- end }} - provider: - name: {{ .Values.provider | quote }} - sources: - - ingress - - service - {{- if .Values.gatewayAPI }} - - gateway-httproute - {{- end }} - {{- with .Values.domainFilters }} - domainFilters: - {{- toYaml . | nindent 8 }} - {{- end }} - - {{- /* Provider-specific credentials and config */}} - - {{- if eq .Values.provider "cloudflare" }} - {{- if or .Values.cloudflare.apiToken (and .Values.cloudflare.apiKey .Values.cloudflare.apiEmail) }} - env: - {{- if .Values.cloudflare.apiToken }} - - name: CF_API_TOKEN - value: {{ .Values.cloudflare.apiToken | quote }} - {{- else }} - - name: CF_API_KEY - value: {{ .Values.cloudflare.apiKey | quote }} - - name: CF_API_EMAIL - value: {{ .Values.cloudflare.apiEmail | quote }} - {{- end }} - {{- end }} - {{- if .Values.cloudflare.proxied }} - cloudflare: - proxied: true - {{- end }} - {{- end }} - - {{- if eq .Values.provider "aws" }} - {{- if or .Values.aws.accessKeyId .Values.aws.secretAccessKey .Values.aws.region }} - env: - {{- if .Values.aws.accessKeyId }} - - name: AWS_ACCESS_KEY_ID - value: {{ .Values.aws.accessKeyId | quote }} - {{- end }} - {{- if .Values.aws.secretAccessKey }} - - name: AWS_SECRET_ACCESS_KEY - value: {{ .Values.aws.secretAccessKey | quote }} - {{- end }} - {{- if .Values.aws.region }} - - name: AWS_DEFAULT_REGION - value: {{ .Values.aws.region | quote }} - {{- end }} - {{- end }} - {{- if .Values.aws.zoneType }} - aws: - zoneType: {{ .Values.aws.zoneType | quote }} - {{- end }} - {{- end }} - - {{- if eq .Values.provider "azure" }} - {{- if or .Values.azure.tenantId .Values.azure.subscriptionId .Values.azure.resourceGroup .Values.azure.aadClientId .Values.azure.aadClientSecret }} - azure: - tenantId: {{ .Values.azure.tenantId | quote }} - subscriptionId: {{ .Values.azure.subscriptionId | quote }} - resourceGroup: {{ .Values.azure.resourceGroup | quote }} - aadClientId: {{ .Values.azure.aadClientId | quote }} - aadClientSecret: {{ .Values.azure.aadClientSecret | quote }} - {{- end }} - {{- end }} - - {{- if eq .Values.provider "digitalocean" }} - {{- if .Values.digitalocean.token }} - env: - - name: DO_TOKEN - value: {{ .Values.digitalocean.token | quote }} - {{- end }} - {{- end }} - - {{- if eq .Values.provider "google" }} - {{- if or .Values.google.project .Values.google.serviceAccountKey }} - google: - project: {{ .Values.google.project | quote }} - {{- if .Values.google.serviceAccountKey }} - serviceAccountKey: {{ .Values.google.serviceAccountKey | quote }} - {{- end }} - {{- end }} - {{- end }} - - {{- if eq .Values.provider "linode" }} - {{- if .Values.linode.token }} - env: - - name: LINODE_TOKEN - value: {{ .Values.linode.token | quote }} - {{- end }} - {{- end }} - - {{- if eq .Values.provider "ovh" }} - {{- if or .Values.ovh.endpoint .Values.ovh.applicationKey .Values.ovh.applicationSecret .Values.ovh.consumerKey }} - env: - - name: OVH_ENDPOINT - value: {{ .Values.ovh.endpoint | quote }} - - name: OVH_APPLICATION_KEY - value: {{ .Values.ovh.applicationKey | quote }} - - name: OVH_APPLICATION_SECRET - value: {{ .Values.ovh.applicationSecret | quote }} - - name: OVH_CONSUMER_KEY - value: {{ .Values.ovh.consumerKey | quote }} - {{- end }} - {{- end }} - - {{- if eq .Values.provider "exoscale" }} - {{- if or .Values.exoscale.apiKey .Values.exoscale.apiSecret }} - env: - - name: EXOSCALE_API_KEY - value: {{ .Values.exoscale.apiKey | quote }} - - name: EXOSCALE_API_SECRET - value: {{ .Values.exoscale.apiSecret | quote }} - {{- end }} - {{- end }} - - {{- /* extraArgs: merge user-supplied args with provider-specific args (godaddy) */}} - {{- $godaddyArgs := list }} - {{- if eq .Values.provider "godaddy" }} - {{- if .Values.godaddy.apiKey }} - {{- $godaddyArgs = append $godaddyArgs (printf "--godaddy-api-key=%s" .Values.godaddy.apiKey) }} - {{- end }} - {{- if .Values.godaddy.apiSecret }} - {{- $godaddyArgs = append $godaddyArgs (printf "--godaddy-api-secret=%s" .Values.godaddy.apiSecret) }} - {{- end }} - {{- end }} - {{- $allArgs := concat (.Values.extraArgs | default list) $godaddyArgs }} - {{- with $allArgs }} - extraArgs: - {{- toYaml . | nindent 8 }} - {{- end }} - - {{- with (include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $)) }} - resources: - {{- . | nindent 8 }} - {{- end }} diff --git a/packages/extra/external-dns/values.schema.json b/packages/extra/external-dns/values.schema.json deleted file mode 100644 index 08de0f8e..00000000 --- a/packages/extra/external-dns/values.schema.json +++ /dev/null @@ -1,193 +0,0 @@ -{ - "title": "Chart Values", - "type": "object", - "properties": { - "provider": { - "description": "DNS provider name.", - "type": "string", - "enum": [ - "cloudflare", - "aws", - "azure", - "google", - "digitalocean", - "linode", - "ovh", - "exoscale", - "godaddy", - "inmemory" - ] - }, - "domainFilters": { - "description": "List of domains this external-dns instance can manage.", - "type": "array", - "default": [], - "items": { - "type": "string" - } - }, - "policy": { - "description": "How DNS records are synchronized.", - "type": "string", - "default": "upsert-only", - "enum": [ - "create-only", - "sync", - "upsert-only" - ] - }, - "extraArgs": { - "description": "Extra arguments for external-dns.", - "type": "array", - "default": [], - "items": { - "type": "string" - } - }, - "gatewayAPI": { - "description": "Enable Gateway API HTTPRoute as a source for DNS records.", - "type": "boolean", - "default": false - }, - "annotationPrefix": { - "description": "Custom annotation prefix for external-dns (useful for running multiple instances).", - "type": "string", - "default": "" - }, - "cloudflare": { - "description": "Cloudflare provider credentials.", - "type": "object", - "default": { - "apiEmail": "", - "apiKey": "", - "apiToken": "", - "proxied": false - }, - "x-kubernetes-preserve-unknown-fields": true - }, - "aws": { - "description": "AWS Route53 provider credentials.", - "type": "object", - "default": { - "accessKeyId": "", - "region": "", - "secretAccessKey": "", - "zoneType": "" - }, - "x-kubernetes-preserve-unknown-fields": true - }, - "azure": { - "description": "Azure DNS provider credentials.", - "type": "object", - "default": { - "aadClientId": "", - "aadClientSecret": "", - "resourceGroup": "", - "subscriptionId": "", - "tenantId": "" - }, - "x-kubernetes-preserve-unknown-fields": true - }, - "google": { - "description": "Google Cloud DNS provider credentials.", - "type": "object", - "default": { - "project": "", - "serviceAccountKey": "" - }, - "x-kubernetes-preserve-unknown-fields": true - }, - "digitalocean": { - "description": "DigitalOcean DNS provider credentials.", - "type": "object", - "default": { - "token": "" - }, - "x-kubernetes-preserve-unknown-fields": true - }, - "linode": { - "description": "Linode DNS provider credentials.", - "type": "object", - "default": { - "token": "" - }, - "x-kubernetes-preserve-unknown-fields": true - }, - "ovh": { - "description": "OVH DNS provider credentials.", - "type": "object", - "default": { - "applicationKey": "", - "applicationSecret": "", - "consumerKey": "", - "endpoint": "" - }, - "x-kubernetes-preserve-unknown-fields": true - }, - "exoscale": { - "description": "Exoscale DNS provider credentials.", - "type": "object", - "default": { - "apiKey": "", - "apiSecret": "" - }, - "x-kubernetes-preserve-unknown-fields": true - }, - "godaddy": { - "description": "GoDaddy DNS provider credentials.", - "type": "object", - "default": { - "apiKey": "", - "apiSecret": "" - }, - "x-kubernetes-preserve-unknown-fields": true - }, - "resources": { - "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "CPU available to each replica.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Memory (RAM) available to each replica.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "resourcesPreset": { - "description": "Default sizing preset used when `resources` is omitted.", - "type": "string", - "default": "nano", - "enum": [ - "nano", - "micro", - "small", - "medium", - "large", - "xlarge", - "2xlarge" - ] - } - } -} diff --git a/packages/extra/external-dns/values.yaml b/packages/extra/external-dns/values.yaml deleted file mode 100644 index c40d2dff..00000000 --- a/packages/extra/external-dns/values.yaml +++ /dev/null @@ -1,149 +0,0 @@ -## -## @section Common parameters -## - -## @enum {string} Provider - DNS provider. -## @value cloudflare -## @value aws -## @value azure -## @value google -## @value digitalocean -## @value linode -## @value ovh -## @value exoscale -## @value godaddy -## @value inmemory - -## @param {Provider} provider - DNS provider name. -# provider: - -## @param {[]string} domainFilters - List of domains this external-dns instance can manage. -domainFilters: [] - -## @enum {string} Policy - How DNS records are synchronized. -## @value create-only -## @value sync -## @value upsert-only - -## @param {Policy} policy="upsert-only" - How DNS records are synchronized. -policy: "upsert-only" - -## @param {[]string} extraArgs - Extra arguments for external-dns. -extraArgs: [] - -## @param {bool} gatewayAPI=false - Enable Gateway API HTTPRoute as a source for DNS records. -gatewayAPI: false - -## @param {string} [annotationPrefix] - Custom annotation prefix for external-dns (useful for running multiple instances). -annotationPrefix: "" - -## -## @section Cloudflare -## - -## @param {object} cloudflare - Cloudflare provider credentials. -cloudflare: - apiToken: "" - apiKey: "" - apiEmail: "" - proxied: false - -## -## @section AWS -## - -## @param {object} aws - AWS Route53 provider credentials. -aws: - accessKeyId: "" - secretAccessKey: "" - region: "" - zoneType: "" - -## -## @section Azure -## - -## @param {object} azure - Azure DNS provider credentials. -azure: - tenantId: "" - subscriptionId: "" - resourceGroup: "" - aadClientId: "" - aadClientSecret: "" - -## -## @section Google -## - -## @param {object} google - Google Cloud DNS provider credentials. -google: - project: "" - serviceAccountKey: "" - -## -## @section DigitalOcean -## - -## @param {object} digitalocean - DigitalOcean DNS provider credentials. -digitalocean: - token: "" - -## -## @section Linode -## - -## @param {object} linode - Linode DNS provider credentials. -linode: - token: "" - -## -## @section OVH -## - -## @param {object} ovh - OVH DNS provider credentials. -ovh: - endpoint: "" - applicationKey: "" - applicationSecret: "" - consumerKey: "" - -## -## @section Exoscale -## - -## @param {object} exoscale - Exoscale DNS provider credentials. -exoscale: - apiKey: "" - apiSecret: "" - -## -## @section GoDaddy -## - -## @param {object} godaddy - GoDaddy DNS provider credentials. -godaddy: - apiKey: "" - apiSecret: "" - -## -## @section Resources -## - -## @typedef {struct} Resources - Explicit CPU and memory configuration. -## @field {quantity} [cpu] - CPU available to each replica. -## @field {quantity} [memory] - Memory (RAM) available to each replica. - -## @enum {string} ResourcesPreset - Default sizing preset. -## @value nano -## @value micro -## @value small -## @value medium -## @value large -## @value xlarge -## @value 2xlarge - -## @param {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. -resources: {} - -## @param {ResourcesPreset} resourcesPreset="nano" - Default sizing preset used when `resources` is omitted. -resourcesPreset: "nano" diff --git a/packages/extra/ingress/Makefile b/packages/extra/ingress/Makefile index 65b53c03..958ce484 100644 --- a/packages/extra/ingress/Makefile +++ b/packages/extra/ingress/Makefile @@ -10,6 +10,3 @@ get-cloudflare-ips: generate: cozyvalues-gen -v values.yaml -s values.schema.json -r README.md ../../../hack/update-crd.sh - -test: - helm unittest . diff --git a/packages/extra/ingress/README.md b/packages/extra/ingress/README.md index c541d8e9..0e786dfb 100644 --- a/packages/extra/ingress/README.md +++ b/packages/extra/ingress/README.md @@ -14,17 +14,3 @@ | `resources.memory` | Memory (RAM) available to each replica. | `quantity` | `""` | | `resourcesPreset` | Default sizing preset used when `resources` is omitted. | `string` | `micro` | - -## Exposure mode - -The ingress Service type is driven by the cluster-wide `publishing.exposure` value in the platform chart, not by any key in this package. Two modes exist: - -- `externalIPs` (default) has three rendered shapes: - - Release namespace matches `publishing.ingressName` AND `publishing.externalIPs` is non-empty → Service is `ClusterIP` with `Service.spec.externalIPs` set from that list and `externalTrafficPolicy: Cluster`. - - Release namespace matches `publishing.ingressName` but `publishing.externalIPs` is empty → Service falls back to `type: LoadBalancer` with `externalTrafficPolicy: Local`. - - Release namespace does not match `publishing.ingressName` (non-root tenants) → Service is `type: LoadBalancer` with `externalTrafficPolicy: Local`. - `Service.spec.externalIPs` is deprecated upstream in Kubernetes v1.36 (KEP-5707); plan migration before v1.40. -- `loadBalancer` — Service is `type: LoadBalancer` with `externalTrafficPolicy: Local`, and a `CiliumLoadBalancerIPPool` makes the addresses in `publishing.externalIPs` allocatable via Cilium LB IPAM. Requires `publishing.externalIPs` to contain at least one non-empty address (render fails otherwise) and assumes the addresses are already routed to a cluster node (floating IP / upstream router). See the inline comment on `publishing.exposure` in the platform chart for full caveats, including the note that switching the value on a running cluster causes the ingress Service to be recreated. - -This setting only migrates ingress-nginx away from `Service.spec.externalIPs`. Other cozystack components that use the same deprecated field (e.g. the `vpn` app) must be migrated separately before Kubernetes v1.40 flips the `AllowServiceExternalIPs` feature gate off. - diff --git a/packages/extra/ingress/templates/nginx-ingress.yaml b/packages/extra/ingress/templates/nginx-ingress.yaml index 8e1f00fb..ca50d276 100644 --- a/packages/extra/ingress/templates/nginx-ingress.yaml +++ b/packages/extra/ingress/templates/nginx-ingress.yaml @@ -1,19 +1,5 @@ {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }} {{- $exposeExternalIPs := (index .Values._cluster "expose-external-ips") | default "" | nospace }} -{{- $exposeMode := (index .Values._cluster "expose-mode") | default "externalIPs" }} -{{- $exposeIPsList := list }} -{{- range splitList "," $exposeExternalIPs }} - {{- $ip := . | trim }} - {{- if $ip }} - {{- $exposeIPsList = append $exposeIPsList $ip }} - {{- end }} -{{- end }} -{{- if not (has $exposeMode (list "externalIPs" "loadBalancer")) }} -{{- fail (printf "unknown publishing.exposure mode %q: must be \"externalIPs\" or \"loadBalancer\"" $exposeMode) }} -{{- end }} -{{- if and (eq $exposeMode "loadBalancer") (eq $exposeIngress .Release.Namespace) (not $exposeIPsList) }} -{{- fail "publishing.exposure=loadBalancer requires publishing.externalIPs to contain at least one non-empty address: the CiliumLoadBalancerIPPool has nothing to advertise and the Service would stay in ." }} -{{- end }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -55,12 +41,9 @@ spec: enabled: false {{- end }} service: - {{- if and (eq $exposeIngress .Release.Namespace) (eq $exposeMode "loadBalancer") }} - type: LoadBalancer - externalTrafficPolicy: Local - {{- else if and (eq $exposeIngress .Release.Namespace) $exposeIPsList }} + {{- if and (eq $exposeIngress .Release.Namespace) $exposeExternalIPs }} externalIPs: - {{- toYaml $exposeIPsList | nindent 12 }} + {{- toYaml (splitList "," $exposeExternalIPs) | nindent 12 }} type: ClusterIP externalTrafficPolicy: Cluster {{- else }} diff --git a/packages/extra/ingress/tests/exposure_test.yaml b/packages/extra/ingress/tests/exposure_test.yaml deleted file mode 100644 index 1c76b3da..00000000 --- a/packages/extra/ingress/tests/exposure_test.yaml +++ /dev/null @@ -1,165 +0,0 @@ -suite: ingress exposure modes -templates: - - templates/nginx-ingress.yaml - -release: - name: ingress - namespace: tenant-root - -tests: - - it: default exposure (externalIPs) renders ClusterIP Service with spec.externalIPs - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: "192.0.2.10,192.0.2.11" - asserts: - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.type - value: ClusterIP - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy - value: Cluster - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.externalIPs - value: - - 192.0.2.10 - - 192.0.2.11 - - template: templates/nginx-ingress.yaml - notExists: - path: spec.values.ingress-nginx.controller.service.labels - - - it: legacy config without expose-mode falls back to externalIPs behavior - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: "192.0.2.10" - asserts: - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.type - value: ClusterIP - - - it: externalIPs mode in a namespace other than publishing.ingressName renders LoadBalancer fallback without externalIPs - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: "192.0.2.10" - release: - namespace: tenant-other - asserts: - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.type - value: LoadBalancer - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy - value: Local - - template: templates/nginx-ingress.yaml - notExists: - path: spec.values.ingress-nginx.controller.service.externalIPs - - - it: loadBalancer mode renders LoadBalancer Service without externalIPs on the Service - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: "192.0.2.10,192.0.2.11" - expose-mode: loadBalancer - asserts: - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.type - value: LoadBalancer - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy - value: Local - - template: templates/nginx-ingress.yaml - notExists: - path: spec.values.ingress-nginx.controller.service.labels - - template: templates/nginx-ingress.yaml - notExists: - path: spec.values.ingress-nginx.controller.service.externalIPs - - - it: loadBalancer mode without externalIPs fails chart render with explicit message - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: "" - expose-mode: loadBalancer - asserts: - - template: templates/nginx-ingress.yaml - failedTemplate: - errorMessage: "publishing.exposure=loadBalancer requires publishing.externalIPs to contain at least one non-empty address: the CiliumLoadBalancerIPPool has nothing to advertise and the Service would stay in ." - - - it: unknown exposure mode is rejected with a clear error (case-sensitive enum) - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: "192.0.2.10" - expose-mode: LoadBalancer - asserts: - - template: templates/nginx-ingress.yaml - failedTemplate: - errorMessage: "unknown publishing.exposure mode \"LoadBalancer\": must be \"externalIPs\" or \"loadBalancer\"" - - - it: another typo in exposure mode also fails - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: "192.0.2.10" - expose-mode: loadbalancer - asserts: - - template: templates/nginx-ingress.yaml - failedTemplate: - errorMessage: "unknown publishing.exposure mode \"loadbalancer\": must be \"externalIPs\" or \"loadBalancer\"" - - - it: loadBalancer mode in a namespace other than publishing.ingressName falls back to LoadBalancer Service without pool - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: "192.0.2.10" - expose-mode: loadBalancer - release: - namespace: tenant-other - asserts: - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.type - value: LoadBalancer - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy - value: Local - - template: templates/nginx-ingress.yaml - notExists: - path: spec.values.ingress-nginx.controller.service.labels - - template: templates/nginx-ingress.yaml - notExists: - path: spec.values.ingress-nginx.controller.service.externalIPs - - - it: loadBalancer mode with only-empty externalIPs fails chart render (comma-only input) - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: ",," - expose-mode: loadBalancer - asserts: - - template: templates/nginx-ingress.yaml - failedTemplate: - errorMessage: "publishing.exposure=loadBalancer requires publishing.externalIPs to contain at least one non-empty address: the CiliumLoadBalancerIPPool has nothing to advertise and the Service would stay in ." - - - it: externalIPs mode also filters out empty entries (trailing comma) - set: - _cluster: - expose-ingress: tenant-root - expose-external-ips: "192.0.2.10," - asserts: - - template: templates/nginx-ingress.yaml - equal: - path: spec.values.ingress-nginx.controller.service.externalIPs - value: - - 192.0.2.10 diff --git a/packages/extra/ingress/values.schema.json b/packages/extra/ingress/values.schema.json index 7a53a197..650a5824 100644 --- a/packages/extra/ingress/values.schema.json +++ b/packages/extra/ingress/values.schema.json @@ -2,24 +2,16 @@ "title": "Chart Values", "type": "object", "properties": { - "replicas": { - "description": "Number of ingress-nginx replicas.", - "type": "integer", - "default": 2 - }, - "whitelist": { - "description": "List of client networks.", - "type": "array", - "default": [], - "items": { - "type": "string" - } - }, "cloudflareProxy": { "description": "Restoring original visitor IPs when Cloudflare proxied is enabled.", "type": "boolean", "default": false }, + "replicas": { + "description": "Number of ingress-nginx replicas.", + "type": "integer", + "default": 2 + }, "resources": { "description": "Explicit CPU and memory configuration for each ingress-nginx replica. When omitted, the preset defined in `resourcesPreset` is applied.", "type": "object", @@ -66,6 +58,14 @@ "xlarge", "2xlarge" ] + }, + "whitelist": { + "description": "List of client networks.", + "type": "array", + "default": [], + "items": { + "type": "string" + } } } -} +} \ No newline at end of file diff --git a/packages/extra/monitoring/templates/dashboard-resourcemap.yaml b/packages/extra/monitoring/templates/dashboard-resourcemap.yaml index 5a5a3def..894a11d4 100644 --- a/packages/extra/monitoring/templates/dashboard-resourcemap.yaml +++ b/packages/extra/monitoring/templates/dashboard-resourcemap.yaml @@ -42,9 +42,7 @@ rules: - {{ .name }}-vminsert {{- end }} {{- range .Values.logsStorages }} - - {{ .name }}-vlstorage - - {{ .name }}-vlselect - - {{ .name }}-vlinsert + - {{ $.Release.Name }}-vlogs-{{ .name }} {{- end }} {{- range .Values.metricsStorages }} - vmalert-{{ .name }} diff --git a/packages/extra/monitoring/templates/workloadmonitors.yaml b/packages/extra/monitoring/templates/workloadmonitors.yaml index 5d803351..6dbfa8c1 100644 --- a/packages/extra/monitoring/templates/workloadmonitors.yaml +++ b/packages/extra/monitoring/templates/workloadmonitors.yaml @@ -67,46 +67,16 @@ spec: apiVersion: cozystack.io/v1alpha1 kind: WorkloadMonitor metadata: - name: {{ .name }}-vlstorage + name: vlogs-{{ .name }} spec: - replicas: 2 + replicas: 1 minReplicas: 1 kind: monitoring - type: vlstorage + type: vlogs selector: app.kubernetes.io/component: monitoring app.kubernetes.io/instance: {{ .name }} - app.kubernetes.io/name: vlstorage - version: {{ $.Chart.Version }} ---- -apiVersion: cozystack.io/v1alpha1 -kind: WorkloadMonitor -metadata: - name: {{ .name }}-vlselect -spec: - replicas: 2 - minReplicas: 1 - kind: monitoring - type: vlselect - selector: - app.kubernetes.io/component: monitoring - app.kubernetes.io/instance: {{ .name }} - app.kubernetes.io/name: vlselect - version: {{ $.Chart.Version }} ---- -apiVersion: cozystack.io/v1alpha1 -kind: WorkloadMonitor -metadata: - name: {{ .name }}-vlinsert -spec: - replicas: 2 - minReplicas: 1 - kind: monitoring - type: vlinsert - selector: - app.kubernetes.io/component: monitoring - app.kubernetes.io/instance: {{ .name }} - app.kubernetes.io/name: vlinsert + app.kubernetes.io/name: vlogs version: {{ $.Chart.Version }} {{- end }} --- diff --git a/packages/extra/monitoring/values.schema.json b/packages/extra/monitoring/values.schema.json index 4bc6906e..0a6f0e64 100644 --- a/packages/extra/monitoring/values.schema.json +++ b/packages/extra/monitoring/values.schema.json @@ -2,11 +2,302 @@ "title": "Chart Values", "type": "object", "properties": { + "alerta": { + "description": "Configuration for the Alerta service.", + "type": "object", + "default": {}, + "properties": { + "alerts": { + "description": "Alert routing configuration.", + "type": "object", + "default": {}, + "properties": { + "slack": { + "description": "Configuration for Slack alerts.", + "type": "object", + "default": {}, + "required": [ + "url" + ], + "properties": { + "disabledSeverity": { + "description": "List of severities without alerts (e.g. [\"informational\",\"warning\"]).", + "type": "array", + "default": [], + "items": { + "type": "string" + } + }, + "url": { + "description": "Configuration uri for Slack alerts.", + "type": "string", + "default": "" + } + } + }, + "telegram": { + "description": "Configuration for Telegram alerts.", + "type": "object", + "default": {}, + "required": [ + "chatID", + "token" + ], + "properties": { + "chatID": { + "description": "Telegram chat ID(s), separated by commas.", + "type": "string", + "default": "" + }, + "disabledSeverity": { + "description": "List of severities without alerts (e.g. [\"informational\",\"warning\"]).", + "type": "array", + "default": [], + "items": { + "type": "string" + } + }, + "token": { + "description": "Telegram bot token.", + "type": "string", + "default": "" + } + } + } + } + }, + "resources": { + "description": "Resource configuration.", + "type": "object", + "default": {}, + "properties": { + "limits": { + "description": "Resource limits.", + "type": "object", + "default": {}, + "properties": { + "cpu": { + "description": "CPU limit.", + "default": 1, + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "memory": { + "description": "Memory limit.", + "default": "1Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, + "requests": { + "description": "Resource requests.", + "type": "object", + "default": {}, + "properties": { + "cpu": { + "description": "CPU request.", + "default": "100m", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "memory": { + "description": "Memory request.", + "default": "256Mi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + } + } + }, + "storage": { + "description": "Persistent volume size for the database.", + "type": "string", + "default": "10Gi" + }, + "storageClassName": { + "description": "StorageClass used for the database.", + "type": "string", + "default": "" + } + } + }, + "grafana": { + "description": "Configuration for Grafana.", + "type": "object", + "default": {}, + "properties": { + "db": { + "description": "Database configuration.", + "type": "object", + "default": {}, + "properties": { + "size": { + "description": "Persistent volume size for the database.", + "type": "string", + "default": "10Gi" + } + } + }, + "resources": { + "description": "Resource configuration.", + "type": "object", + "default": {}, + "properties": { + "limits": { + "description": "Resource limits.", + "type": "object", + "default": {}, + "properties": { + "cpu": { + "description": "CPU limit.", + "default": 1, + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "memory": { + "description": "Memory limit.", + "default": "1Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, + "requests": { + "description": "Resource requests.", + "type": "object", + "default": {}, + "properties": { + "cpu": { + "description": "CPU request.", + "default": "100m", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "memory": { + "description": "Memory request.", + "default": "256Mi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + } + } + } + } + }, "host": { "description": "The hostname used to access Grafana externally (defaults to 'grafana' subdomain for the tenant host).", "type": "string", "default": "" }, + "logsStorages": { + "description": "Configuration of logs storage instances.", + "type": "array", + "default": [ + { + "name": "generic", + "retentionPeriod": "1", + "storage": "10Gi", + "storageClassName": "replicated" + } + ], + "items": { + "type": "object", + "required": [ + "name", + "retentionPeriod", + "storage", + "storageClassName" + ], + "properties": { + "name": { + "description": "Name of the storage instance.", + "type": "string" + }, + "retentionPeriod": { + "description": "Retention period for logs.", + "type": "string", + "default": "1" + }, + "storage": { + "description": "Persistent volume size.", + "type": "string", + "default": "10Gi" + }, + "storageClassName": { + "description": "StorageClass used to store the data.", + "type": "string", + "default": "replicated" + } + } + } + }, "metricsStorages": { "description": "Configuration of metrics storage instances.", "type": "array", @@ -281,297 +572,6 @@ } } }, - "logsStorages": { - "description": "Configuration of logs storage instances.", - "type": "array", - "default": [ - { - "name": "generic", - "retentionPeriod": "1", - "storage": "10Gi", - "storageClassName": "replicated" - } - ], - "items": { - "type": "object", - "required": [ - "name", - "retentionPeriod", - "storage", - "storageClassName" - ], - "properties": { - "name": { - "description": "Name of the storage instance.", - "type": "string" - }, - "retentionPeriod": { - "description": "Retention period for logs.", - "type": "string", - "default": "1" - }, - "storage": { - "description": "Persistent volume size.", - "type": "string", - "default": "10Gi" - }, - "storageClassName": { - "description": "StorageClass used to store the data.", - "type": "string", - "default": "replicated" - } - } - } - }, - "alerta": { - "description": "Configuration for the Alerta service.", - "type": "object", - "default": {}, - "properties": { - "alerts": { - "description": "Alert routing configuration.", - "type": "object", - "default": {}, - "properties": { - "slack": { - "description": "Configuration for Slack alerts.", - "type": "object", - "default": {}, - "required": [ - "url" - ], - "properties": { - "disabledSeverity": { - "description": "List of severities without alerts (e.g. [\"informational\",\"warning\"]).", - "type": "array", - "default": [], - "items": { - "type": "string" - } - }, - "url": { - "description": "Configuration uri for Slack alerts.", - "type": "string", - "default": "" - } - } - }, - "telegram": { - "description": "Configuration for Telegram alerts.", - "type": "object", - "default": {}, - "required": [ - "chatID", - "token" - ], - "properties": { - "chatID": { - "description": "Telegram chat ID(s), separated by commas.", - "type": "string", - "default": "" - }, - "disabledSeverity": { - "description": "List of severities without alerts (e.g. [\"informational\",\"warning\"]).", - "type": "array", - "default": [], - "items": { - "type": "string" - } - }, - "token": { - "description": "Telegram bot token.", - "type": "string", - "default": "" - } - } - } - } - }, - "resources": { - "description": "Resource configuration.", - "type": "object", - "default": {}, - "properties": { - "limits": { - "description": "Resource limits.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "CPU limit.", - "default": 1, - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Memory limit.", - "default": "1Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "requests": { - "description": "Resource requests.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "CPU request.", - "default": "100m", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Memory request.", - "default": "256Mi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - } - } - }, - "storage": { - "description": "Persistent volume size for the database.", - "type": "string", - "default": "10Gi" - }, - "storageClassName": { - "description": "StorageClass used for the database.", - "type": "string", - "default": "" - } - } - }, - "grafana": { - "description": "Configuration for Grafana.", - "type": "object", - "default": {}, - "properties": { - "db": { - "description": "Database configuration.", - "type": "object", - "default": {}, - "properties": { - "size": { - "description": "Persistent volume size for the database.", - "type": "string", - "default": "10Gi" - } - } - }, - "resources": { - "description": "Resource configuration.", - "type": "object", - "default": {}, - "properties": { - "limits": { - "description": "Resource limits.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "CPU limit.", - "default": 1, - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Memory limit.", - "default": "1Gi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "requests": { - "description": "Resource requests.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "CPU request.", - "default": "100m", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Memory request.", - "default": "256Mi", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - } - } - } - } - }, "vmagent": { "description": "Configuration for VictoriaMetrics Agent.", "type": "object", @@ -579,14 +579,12 @@ "properties": { "externalLabels": { "description": "External labels applied to all metrics.", - "type": "object", "default": { "cluster": "cozystack" } }, "remoteWrite": { "description": "Remote write configuration.", - "type": "object", "default": { "urls": [ "http://vminsert-shortterm:8480/insert/0/prometheus", @@ -597,4 +595,4 @@ } } } -} +} \ No newline at end of file diff --git a/packages/extra/monitoring/values.yaml b/packages/extra/monitoring/values.yaml index c521f389..ab32b1b2 100644 --- a/packages/extra/monitoring/values.yaml +++ b/packages/extra/monitoring/values.yaml @@ -178,7 +178,3 @@ vmagent: urls: - http://vminsert-shortterm:8480/insert/0/prometheus - http://vminsert-longterm:8480/insert/0/prometheus - ## inlineScrapeConfig: | - ## - job_name: "custom" - ## static_configs: - ## - targets: ["my-service:9090"] diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag index 9b413da5..0628d78b 100644 --- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag +++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag @@ -1 +1 @@ -ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.3.0@sha256:5bcccbdb13979a16cee535eb5fbcdf0d87973689010a10b7b25e55c5be3edaa6 +ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.1.7@sha256:fd3571e746efbc65fab342ca557beb2d0ad46fc0183772605fe84c6d3dd446a4 diff --git a/packages/extra/seaweedfs/values.schema.json b/packages/extra/seaweedfs/values.schema.json index 9b48043d..b80a2b33 100644 --- a/packages/extra/seaweedfs/values.schema.json +++ b/packages/extra/seaweedfs/values.schema.json @@ -2,26 +2,6 @@ "title": "Chart Values", "type": "object", "properties": { - "host": { - "description": "The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).", - "type": "string", - "default": "" - }, - "topology": { - "description": "The topology of the SeaweedFS cluster.", - "type": "string", - "default": "Simple", - "enum": [ - "Simple", - "MultiZone", - "Client" - ] - }, - "replicationFactor": { - "description": "Replication factor: number of replicas for each volume in the SeaweedFS cluster.", - "type": "integer", - "default": 2 - }, "db": { "description": "Database configuration.", "type": "object", @@ -100,65 +80,6 @@ } } }, - "master": { - "description": "Master service configuration.", - "type": "object", - "default": {}, - "properties": { - "replicas": { - "description": "Number of master replicas.", - "type": "integer", - "default": 3 - }, - "resources": { - "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "Number of CPU cores allocated.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Amount of memory allocated.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "resourcesPreset": { - "description": "Default sizing preset used when `resources` is omitted.", - "type": "string", - "default": "small", - "enum": [ - "nano", - "micro", - "small", - "medium", - "large", - "xlarge", - "2xlarge" - ] - } - } - }, "filer": { "description": "Filer service configuration.", "type": "object", @@ -236,6 +157,144 @@ } } }, + "host": { + "description": "The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).", + "type": "string", + "default": "" + }, + "master": { + "description": "Master service configuration.", + "type": "object", + "default": {}, + "properties": { + "replicas": { + "description": "Number of master replicas.", + "type": "integer", + "default": 3 + }, + "resources": { + "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.", + "type": "object", + "default": {}, + "properties": { + "cpu": { + "description": "Number of CPU cores allocated.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "memory": { + "description": "Amount of memory allocated.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, + "resourcesPreset": { + "description": "Default sizing preset used when `resources` is omitted.", + "type": "string", + "default": "small", + "enum": [ + "nano", + "micro", + "small", + "medium", + "large", + "xlarge", + "2xlarge" + ] + } + } + }, + "replicationFactor": { + "description": "Replication factor: number of replicas for each volume in the SeaweedFS cluster.", + "type": "integer", + "default": 2 + }, + "s3": { + "description": "S3 service configuration.", + "type": "object", + "default": {}, + "properties": { + "replicas": { + "description": "Number of S3 replicas.", + "type": "integer", + "default": 2 + }, + "resources": { + "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.", + "type": "object", + "default": {}, + "properties": { + "cpu": { + "description": "Number of CPU cores allocated.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "memory": { + "description": "Amount of memory allocated.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + } + } + }, + "resourcesPreset": { + "description": "Default sizing preset used when `resources` is omitted.", + "type": "string", + "default": "small", + "enum": [ + "nano", + "micro", + "small", + "medium", + "large", + "xlarge", + "2xlarge" + ] + } + } + }, + "topology": { + "description": "The topology of the SeaweedFS cluster.", + "type": "string", + "default": "Simple", + "enum": [ + "Simple", + "MultiZone", + "Client" + ] + }, "volume": { "description": "Volume service configuration.", "type": "object", @@ -522,65 +581,6 @@ } } } - }, - "s3": { - "description": "S3 service configuration.", - "type": "object", - "default": {}, - "properties": { - "replicas": { - "description": "Number of S3 replicas.", - "type": "integer", - "default": 2 - }, - "resources": { - "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.", - "type": "object", - "default": {}, - "properties": { - "cpu": { - "description": "Number of CPU cores allocated.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - }, - "memory": { - "description": "Amount of memory allocated.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "x-kubernetes-int-or-string": true - } - } - }, - "resourcesPreset": { - "description": "Default sizing preset used when `resources` is omitted.", - "type": "string", - "default": "small", - "enum": [ - "nano", - "micro", - "small", - "medium", - "large", - "xlarge", - "2xlarge" - ] - } - } } } -} +} \ No newline at end of file diff --git a/packages/library/cozy-lib/templates/_strings.tpl b/packages/library/cozy-lib/templates/_strings.tpl deleted file mode 100644 index 0ba8153f..00000000 --- a/packages/library/cozy-lib/templates/_strings.tpl +++ /dev/null @@ -1,3 +0,0 @@ -{{- define "cozy-lib.strings.hexToInt" }} -{{- printf "num: 0x%s" . | fromYaml | dig "num" 0 }} -{{- end }} diff --git a/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml b/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml index d48df533..6d55cb84 100644 --- a/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml +++ b/packages/system/backup-controller/definitions/backups.cozystack.io_backups.yaml @@ -205,14 +205,6 @@ spec: Phase is a simple, high-level summary of the backup's state. Typical values are: Pending, Ready, Failed. type: string - underlyingResources: - description: |- - UnderlyingResources holds application-specific resource metadata discovered - during backup (e.g., VM disks, network configuration). The payload is a - self-typed JSON object carrying an inlined TypeMeta (kind/apiVersion) so - the consuming controller can dispatch on the application kind. - type: object - x-kubernetes-preserve-unknown-fields: true type: object type: object selectableFields: diff --git a/packages/system/backup-controller/definitions/backups.cozystack.io_restorejobs.yaml b/packages/system/backup-controller/definitions/backups.cozystack.io_restorejobs.yaml index b9465994..400737fc 100644 --- a/packages/system/backup-controller/definitions/backups.cozystack.io_restorejobs.yaml +++ b/packages/system/backup-controller/definitions/backups.cozystack.io_restorejobs.yaml @@ -59,12 +59,6 @@ spec: type: string type: object x-kubernetes-map-type: atomic - options: - description: |- - Options is a driver-specific blob of restore options, typed based on - targetApplicationRef and the current controller implementation. - type: object - x-kubernetes-preserve-unknown-fields: true targetApplicationRef: description: |- TargetApplicationRef refers to the application into which the backup diff --git a/packages/system/backup-controller/templates/rbac.yaml b/packages/system/backup-controller/templates/rbac.yaml index da2460c0..37ab7243 100644 --- a/packages/system/backup-controller/templates/rbac.yaml +++ b/packages/system/backup-controller/templates/rbac.yaml @@ -14,10 +14,3 @@ rules: - apiGroups: ["backups.cozystack.io"] resources: ["backupjobs"] verbs: ["create", "get", "list", "watch"] -# Leader election (--leader-elect) -- apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "watch", "create", "update", "patch"] -- apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml index 34e033ce..cc203a25 100644 --- a/packages/system/backup-controller/values.yaml +++ b/packages/system/backup-controller/values.yaml @@ -1,5 +1,5 @@ backupController: - image: "ghcr.io/cozystack/cozystack/backup-controller:v1.3.0@sha256:e1a083dc92f26dfef004f47c1cd20a6357174aad835004f58e751c494b76649a" + image: "ghcr.io/cozystack/cozystack/backup-controller:v1.1.7@sha256:ee54ad2007f7f103ba3d01ba95fa62e28419e96ba14cc8f96c7283bdac886f18" replicas: 2 debug: false metrics: diff --git a/packages/system/backupstrategy-controller/templates/rbac.yaml b/packages/system/backupstrategy-controller/templates/rbac.yaml index 634ea88b..b69a2744 100644 --- a/packages/system/backupstrategy-controller/templates/rbac.yaml +++ b/packages/system/backupstrategy-controller/templates/rbac.yaml @@ -11,71 +11,25 @@ rules: - apiGroups: ["backups.cozystack.io"] resources: ["backupclasses"] verbs: ["get", "list", "watch"] -# BackupJob / RestoreJob: reconcile; update for RestoreJob finalizers +# BackupJob / RestoreJob: reconcile and update status - apiGroups: ["backups.cozystack.io"] resources: ["backupjobs", "restorejobs"] - verbs: ["get", "list", "watch", "update", "patch"] + verbs: ["get", "list", "watch"] - apiGroups: ["backups.cozystack.io"] resources: ["backupjobs/status", "restorejobs/status"] verbs: ["get", "update", "patch"] -# Backup: create after Velero job completes; update/patch for BackupReconciler finalizers +# Backup: create after Velero backup completes - apiGroups: ["backups.cozystack.io"] resources: ["backups"] - verbs: ["create", "get", "list", "watch", "update", "patch"] -# Pods: BackupJob lists virt-launcher pods by label (manager cache uses cluster-scoped list/watch) -- apiGroups: [""] - resources: ["pods"] - verbs: ["get", "list", "watch"] -# ConfigMaps: controller-runtime cache requires cluster-scoped list/watch; -# create/update/delete is scoped to cozy-velero via a Role shipped by the -# velero chart (packages/system/velero/templates/backupstrategy-controller-rbac.yaml) -# so it is only created when velero is installed. -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "list", "watch"] -# Application refs (e.g. VMInstance) for backup/restore scope + verbs: ["create", "get", "list", "watch"] +# Application refs (e.g. VMInstance, VirtualMachine) for backup/restore scope - apiGroups: ["apps.cozystack.io"] resources: ["*"] verbs: ["get", "list", "watch"] -# KubeVirt: pre-restore halts VMs and checks VMI shutdown -- apiGroups: ["kubevirt.io"] - resources: ["virtualmachines"] - verbs: ["get", "update"] -- apiGroups: ["kubevirt.io"] - resources: ["virtualmachineinstances"] - verbs: ["get"] -# CDI DataVolumes: pre-restore deletes DVs so CDI doesn't recreate PVCs after rename -- apiGroups: ["cdi.kubevirt.io"] - resources: ["datavolumes"] - verbs: ["delete"] -# HelmReleases: pre-restore suspends HRs; post-restore rename creates new HR and deletes old -- apiGroups: ["helm.toolkit.fluxcd.io"] - resources: ["helmreleases"] - verbs: ["get", "create", "update", "delete"] -# PVCs and PVs: pre-restore renames PVCs (delete old, create new) and patches PV reclaim policy -- apiGroups: [""] - resources: ["persistentvolumeclaims"] - verbs: ["get", "list", "watch", "create", "delete"] -- apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "update"] -# Velero Backup/Restore/DataUpload in cozy-velero namespace (DataUpload: enrich BackupJob failure messages) +# Velero Backup/Restore in cozy-velero namespace - apiGroups: ["velero.io"] - resources: ["backups", "restores", "datauploads"] - verbs: ["create", "get", "list", "watch", "update", "patch", "delete", "deletecollection"] -# Velero DeleteBackupRequest: used by BackupReconciler to delete Velero backups with their storage data -- apiGroups: ["velero.io"] - resources: ["deletebackuprequests"] - verbs: ["create", "get", "list", "watch"] -# Namespaces: validate target namespace exists for cross-namespace restore -# controller-runtime cache requires list/watch for any resource accessed via r.Get() -- apiGroups: [""] - resources: ["namespaces"] - verbs: ["get", "list", "watch"] -# Events from Recorder.Event() calls -- apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] + resources: ["backups", "restores"] + verbs: ["create", "get", "list", "watch", "update", "patch"] # Leader election (--leader-elect) - apiGroups: ["coordination.k8s.io"] resources: ["leases"] diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml index d6453124..ce4ba753 100644 --- a/packages/system/backupstrategy-controller/values.yaml +++ b/packages/system/backupstrategy-controller/values.yaml @@ -1,5 +1,5 @@ backupStrategyController: - image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.3.0@sha256:be0a9ec1f4307064b16388a24628aee46e06252738338add80b99ea1e04e62bf" + image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.1.7@sha256:3dcdbf368a33c85961fe1b692c0bfe5280c8c3c64bb8235c89d5efc1ea33c2d9" replicas: 2 debug: false metrics: diff --git a/packages/system/bootbox-rd/cozyrds/bootbox.yaml b/packages/system/bootbox-rd/cozyrds/bootbox.yaml index 667740e3..62e87931 100644 --- a/packages/system/bootbox-rd/cozyrds/bootbox.yaml +++ b/packages/system/bootbox-rd/cozyrds/bootbox.yaml @@ -8,7 +8,7 @@ spec: plural: bootboxes singular: bootbox openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"whitelistHTTP":{"description":"Secure HTTP by enabling client networks whitelisting.","type":"boolean","default":true},"whitelist":{"description":"List of client networks.","type":"array","default":[],"items":{"type":"string"}},"machines":{"description":"Configuration of physical machine instances.","type":"array","default":[],"items":{"type":"object","required":["arch","hostname","ip","leaseTime","uefi"],"properties":{"arch":{"description":"Architecture.","type":"string"},"hostname":{"description":"Hostname.","type":"string"},"ip":{"description":"IP address configuration.","type":"object","required":["address","gateway","netmask"],"properties":{"address":{"description":"IP address.","type":"string"},"gateway":{"description":"IP gateway.","type":"string"},"netmask":{"description":"Netmask.","type":"string"}}},"leaseTime":{"description":"Lease time.","type":"integer"},"mac":{"description":"MAC addresses.","type":"array","items":{"type":"string"}},"nameServers":{"description":"Name servers.","type":"array","items":{"type":"string"}},"timeServers":{"description":"Time servers.","type":"array","items":{"type":"string"}},"uefi":{"description":"UEFI.","type":"boolean"}}}}}} + {"title":"Chart Values","type":"object","properties":{"machines":{"description":"Configuration of physical machine instances.","type":"array","default":[],"items":{"type":"object","required":["arch","hostname","ip","leaseTime","uefi"],"properties":{"arch":{"description":"Architecture.","type":"string"},"hostname":{"description":"Hostname.","type":"string"},"ip":{"description":"IP address configuration.","type":"object","required":["address","gateway","netmask"],"properties":{"address":{"description":"IP address.","type":"string"},"gateway":{"description":"IP gateway.","type":"string"},"netmask":{"description":"Netmask.","type":"string"}}},"leaseTime":{"description":"Lease time.","type":"integer"},"mac":{"description":"MAC addresses.","type":"array","items":{"type":"string"}},"nameServers":{"description":"Name servers.","type":"array","items":{"type":"string"}},"timeServers":{"description":"Time servers.","type":"array","items":{"type":"string"}},"uefi":{"description":"UEFI.","type":"boolean"}}}},"whitelist":{"description":"List of client networks.","type":"array","default":[],"items":{"type":"string"}},"whitelistHTTP":{"description":"Secure HTTP by enabling client networks whitelisting.","type":"boolean","default":true}}} release: prefix: "" labels: diff --git a/packages/system/bucket/images/s3manager.tag b/packages/system/bucket/images/s3manager.tag index 889db0af..6d86e4ca 100644 --- a/packages/system/bucket/images/s3manager.tag +++ b/packages/system/bucket/images/s3manager.tag @@ -1 +1 @@ -ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:fb65e734bbdbdaef2238769cc2ecfb54dbddaf1e0952ad438a9b3e26b9dbb4b5 +ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:c785518051e005de3e2a8393949b7a0040bd9bca9c0aea556ee3f401cc93e631 diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile index 71b47a77..267c75cc 100644 --- a/packages/system/cilium/Makefile +++ b/packages/system/cilium/Makefile @@ -10,17 +10,8 @@ update: rm -rf charts helm repo add cilium https://helm.cilium.io/ helm repo update cilium - helm pull cilium/cilium --untar --untardir charts --version 1.19 + helm pull cilium/cilium --untar --untardir charts --version 1.18 $(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml - # Drop the whole k8s<1.30 AppArmor annotations block from the cilium-agent - # DaemonSet. Cozystack manages these annotations through cilium.podAnnotations - # in values.yaml on every k8s version, so keeping the upstream block would - # produce duplicate mapping keys on k8s<1.30. - perl -i -0pe 's|\n \{\{- if not \.Values\.securityContext\.privileged \}\}\n \{\{- if semverCompare "<1\.30\.0".*?\n \{\{- end \}\}\n \{\{- end \}\}\n \{\{- end \}\}||s' \ - charts/cilium/templates/cilium-agent/daemonset.yaml - @! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io' \ - charts/cilium/templates/cilium-agent/daemonset.yaml || \ - { echo 'ERROR: perl patch did not remove the upstream AppArmor block from cilium-agent/daemonset.yaml (upstream template format may have changed)' >&2; exit 1; } version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \ $(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile diff --git a/packages/system/cilium/charts/cilium/Chart.yaml b/packages/system/cilium/charts/cilium/Chart.yaml index 5fe2baed..0de0d9c7 100644 --- a/packages/system/cilium/charts/cilium/Chart.yaml +++ b/packages/system/cilium/charts/cilium/Chart.yaml @@ -41,8 +41,11 @@ annotations: namespace context.\n- kind: CiliumNodeConfig\n version: v2\n name: ciliumnodeconfigs.cilium.io\n \ displayName: Cilium Node Configuration\n description: |\n CiliumNodeConfig is a list of configuration key-value pairs. It is applied to\n nodes indicated - by a label selector.\n- kind: CiliumBGPClusterConfig\n version: v2alpha1\n name: - ciliumbgpclusterconfigs.cilium.io\n displayName: Cilium BGP Cluster Config\n + by a label selector.\n- kind: CiliumBGPPeeringPolicy\n version: v2alpha1\n name: + ciliumbgppeeringpolicies.cilium.io\n displayName: Cilium BGP Peering Policy\n + \ description: |\n Cilium BGP Peering Policy instructs Cilium to create specific + BGP peering\n configurations.\n- kind: CiliumBGPClusterConfig\n version: v2alpha1\n + \ name: ciliumbgpclusterconfigs.cilium.io\n displayName: Cilium BGP Cluster Config\n \ description: |\n Cilium BGP Cluster Config instructs Cilium operator to create specific BGP cluster\n configurations.\n- kind: CiliumBGPPeerConfig\n version: v2alpha1\n name: ciliumbgppeerconfigs.cilium.io\n displayName: Cilium BGP Peer @@ -76,7 +79,7 @@ annotations: Cilium Gateway Class Config\n description: |\n CiliumGatewayClassConfig defines a configuration for Gateway API GatewayClass.\n" apiVersion: v2 -appVersion: 1.19.3 +appVersion: 1.18.6 description: eBPF-based Networking, Security, and Observability home: https://cilium.io/ icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg @@ -92,4 +95,4 @@ kubeVersion: '>= 1.21.0-0' name: cilium sources: - https://github.com/cilium/cilium -version: 1.19.3 +version: 1.18.6 diff --git a/packages/system/cilium/charts/cilium/README.md b/packages/system/cilium/charts/cilium/README.md index d7697c56..840d0126 100644 --- a/packages/system/cilium/charts/cilium/README.md +++ b/packages/system/cilium/charts/cilium/README.md @@ -1,6 +1,6 @@ # cilium -![Version: 1.19.3](https://img.shields.io/badge/Version-1.19.3-informational?style=flat-square) ![AppVersion: 1.19.3](https://img.shields.io/badge/AppVersion-1.19.3-informational?style=flat-square) +![Version: 1.18.6](https://img.shields.io/badge/Version-1.18.6-informational?style=flat-square) ![AppVersion: 1.18.6](https://img.shields.io/badge/AppVersion-1.18.6-informational?style=flat-square) Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as @@ -59,14 +59,10 @@ contributors across the globe, there is almost always someone available to help. | agentNotReadyTaintKey | string | `"node.cilium.io/agent-not-ready"` | Configure the key of the taint indicating that Cilium is not ready on the node. When set to a value starting with `ignore-taint.cluster-autoscaler.kubernetes.io/`, the Cluster Autoscaler will ignore the taint on its decisions, allowing the cluster to scale up. | | aksbyocni.enabled | bool | `false` | Enable AKS BYOCNI integration. Note that this is incompatible with AKS clusters not created in BYOCNI mode: use Azure integration (`azure.enabled`) instead. | | alibabacloud.enabled | bool | `false` | Enable AlibabaCloud ENI integration | -| alibabacloud.nodeSpec.securityGroupTags | list | `[]` | | -| alibabacloud.nodeSpec.securityGroups | list | `[]` | | -| alibabacloud.nodeSpec.vSwitchTags | list | `[]` | | -| alibabacloud.nodeSpec.vSwitches | list | `[]` | | | annotateK8sNode | bool | `false` | Annotate k8s node upon initialization with Cilium's metadata. | | annotations | object | `{}` | Annotations to be added to all top-level cilium-agent objects (resources under templates/cilium-agent) | | apiRateLimit | string | `nil` | The api-rate-limit option can be used to overwrite individual settings of the default configuration for rate limiting calls to the Cilium Agent API | -| authentication.enabled | bool | `false` | Enable authentication processing and garbage collection. Note that if disabled, policy enforcement will still block requests that require authentication. But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed. | +| authentication.enabled | bool | `true` | Enable authentication processing and garbage collection. Note that if disabled, policy enforcement will still block requests that require authentication. But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed. | | authentication.gcInterval | string | `"5m0s"` | Interval for garbage collection of auth map entries. | | authentication.mutual.connectTimeout | string | `"5s"` | Timeout for connecting to the remote node TCP socket | | authentication.mutual.port | int | `4250` | Port on the agent where mutual authentication handshakes between agents will be performed | @@ -77,7 +73,7 @@ contributors across the globe, there is almost always someone available to help. | authentication.mutual.spire.enabled | bool | `false` | Enable SPIRE integration (beta) | | authentication.mutual.spire.install.agent.affinity | object | `{}` | SPIRE agent affinity configuration | | authentication.mutual.spire.install.agent.annotations | object | `{}` | SPIRE agent annotations | -| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:5106ac601272a88684db14daf7f54b9a45f31f77bb16a906bd5e87756ee7b97c","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-agent","tag":"1.9.6","useDigest":true}` | SPIRE agent image | +| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:163970884fba18860cac93655dc32b6af85a5dcf2ebb7e3e119a10888eff8fcd","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-agent","tag":"1.12.4","useDigest":true}` | SPIRE agent image | | authentication.mutual.spire.install.agent.labels | object | `{}` | SPIRE agent labels | | authentication.mutual.spire.install.agent.nodeSelector | object | `{}` | SPIRE agent nodeSelector configuration ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | | authentication.mutual.spire.install.agent.podSecurityContext | object | `{}` | Security context to be added to spire agent pods. SecurityContext holds pod-level security attributes and common container settings. ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod | @@ -89,7 +85,7 @@ contributors across the globe, there is almost always someone available to help. | authentication.mutual.spire.install.agent.tolerations | list | `[{"effect":"NoSchedule","key":"node.kubernetes.io/not-ready"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/control-plane"},{"effect":"NoSchedule","key":"node.cloudprovider.kubernetes.io/uninitialized","value":"true"},{"key":"CriticalAddonsOnly","operator":"Exists"}]` | SPIRE agent tolerations configuration By default it follows the same tolerations as the agent itself to allow the Cilium agent on this node to connect to SPIRE. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | | authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true | | authentication.mutual.spire.install.existingNamespace | bool | `false` | SPIRE namespace already exists. Set to true if Helm should not create, manage, and import the SPIRE namespace. | -| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server | +| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:2383baad1860bbe9d8a7a843775048fd07d8afe292b94bd876df64a69aae7cb1","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server | | authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into | | authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration | | authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations | @@ -99,7 +95,7 @@ contributors across the globe, there is almost always someone available to help. | authentication.mutual.spire.install.server.dataStorage.enabled | bool | `true` | Enable SPIRE server data storage | | authentication.mutual.spire.install.server.dataStorage.size | string | `"1Gi"` | Size of the SPIRE server data storage | | authentication.mutual.spire.install.server.dataStorage.storageClass | string | `nil` | StorageClass of the SPIRE server data storage | -| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:59a0b92b39773515e25e68a46c40d3b931b9c1860bc445a79ceb45a805cab8b4","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-server","tag":"1.9.6","useDigest":true}` | SPIRE server image | +| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:34147f27066ab2be5cc10ca1d4bfd361144196467155d46c45f3519f41596e49","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-server","tag":"1.12.4","useDigest":true}` | SPIRE server image | | authentication.mutual.spire.install.server.initContainers | list | `[]` | SPIRE server init containers | | authentication.mutual.spire.install.server.labels | object | `{}` | SPIRE server labels | | authentication.mutual.spire.install.server.nodeSelector | object | `{}` | SPIRE server nodeSelector configuration ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | @@ -118,14 +114,13 @@ contributors across the globe, there is almost always someone available to help. | authentication.rotatedIdentitiesQueueSize | int | `1024` | Buffer size of the channel Cilium uses to receive certificate expiration events from auth handlers. | | autoDirectNodeRoutes | bool | `false` | Enable installation of PodCIDR routes between worker nodes if worker nodes share a common L2 network segment. | | azure.enabled | bool | `false` | Enable Azure integration. Note that this is incompatible with AKS clusters created in BYOCNI mode: use AKS BYOCNI integration (`aksbyocni.enabled`) instead. | -| azure.nodeSpec.azureInterfaceName | string | `""` | | | bandwidthManager | object | `{"bbr":false,"bbrHostNamespaceOnly":false,"enabled":false}` | Enable bandwidth manager to optimize TCP and UDP workloads and allow for rate-limiting traffic from individual Pods with EDT (Earliest Departure Time) through the "kubernetes.io/egress-bandwidth" Pod annotation. | | bandwidthManager.bbr | bool | `false` | Activate BBR TCP congestion control for Pods | | bandwidthManager.bbrHostNamespaceOnly | bool | `false` | Activate BBR TCP congestion control for Pods in the host namespace only. | | bandwidthManager.enabled | bool | `false` | Enable bandwidth manager infrastructure (also prerequirement for BBR) | -| bgpControlPlane | object | `{"enabled":false,"legacyOriginAttribute":{"enabled":false},"routerIDAllocation":{"ipPool":"","mode":"default"},"secretsNamespace":{"create":false,"name":"kube-system"},"statusReport":{"enabled":true}}` | This feature set enables virtual BGP routers to be created via BGP CRDs. | +| bgpControlPlane | object | `{"enabled":false,"legacyOriginAttribute":{"enabled":false},"routerIDAllocation":{"ipPool":"","mode":"default"},"secretsNamespace":{"create":false,"name":"kube-system"},"statusReport":{"enabled":true}}` | This feature set enables virtual BGP routers to be created via CiliumBGPPeeringPolicy CRDs. | | bgpControlPlane.enabled | bool | `false` | Enables the BGP control plane. | -| bgpControlPlane.legacyOriginAttribute | object | `{"enabled":false}` | Legacy BGP ORIGIN attribute settings | +| bgpControlPlane.legacyOriginAttribute | object | `{"enabled":false}` | Legacy BGP ORIGIN attribute settings (BGPv2 only) | | bgpControlPlane.legacyOriginAttribute.enabled | bool | `false` | Enable/Disable advertising LoadBalancerIP routes with the legacy BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0). Enable for compatibility with the legacy behavior of MetalLB integration. | | bgpControlPlane.routerIDAllocation | object | `{"ipPool":"","mode":"default"}` | BGP router-id allocation mode | | bgpControlPlane.routerIDAllocation.ipPool | string | `""` | IP pool to allocate the BGP router-id from when the mode is ip-pool. | @@ -133,20 +128,20 @@ contributors across the globe, there is almost always someone available to help. | bgpControlPlane.secretsNamespace | object | `{"create":false,"name":"kube-system"}` | SecretsNamespace is the namespace which BGP support will retrieve secrets from. | | bgpControlPlane.secretsNamespace.create | bool | `false` | Create secrets namespace for BGP secrets. | | bgpControlPlane.secretsNamespace.name | string | `"kube-system"` | The name of the secret namespace to which Cilium agents are given read access | -| bgpControlPlane.statusReport | object | `{"enabled":true}` | Status reporting settings | -| bgpControlPlane.statusReport.enabled | bool | `true` | Enable/Disable BGP status reporting It is recommended to enable status reporting in general, but if you have any issue such as high API server load, you can disable it by setting this to false. | +| bgpControlPlane.statusReport | object | `{"enabled":true}` | Status reporting settings (BGPv2 only) | +| bgpControlPlane.statusReport.enabled | bool | `true` | Enable/Disable BGPv2 status reporting It is recommended to enable status reporting in general, but if you have any issue such as high API server load, you can disable it by setting this to false. | | bpf.authMapMax | int | `524288` | Configure the maximum number of entries in auth map. | | bpf.autoMount.enabled | bool | `true` | Enable automatic mount of BPF filesystem When `autoMount` is enabled, the BPF filesystem is mounted at `bpf.root` path on the underlying host and inside the cilium agent pod. If users disable `autoMount`, it's expected that users have mounted bpffs filesystem at the specified `bpf.root` volume, and then the volume will be mounted inside the cilium agent pod at the same path. | | bpf.ctAccounting | bool | `false` | Enable CT accounting for packets and bytes | | bpf.ctAnyMax | int | `262144` | Configure the maximum number of entries for the non-TCP connection tracking table. | | bpf.ctTcpMax | int | `524288` | Configure the maximum number of entries in the TCP connection tracking table. | -| bpf.datapathMode | string | `veth` | Mode for Pod devices for the core datapath (veth, netkit, netkit-l2). Note netkit is incompatible with TPROXY (`bpf.tproxy`). | +| bpf.datapathMode | string | `veth` | Mode for Pod devices for the core datapath (veth, netkit, netkit-l2) | | bpf.disableExternalIPMitigation | bool | `false` | Disable ExternalIP mitigation (CVE-2020-8554) | | bpf.distributedLRU | object | `{"enabled":false}` | Control to use a distributed per-CPU backend memory for the core BPF LRU maps which Cilium uses. This improves performance significantly, but it is also recommended to increase BPF map sizing along with that. | | bpf.distributedLRU.enabled | bool | `false` | Enable distributed LRU backend memory. For compatibility with existing installations it is off by default. | | bpf.enableTCX | bool | `true` | Attach endpoint programs using tcx instead of legacy tc hooks on supported kernels. | | bpf.events | object | `{"default":{"burstLimit":null,"rateLimit":null},"drop":{"enabled":true},"policyVerdict":{"enabled":true},"trace":{"enabled":true}}` | Control events generated by the Cilium datapath exposed to Cilium monitor and Hubble. Helm configuration for BPF events map rate limiting is experimental and might change in upcoming releases. | -| bpf.events.default | object | `{"burstLimit":null,"rateLimit":null}` | Default settings for all types of events except dbg. | +| bpf.events.default | object | `{"burstLimit":null,"rateLimit":null}` | Default settings for all types of events except dbg and pcap. | | bpf.events.default.burstLimit | int | `0` | Configure the maximum number of messages that can be written to BPF events map in 1 second. If burstLimit is greater than 0, non-zero value for rateLimit must also be provided lest the configuration is considered invalid. Setting both burstLimit and rateLimit to 0 disables BPF events rate limiting. | | bpf.events.default.rateLimit | int | `0` | Configure the limit of messages per second that can be written to BPF events map. The number of messages is averaged, meaning that if no messages were written to the map over 5 seconds, it's possible to write more events in the 6th second. If rateLimit is greater than 0, non-zero value for burstLimit must also be provided lest the configuration is considered invalid. Setting both burstLimit and rateLimit to 0 disables BPF events rate limiting. | | bpf.events.drop.enabled | bool | `true` | Enable drop events. | @@ -163,23 +158,19 @@ contributors across the globe, there is almost always someone available to help. | bpf.monitorAggregation | string | `"medium"` | Configure the level of aggregation for monitor notifications. Valid options are none, low, medium, maximum. | | bpf.monitorFlags | string | `"all"` | Configure which TCP flags trigger notifications when seen for the first time in a connection. | | bpf.monitorInterval | string | `"5s"` | Configure the typical time between monitor notifications for active connections. | -| bpf.monitorTraceIPOption | int | `0` | Configure the IP tracing option type. This option is used to specify the IP option type to use for tracing. The value must be an integer between 0 and 255. @schema type: [null, integer] minimum: 0 maximum: 255 @schema | | bpf.natMax | int | `524288` | Configure the maximum number of entries for the NAT table. | | bpf.neighMax | int | `524288` | Configure the maximum number of entries for the neighbor table. | | bpf.nodeMapMax | int | `nil` | Configures the maximum number of entries for the node table. | | bpf.policyMapMax | int | `16384` | Configure the maximum number of entries in endpoint policy map (per endpoint). @schema type: [null, integer] @schema | -| bpf.policyMapPressureMetricsThreshold | float64 | `0.1` | Configure threshold for emitting pressure metrics of policy maps. @schema type: [null, number] @schema | | bpf.policyStatsMapMax | int | `65536` | Configure the maximum number of entries in global policy stats map. @schema type: [null, integer] @schema | | bpf.preallocateMaps | bool | `false` | Enables pre-allocation of eBPF map values. This increases memory usage but can reduce latency. | | bpf.root | string | `"/sys/fs/bpf"` | Configure the mount point for the BPF filesystem | -| bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules for implementing Layer 7 policy. Note this is incompatible with netkit (`bpf.datapathMode=netkit`, `bpf.datapathMode=netkit-l2`). | +| bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules for implementing Layer 7 policy. | | bpf.vlanBypass | list | `[]` | Configure explicitly allowed VLAN id's for bpf logic bypass. [0] will allow all VLAN id's without any filtering. | | bpfClockProbe | bool | `false` | Enable BPF clock source probing for more efficient tick retrieval. | -| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"cronJob":{"failedJobsHistoryLimit":1,"successfulJobsHistoryLimit":3},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.4.1","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":null}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. | +| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.3.1","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. | | certgen.affinity | object | `{}` | Affinity for certgen | | certgen.annotations | object | `{"cronJob":{},"job":{}}` | Annotations to be added to the hubble-certgen initial Job and CronJob | -| certgen.cronJob.failedJobsHistoryLimit | int | `1` | The number of failed finished jobs to keep | -| certgen.cronJob.successfulJobsHistoryLimit | int | `3` | The number of successful finished jobs to keep | | certgen.extraVolumeMounts | list | `[]` | Additional certgen volumeMounts. | | certgen.extraVolumes | list | `[]` | Additional certgen volumes. | | certgen.generateCA | bool | `true` | When set to true the certificate authority secret is created. | @@ -188,7 +179,7 @@ contributors across the globe, there is almost always someone available to help. | certgen.priorityClassName | string | `""` | Priority class for certgen ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass | | certgen.resources | object | `{}` | Resource limits for certgen ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers | | certgen.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | -| certgen.ttlSecondsAfterFinished | string | `nil` | Seconds after which the completed job pod will be deleted | +| certgen.ttlSecondsAfterFinished | int | `1800` | Seconds after which the completed job pod will be deleted | | cgroup | object | `{"autoMount":{"enabled":true,"resources":{}},"hostRoot":"/run/cilium/cgroupv2"}` | Configure cgroup related configuration | | cgroup.autoMount.enabled | bool | `true` | Enable auto mount of cgroup2 filesystem. When `autoMount` is enabled, cgroup2 filesystem is mounted at `cgroup.hostRoot` path on the underlying host and inside the cilium agent pod. If users disable `autoMount`, it's expected that users have mounted cgroup2 filesystem at the specified `cgroup.hostRoot` volume, and then the volume will be mounted inside the cilium agent pod at the same path. | | cgroup.autoMount.resources | object | `{}` | Init Container Cgroup Automount resource limits & requests | @@ -214,7 +205,7 @@ contributors across the globe, there is almost always someone available to help. | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. | | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. | | clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. | -| clustermesh.apiserver.image | object | `{"digest":"sha256:a8136a7615d6c6041d3aa6f2674d17beaec238170d669507ccc05328a778e2b7","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.19.3","useDigest":true}` | Clustermesh API server image. | +| clustermesh.apiserver.image | object | `{"digest":"sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.18.6","useDigest":true}` | Clustermesh API server image. | | clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance (deprecated - KVStoreMesh will always be enabled once the option is removed). | | clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. | | clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. | @@ -264,65 +255,38 @@ contributors across the globe, there is almost always someone available to help. | clustermesh.apiserver.service.annotations | object | `{}` | Annotations for the clustermesh-apiserver service. Example annotations to configure an internal load balancer on different cloud providers: * AKS: service.beta.kubernetes.io/azure-load-balancer-internal: "true" * EKS: service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" * GKE: networking.gke.io/load-balancer-type: "Internal" | | clustermesh.apiserver.service.enableSessionAffinity | string | `"HAOnly"` | Defines when to enable session affinity. Each replica in a clustermesh-apiserver deployment runs its own discrete etcd cluster. Remote clients connect to one of the replicas through a shared Kubernetes Service. A client reconnecting to a different backend will require a full resync to ensure data integrity. Session affinity can reduce the likelihood of this happening, but may not be supported by all cloud providers. Possible values: - "HAOnly" (default) Only enable session affinity for deployments with more than 1 replica. - "Always" Always enable session affinity. - "Never" Never enable session affinity. Useful in environments where session affinity is not supported, but may lead to slightly degraded performance due to more frequent reconnections. | | clustermesh.apiserver.service.externalTrafficPolicy | string | `"Cluster"` | The externalTrafficPolicy of service used for apiserver access. | -| clustermesh.apiserver.service.externallyCreated | bool | `false` | Set externallyCreated to true to create the clustermesh-apiserver service outside this helm chart. For example after external load balancer controllers are created. | | clustermesh.apiserver.service.internalTrafficPolicy | string | `"Cluster"` | The internalTrafficPolicy of service used for apiserver access. | | clustermesh.apiserver.service.labels | object | `{}` | Labels for the clustermesh-apiserver service. | | clustermesh.apiserver.service.loadBalancerClass | string | `nil` | Configure a loadBalancerClass. Allows to configure the loadBalancerClass on the clustermesh-apiserver LB service in case the Service type is set to LoadBalancer (requires Kubernetes 1.24+). | | clustermesh.apiserver.service.loadBalancerIP | string | `nil` | Configure a specific loadBalancerIP. Allows to configure a specific loadBalancerIP on the clustermesh-apiserver LB service in case the Service type is set to LoadBalancer. | | clustermesh.apiserver.service.loadBalancerSourceRanges | list | `[]` | Configure loadBalancerSourceRanges. Allows to configure the source IP ranges allowed to access the clustermesh-apiserver LB service in case the Service type is set to LoadBalancer. | -| clustermesh.apiserver.service.nodePort | int | `32379` | Optional port to use as the node port for apiserver access. | +| clustermesh.apiserver.service.nodePort | int | `32379` | Optional port to use as the node port for apiserver access. WARNING: make sure to configure a different NodePort in each cluster if kube-proxy replacement is enabled, as Cilium is currently affected by a known bug (#24692) when NodePorts are handled by the KPR implementation. If a service with the same NodePort exists both in the local and the remote cluster, all traffic originating from inside the cluster and targeting the corresponding NodePort will be redirected to a local backend, regardless of whether the destination node belongs to the local or the remote cluster. | | clustermesh.apiserver.service.type | string | `"NodePort"` | The type of service used for apiserver access. | | clustermesh.apiserver.terminationGracePeriodSeconds | int | `30` | terminationGracePeriodSeconds for the clustermesh-apiserver deployment | | clustermesh.apiserver.tls.admin | object | `{"cert":"","key":""}` | base64 encoded PEM values for the clustermesh-apiserver admin certificate and private key. Used if 'auto' is not enabled. | -| clustermesh.apiserver.tls.admin.cert | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. | -| clustermesh.apiserver.tls.admin.key | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. | -| clustermesh.apiserver.tls.authMode | string | `"migration"` | Configure the clustermesh authentication mode. Supported values: - legacy: All clusters access remote clustermesh instances with the same username (i.e., remote). The "remote" certificate must be generated with CN=remote if provided manually. - migration: Intermediate mode required to upgrade from legacy to cluster (and vice versa) with no disruption. Specifically, it enables the creation of the per-cluster usernames, while still using the common one for authentication. The "remote" certificate must be generated with CN=remote if provided manually (same as legacy). - cluster: Each cluster accesses remote etcd instances with a username depending on the local cluster name (i.e., remote-). The "remote" certificate must be generated with CN=remote- if provided manually. Cluster mode is meaningful only when the same CA is shared across all clusters part of the mesh. | +| clustermesh.apiserver.tls.authMode | string | `"legacy"` | Configure the clustermesh authentication mode. Supported values: - legacy: All clusters access remote clustermesh instances with the same username (i.e., remote). The "remote" certificate must be generated with CN=remote if provided manually. - migration: Intermediate mode required to upgrade from legacy to cluster (and vice versa) with no disruption. Specifically, it enables the creation of the per-cluster usernames, while still using the common one for authentication. The "remote" certificate must be generated with CN=remote if provided manually (same as legacy). - cluster: Each cluster accesses remote etcd instances with a username depending on the local cluster name (i.e., remote-). The "remote" certificate must be generated with CN=remote- if provided manually. Cluster mode is meaningful only when the same CA is shared across all clusters part of the mesh. | | clustermesh.apiserver.tls.auto | object | `{"certManagerIssuerRef":{},"certValidityDuration":1095,"enabled":true,"method":"helm"}` | Configure automatic TLS certificates generation. A Kubernetes CronJob is used the generate any certificates not provided by the user at installation time. | | clustermesh.apiserver.tls.auto.certManagerIssuerRef | object | `{}` | certmanager issuer used when clustermesh.apiserver.tls.auto.method=certmanager. | | clustermesh.apiserver.tls.auto.certValidityDuration | int | `1095` | Generated certificates validity duration in days. | -| clustermesh.apiserver.tls.auto.enabled | bool | `true` | When set to true, automatically generate a CA and certificates to enable mTLS between clustermesh-apiserver and external workload instances. When set to false you need to pre-create the following secrets: - clustermesh-apiserver-server-cert - clustermesh-apiserver-admin-cert - clustermesh-apiserver-remote-cert - clustermesh-apiserver-local-cert The above secret should at least contains the keys `tls.crt` and `tls.key` and optionally `ca.crt` if a CA bundle is not configured. | -| clustermesh.apiserver.tls.enableSecrets | deprecated | `true` | Allow users to provide their own certificates Users may need to provide their certificates using a mechanism that requires they provide their own secrets. This setting does not apply to any of the auto-generated mechanisms below, it only restricts the creation of secrets via the `tls-provided` templates. This option is deprecated as secrets are expected to be created externally when 'auto' is not enabled. | +| clustermesh.apiserver.tls.auto.enabled | bool | `true` | When set to true, automatically generate a CA and certificates to enable mTLS between clustermesh-apiserver and external workload instances. If set to false, the certs to be provided by setting appropriate values below. | +| clustermesh.apiserver.tls.client | object | `{"cert":"","key":""}` | base64 encoded PEM values for the clustermesh-apiserver client certificate and private key. Used if 'auto' is not enabled. | +| clustermesh.apiserver.tls.enableSecrets | bool | `true` | Allow users to provide their own certificates Users may need to provide their certificates using a mechanism that requires they provide their own secrets. This setting does not apply to any of the auto-generated mechanisms below, it only restricts the creation of secrets via the `tls-provided` templates. | | clustermesh.apiserver.tls.remote | object | `{"cert":"","key":""}` | base64 encoded PEM values for the clustermesh-apiserver remote cluster certificate and private key. Used if 'auto' is not enabled. | -| clustermesh.apiserver.tls.remote.cert | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. | -| clustermesh.apiserver.tls.remote.key | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. | | clustermesh.apiserver.tls.server | object | `{"cert":"","extraDnsNames":[],"extraIpAddresses":[],"key":""}` | base64 encoded PEM values for the clustermesh-apiserver server certificate and private key. Used if 'auto' is not enabled. | -| clustermesh.apiserver.tls.server.cert | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. | | clustermesh.apiserver.tls.server.extraDnsNames | list | `[]` | Extra DNS names added to certificate when it's auto generated | | clustermesh.apiserver.tls.server.extraIpAddresses | list | `[]` | Extra IP addresses added to certificate when it's auto generated | -| clustermesh.apiserver.tls.server.key | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. | | clustermesh.apiserver.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | | clustermesh.apiserver.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for clustermesh-apiserver | | clustermesh.apiserver.updateStrategy | object | `{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}` | clustermesh-apiserver update strategy | -| clustermesh.cacheTTL | string | `"0s"` | The time to live for the cache of a remote cluster after connectivity is lost. If the connection is not re-established within this duration, the cached data is revoked to prevent stale state. If not specified or set to 0s, the cache is never revoked (default). | | clustermesh.config | object | `{"clusters":[],"domain":"mesh.cilium.io","enabled":false}` | Clustermesh explicit configuration. | -| clustermesh.config.clusters | list | `[]` | Clusters to be peered in the mesh. @schema type: [object, array] @schema | +| clustermesh.config.clusters | list | `[]` | List of clusters to be peered in the mesh. | | clustermesh.config.domain | string | `"mesh.cilium.io"` | Default dns domain for the Clustermesh API servers This is used in the case cluster addresses are not provided and IPs are used. | -| clustermesh.config.enabled | bool | `false` | Enable the Clustermesh explicit configuration. If set to false, you need to provide the following resources yourself: - (Secret) cilium-clustermesh (used by cilium-agent/cilium-operator to connect to the local etcd instance if KVStoreMesh is enabled or the remote clusters if KVStoreMesh is disabled) - (Secret) cilium-kvstoremesh (used by KVStoreMesh to connect to the remote clusters) - (ConfigMap) clustermesh-remote-users (used to create one etcd user per remote cluster if clustermesh-apiserver is used and `clustermesh.apiserver.tls.authMode` is not set to `legacy`) | +| clustermesh.config.enabled | bool | `false` | Enable the Clustermesh explicit configuration. | | clustermesh.enableEndpointSliceSynchronization | bool | `false` | Enable the synchronization of Kubernetes EndpointSlices corresponding to the remote endpoints of appropriately-annotated global services through ClusterMesh | -| clustermesh.enableMCSAPISupport | bool | `false` | Enable Multi-Cluster Services API support (deprecated; use clustermesh.mcsapi.enabled) | +| clustermesh.enableMCSAPISupport | bool | `false` | Enable Multi-Cluster Services API support | | clustermesh.maxConnectedClusters | int | `255` | The maximum number of clusters to support in a ClusterMesh. This value cannot be changed on running clusters, and all clusters in a ClusterMesh must be configured with the same value. Values > 255 will decrease the maximum allocatable cluster-local identities. Supported values are 255 and 511. | -| clustermesh.mcsapi.corednsAutoConfigure.affinity | object | `{}` | Affinity for coredns-mcsapi-autoconfig | -| clustermesh.mcsapi.corednsAutoConfigure.annotations | object | `{}` | Annotations to be added to the coredns-mcsapi-autoconfig Job | -| clustermesh.mcsapi.corednsAutoConfigure.coredns.clusterDomain | string | `"cluster.local"` | The cluster domain for the cluster CoreDNS service | -| clustermesh.mcsapi.corednsAutoConfigure.coredns.clustersetDomain | string | `"clusterset.local"` | The clusterset domain for the cluster CoreDNS service | -| clustermesh.mcsapi.corednsAutoConfigure.coredns.configMapName | string | `"coredns"` | The ConfigMap name for the cluster CoreDNS service | -| clustermesh.mcsapi.corednsAutoConfigure.coredns.deploymentName | string | `"coredns"` | The Deployment for the cluster CoreDNS service | -| clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace | string | `"kube-system"` | The namespace for the cluster CoreDNS service | -| clustermesh.mcsapi.corednsAutoConfigure.coredns.serviceAccountName | string | `"coredns"` | The Service Account name for the cluster CoreDNS service | -| clustermesh.mcsapi.corednsAutoConfigure.enabled | bool | `false` | Enable auto-configuration of CoreDNS for Multi-Cluster Services API. CoreDNS MUST be at least in version v1.12.2 to run this. | -| clustermesh.mcsapi.corednsAutoConfigure.extraArgs | list | `[]` | Additional arguments to `clustermesh-apiserver coredns-mcsapi-auto-configure`. | -| clustermesh.mcsapi.corednsAutoConfigure.extraVolumeMounts | list | `[]` | Additional coredns-mcsapi-autoconfig volumeMounts. | -| clustermesh.mcsapi.corednsAutoConfigure.extraVolumes | list | `[]` | Additional coredns-mcsapi-autoconfig volumes. | -| clustermesh.mcsapi.corednsAutoConfigure.nodeSelector | object | `{}` | Node selector for coredns-mcsapi-autoconfig ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | -| clustermesh.mcsapi.corednsAutoConfigure.podLabels | object | `{}` | Labels to be added to coredns-mcsapi-autoconfig pods | -| clustermesh.mcsapi.corednsAutoConfigure.priorityClassName | string | `""` | Priority class for coredns-mcsapi-autoconfig ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass | -| clustermesh.mcsapi.corednsAutoConfigure.resources | object | `{}` | Resource limits for coredns-mcsapi-autoconfig ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers | -| clustermesh.mcsapi.corednsAutoConfigure.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | -| clustermesh.mcsapi.corednsAutoConfigure.ttlSecondsAfterFinished | int | `1800` | Seconds after which the completed job pod will be deleted | -| clustermesh.mcsapi.enabled | bool | `false` | Enable Multi-Cluster Services API support | -| clustermesh.mcsapi.installCRDs | bool | `true` | Enabled MCS-API CRDs auto-installation | -| clustermesh.policyDefaultLocalCluster | bool | `true` | Control whether policy rules assume by default the local cluster if not explicitly selected | -| clustermesh.useAPIServer | bool | `false` | Deploy clustermesh-apiserver for clustermesh. This option is typically used with ``clustermesh.config.enabled=true``. Refer to the ``clustermesh.config.enabled=true``documentation for more information. | +| clustermesh.policyDefaultLocalCluster | bool | `false` | Control whether policy rules assume by default the local cluster if not explicitly selected | +| clustermesh.useAPIServer | bool | `false` | Deploy clustermesh-apiserver for clustermesh | | cni.binPath | string | `"/opt/cni/bin"` | Configure the path to the CNI binary directory on the host. | | cni.chainingMode | string | `nil` | Configure chaining on top of other CNI plugins. Possible values: - none - aws-cni - flannel - generic-veth - portmap | | cni.chainingTarget | string | `nil` | A CNI network name in to which the Cilium plugin should be added as a chained plugin. This will cause the agent to watch for a CNI network with this network name. When it is found, this will be used as the basis for Cilium's CNI configuration file. If this is set, it assumes a chaining mode of generic-veth. As a special case, a chaining mode of aws-cni implies a chainingTarget of aws-cni. | @@ -337,17 +301,15 @@ contributors across the globe, there is almost always someone available to help. | cni.install | bool | `true` | Install the CNI configuration and binary files into the filesystem. | | cni.iptablesRemoveAWSRules | bool | `true` | Enable the removal of iptables rules created by the AWS CNI VPC plugin. | | cni.logFile | string | `"/var/run/cilium/cilium-cni.log"` | Configure the log file for CNI logging with retention policy of 7 days. Disable CNI file logging by setting this field to empty explicitly. | -| cni.resources | object | `{"limits":{"cpu":1,"memory":"1Gi"},"requests":{"cpu":"100m","memory":"10Mi"}}` | Specifies the resources for the cni initContainer | +| cni.resources | object | `{"requests":{"cpu":"100m","memory":"10Mi"}}` | Specifies the resources for the cni initContainer | | cni.uninstall | bool | `false` | Remove the CNI configuration and binary files on agent shutdown. Enable this if you're removing Cilium from the cluster. Disable this to prevent the CNI configuration file from being removed during agent upgrade, which can cause nodes to go unmanageable. | | commonLabels | object | `{}` | commonLabels allows users to add common labels for all Cilium resources. | -| configDriftDetection | object | `{"driftChecker":true,"enabled":true,"ignoredKeys":[]}` | Configuration for the ConfigMap drift detection feature. When enabled, the agent continuously watches the cilium-config ConfigMap and exposes a cilium_drift_checker_config_delta Prometheus metric reporting the number of keys that differ between the ConfigMap and the agent's active settings. A non-zero value indicates that the agent has not yet applied all current ConfigMap changes and needs to be restarted. | -| configDriftDetection.driftChecker | bool | `true` | Enable the drift checker which compares the DynamicConfig table against the agent's active settings and publishes the cilium_drift_checker_config_delta metric. | -| configDriftDetection.enabled | bool | `true` | Enable watching of the cilium-config ConfigMap and reflecting its contents into the agent's internal DynamicConfig table. | -| configDriftDetection.ignoredKeys | list | `[]` | List of config-map keys to ignore when computing the drift delta. | | connectivityProbeFrequencyRatio | float64 | `0.5` | Ratio of the connectivity probe frequency vs resource usage, a float in [0, 1]. 0 will give more frequent probing, 1 will give less frequent probing. Probing frequency is dynamically adjusted based on the cluster size. | | conntrackGCInterval | string | `"0s"` | Configure how frequently garbage collection should occur for the datapath connection tracking table. | | conntrackGCMaxInterval | string | `""` | Configure the maximum frequency for the garbage collection of the connection tracking table. Only affects the automatic computation for the frequency and has no effect when 'conntrackGCInterval' is set. This can be set to more frequently clean up unused identities created from ToFQDN policies. | | crdWaitTimeout | string | `"5m"` | Configure timeout in which Cilium will exit if CRDs are not available | +| customCalls | object | `{"enabled":false}` | Tail call hooks for custom eBPF programs. | +| customCalls.enabled | bool | `false` | Enable tail call hooks for custom eBPF programs. | | daemon.allowedConfigOverrides | string | `nil` | allowedConfigOverrides is a list of config-map keys that can be overridden. That is to say, if this value is set, config sources (excepting the first one) can only override keys in this list. This takes precedence over blockedConfigOverrides. By default, all keys may be overridden. To disable overrides, set this to "none" or change the configSources variable. | | daemon.blockedConfigOverrides | string | `nil` | blockedConfigOverrides is a list of config-map keys that may not be overridden. In other words, if any of these keys appear in a configuration source excepting the first one, they will be ignored This is ignored if allowedConfigOverrides is set. By default, all keys may be overridden. | | daemon.configSources | string | `nil` | Configure a custom list of possible configuration override sources The default is "config-map:cilium-config,cilium-node-config". For supported values, see the help text for the build-config subcommand. Note that this value should be a comma-separated string. | @@ -356,8 +318,8 @@ contributors across the globe, there is almost always someone available to help. | dashboards | object | `{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null}` | Grafana dashboards for cilium-agent grafana can import dashboards based on the label and value ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards | | debug.enabled | bool | `false` | Enable debug logging | | debug.metricsSamplingInterval | string | `"5m"` | Set the agent-internal metrics sampling frequency. This sets the frequency of the internal sampling of the agent metrics. These are available via the "cilium-dbg shell -- metrics -s" command and are part of the metrics HTML page included in the sysdump. @schema type: [null, string] @schema | -| debug.verbose | string | `nil` | Configure verbosity levels for debug logging This option is used to enable debug messages for operations related to such sub-system such as (e.g. kvstore, envoy, datapath, policy, or tagged), and flow is for enabling debug messages emitted per request, message and connection. Multiple values can be set via a space-separated string (e.g. "datapath envoy"). Applicable values: - flow - kvstore - envoy - datapath - policy - tagged | -| defaultLBServiceIPAM | string | `"lbipam"` | defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none | +| debug.verbose | string | `nil` | Configure verbosity levels for debug logging This option is used to enable debug messages for operations related to such sub-system such as (e.g. kvstore, envoy, datapath or policy), and flow is for enabling debug messages emitted per request, message and connection. Multiple values can be set via a space-separated string (e.g. "datapath envoy"). Applicable values: - flow - kvstore - envoy - datapath - policy | +| defaultLBServiceIPAM | string | `"lbipam"` | defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none @schema type: [string] @schema | | directRoutingSkipUnreachable | bool | `false` | Enable skipping of PodCIDR routes between worker nodes if the worker nodes are in a different L2 network segment. | | disableEndpointCRD | bool | `false` | Disable the usage of CiliumEndpoint CRD. | | dnsPolicy | string | `""` | DNS policy for Cilium agent pods. Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | @@ -376,13 +338,12 @@ contributors across the globe, there is almost always someone available to help. | egressGateway.reconciliationTriggerInterval | string | `"1s"` | Time between triggers of egress gateway state reconciliations | | enableCriticalPriorityClass | bool | `true` | Explicitly enable or disable priority class. .Capabilities.KubeVersion is unsettable in `helm template` calls, it depends on k8s libraries version that Helm was compiled against. This option allows to explicitly disable setting the priority class, which is useful for rendering charts for gke clusters in advance. | | enableIPv4BIGTCP | bool | `false` | Enables IPv4 BIG TCP support which increases maximum IPv4 GSO/GRO limits for nodes and pods | -| enableIPv4Masquerade | bool | `true` unless ipam eni mode is active | Enables masquerading of IPv4 traffic leaving the node from endpoints. | +| enableIPv4Masquerade | bool | `true` unless ipam eni mode is active | Enables masquerading of IPv4 traffic leaving the node from endpoints. | | enableIPv6BIGTCP | bool | `false` | Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods | | enableIPv6Masquerade | bool | `true` | Enables masquerading of IPv6 traffic leaving the node from endpoints. | | enableInternalTrafficPolicy | bool | `true` | Enable Internal Traffic Policy | | enableLBIPAM | bool | `true` | Enable LoadBalancer IP Address Management | | enableMasqueradeRouteSource | bool | `false` | Enables masquerading to the source of the route for traffic leaving the node from endpoints. | -| enableNoServiceEndpointsRoutable | bool | `true` | Enable routing to a service that has zero endpoints | | enableNonDefaultDenyPolicies | bool | `true` | Enable Non-Default-Deny policies | | enableXTSocketFallback | bool | `true` | Enables the fallback compatibility solution for when the xt_socket kernel module is missing and it is needed for the datapath L7 redirection to work properly. See documentation for details on when this can be disabled: https://docs.cilium.io/en/stable/operations/system_requirements/#linux-kernel. | | encryption.enabled | bool | `false` | Enable transparent network encryption. | @@ -394,39 +355,14 @@ contributors across the globe, there is almost always someone available to help. | encryption.ipsec.mountPath | string | `"/etc/ipsec"` | Path to mount the secret inside the Cilium pod. | | encryption.ipsec.secretName | string | `"cilium-ipsec-keys"` | Name of the Kubernetes secret containing the encryption keys. | | encryption.nodeEncryption | bool | `false` | Enable encryption for pure node to node traffic. This option is only effective when encryption.type is set to "wireguard". | -| encryption.strictMode | object | `{"allowRemoteNodeIdentities":false,"cidr":"","egress":{"allowRemoteNodeIdentities":false,"cidr":"","enabled":false},"enabled":false,"ingress":{"enabled":false}}` | Configure the Encryption Pod2Pod strict mode. | -| encryption.strictMode.allowRemoteNodeIdentities | bool | `false` | Allow dynamic lookup of remote node identities. (deprecated: please use encryption.strictMode.egress.allowRemoteNodeIdentities) This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. | -| encryption.strictMode.cidr | string | `""` | CIDR for the Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.cidr) | -| encryption.strictMode.egress.allowRemoteNodeIdentities | bool | `false` | Allow dynamic lookup of remote node identities. This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. | -| encryption.strictMode.egress.cidr | string | `""` | CIDR for the Encryption Pod2Pod strict egress mode. | -| encryption.strictMode.egress.enabled | bool | `false` | Enable strict egress encryption. | -| encryption.strictMode.enabled | bool | `false` | Enable Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.enabled) | -| encryption.strictMode.ingress.enabled | bool | `false` | Enable strict ingress encryption. When enabled, all unencrypted overlay ingress traffic will be dropped. This option is only applicable when WireGuard and tunneling are enabled. | -| encryption.type | string | `"ipsec"` | Encryption method. Can be one of ipsec, wireguard or ztunnel. | +| encryption.strictMode | object | `{"allowRemoteNodeIdentities":false,"cidr":"","enabled":false}` | Configure the WireGuard Pod2Pod strict mode. | +| encryption.strictMode.allowRemoteNodeIdentities | bool | `false` | Allow dynamic lookup of remote node identities. This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. | +| encryption.strictMode.cidr | string | `""` | CIDR for the WireGuard Pod2Pod strict mode. | +| encryption.strictMode.enabled | bool | `false` | Enable WireGuard Pod2Pod strict mode. | +| encryption.type | string | `"ipsec"` | Encryption method. Can be either ipsec or wireguard. | | encryption.wireguard.persistentKeepalive | string | `"0s"` | Controls WireGuard PersistentKeepalive option. Set 0s to disable. | -| encryption.ztunnel | object | `{"affinity":{},"annotations":{},"caAddress":"https://localhost:15012","extraEnv":[],"extraVolumeMounts":[],"extraVolumes":[],"healthPort":15021,"image":{"digest":null,"override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/istio/ztunnel","tag":"1.28.0-distroless","useDigest":false},"nodeSelector":{"kubernetes.io/os":"linux"},"podAnnotations":{},"podLabels":{},"priorityClassName":null,"readinessProbe":{"failureThreshold":3,"initialDelaySeconds":0,"periodSeconds":10},"resources":{"requests":{"cpu":"200m","memory":"512Mi"}},"secrets":{"bootstrapRootCert":null},"terminationGracePeriodSeconds":30,"tolerations":[{"effect":"NoSchedule","operator":"Exists"},{"key":"CriticalAddonsOnly","operator":"Exists"},{"effect":"NoExecute","operator":"Exists"}],"updateStrategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}}` | ztunnel encryption configuration. ztunnel is Istio's purpose-built, per-node proxy for handling L4 traffic in ambient mesh mode. These settings only apply when encryption.type is set to "ztunnel". | -| encryption.ztunnel.affinity | object | `{}` | Affinity for ztunnel pods. | -| encryption.ztunnel.annotations | object | `{}` | Annotations to be added to all ztunnel resources. | -| encryption.ztunnel.caAddress | string | `"https://localhost:15012"` | CA server address for certificate requests. | -| encryption.ztunnel.extraEnv | list | `[]` | Additional ztunnel container environment variables. | -| encryption.ztunnel.extraVolumeMounts | list | `[]` | Additional ztunnel volumeMounts. | -| encryption.ztunnel.extraVolumes | list | `[]` | Additional ztunnel volumes. | -| encryption.ztunnel.healthPort | int | `15021` | TCP port for the health API. | -| encryption.ztunnel.image | object | `{"digest":null,"override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/istio/ztunnel","tag":"1.28.0-distroless","useDigest":false}` | ztunnel container image. | -| encryption.ztunnel.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for ztunnel pods. | -| encryption.ztunnel.podAnnotations | object | `{}` | Annotations to be added to ztunnel pods. | -| encryption.ztunnel.podLabels | object | `{}` | Labels to be added to ztunnel pods. | -| encryption.ztunnel.priorityClassName | string | `nil` | The priority class to use for ztunnel pods. | -| encryption.ztunnel.readinessProbe | object | `{"failureThreshold":3,"initialDelaySeconds":0,"periodSeconds":10}` | Readiness probe configuration. | -| encryption.ztunnel.resources | object | `{"requests":{"cpu":"200m","memory":"512Mi"}}` | ztunnel resource limits & requests. | -| encryption.ztunnel.secrets | object | `{"bootstrapRootCert":null}` | ztunnel secrets configuration. | -| encryption.ztunnel.secrets.bootstrapRootCert | string | `nil` | Base64-encoded bootstrap root certificate content. If not provided, the secret must be created manually before deploying. @schema type: [null, string] @schema | -| encryption.ztunnel.terminationGracePeriodSeconds | int | `30` | Configure termination grace period for ztunnel DaemonSet. | -| encryption.ztunnel.tolerations | list | `[{"effect":"NoSchedule","operator":"Exists"},{"key":"CriticalAddonsOnly","operator":"Exists"},{"effect":"NoExecute","operator":"Exists"}]` | Node tolerations for ztunnel scheduling. | -| encryption.ztunnel.updateStrategy | object | `{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}` | ztunnel update strategy. | | endpointHealthChecking.enabled | bool | `true` | Enable connectivity health checking between virtual endpoints. | | endpointLockdownOnMapOverflow | bool | `false` | Enable endpoint lockdown on policy map overflow. | -| endpointPolicyUpdateTimeoutDuration | string | `nil` | Max duration to wait for envoy to respond to configuration changes. Default "10s". | | endpointRoutes.enabled | bool | `false` | Enable use of per endpoint routes instead of routing via the cilium_host interface. | | eni.awsEnablePrefixDelegation | bool | `false` | Enable ENI prefix delegation | | eni.awsReleaseExcessIPs | bool | `false` | Release IPs not used from the ENI | @@ -437,24 +373,12 @@ contributors across the globe, there is almost always someone available to help. | eni.gcTags | object | `{"io.cilium/cilium-managed":"true,"io.cilium/cluster-name":""}` | Additional tags attached to ENIs created by Cilium. Dangling ENIs with this tag will be garbage collected | | eni.iamRole | string | `""` | If using IAM role for Service Accounts will not try to inject identity values from cilium-aws kubernetes secret. Adds annotation to service account if managed by Helm. See https://github.com/aws/amazon-eks-pod-identity-webhook | | eni.instanceTagsFilter | list | `[]` | Filter via AWS EC2 Instance tags (k=v) which will dictate which AWS EC2 Instances are going to be used to create new ENIs | -| eni.nodeSpec | object | `{"deleteOnTermination":null,"disablePrefixDelegation":false,"excludeInterfaceTags":[],"firstInterfaceIndex":null,"securityGroupTags":[],"securityGroups":[],"subnetIDs":[],"subnetTags":[],"usePrimaryAddress":false}` | NodeSpec configuration for the ENI | -| eni.nodeSpec.deleteOnTermination | string | `nil` | Delete ENI on termination @schema type: [null, boolean] @schema | -| eni.nodeSpec.disablePrefixDelegation | bool | `false` | Disable prefix delegation for IP allocation | -| eni.nodeSpec.excludeInterfaceTags | list | `[]` | Exclude interface tags to use for IP allocation | -| eni.nodeSpec.firstInterfaceIndex | string | `nil` | First interface index to use for IP allocation @schema type: [null, integer] @schema | -| eni.nodeSpec.securityGroupTags | list | `[]` | Security group tags to use for IP allocation | -| eni.nodeSpec.securityGroups | list | `[]` | Security groups to use for IP allocation | -| eni.nodeSpec.subnetIDs | list | `[]` | Subnet IDs to use for IP allocation | -| eni.nodeSpec.subnetTags | list | `[]` | Subnet tags to use for IP allocation | -| eni.nodeSpec.usePrimaryAddress | bool | `false` | Use primary address for IP allocation | | eni.subnetIDsFilter | list | `[]` | Filter via subnet IDs which will dictate which subnets are going to be used to create new ENIs Important note: This requires that each instance has an ENI with a matching subnet attached when Cilium is deployed. If you only want to control subnets for ENIs attached by Cilium, use the CNI configuration file settings (cni.customConf) instead. | | eni.subnetTagsFilter | list | `[]` | Filter via tags (k=v) which will dictate which subnets are going to be used to create new ENIs Important note: This requires that each instance has an ENI with a matching subnet attached when Cilium is deployed. If you only want to control subnets for ENIs attached by Cilium, use the CNI configuration file settings (cni.customConf) instead. | | envoy.affinity | object | `{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"cilium.io/no-schedule","operator":"NotIn","values":["true"]}]}]}},"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]},"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium-envoy"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-envoy. | | envoy.annotations | object | `{}` | Annotations to be added to all top-level cilium-envoy objects (resources under templates/cilium-envoy) | | envoy.baseID | int | `0` | Set Envoy'--base-id' to use when allocating shared memory regions. Only needs to be changed if multiple Envoy instances will run on the same node and may have conflicts. Supported values: 0 - 4294967295. Defaults to '0' | | envoy.bootstrapConfigMap | string | `nil` | ADVANCED OPTION: Bring your own custom Envoy bootstrap ConfigMap. Provide the name of a ConfigMap with a `bootstrap-config.json` key. When specified, Envoy will use this ConfigMap instead of the default provided by the chart. WARNING: Use of this setting has the potential to prevent cilium-envoy from starting up, and can cause unexpected behavior (e.g. due to syntax error or semantically incorrect configuration). Before submitting an issue, please ensure you have disabled this feature, as support cannot be provided for custom Envoy bootstrap configs. @schema type: [null, string] @schema | -| envoy.clusterMaxConnections | int | `1024` | Maximum number of connections on Envoy clusters | -| envoy.clusterMaxRequests | int | `1024` | Maximum number of requests on Envoy clusters | | envoy.connectTimeoutSeconds | int | `2` | Time in seconds after which a TCP connection attempt times out | | envoy.debug.admin.enabled | bool | `false` | Enable admin interface for cilium-envoy. This is useful for debugging and should not be enabled in production. | | envoy.debug.admin.port | int | `9901` | Port number (bound to loopback interface). kubectl port-forward can be used to access the admin interface. | @@ -470,8 +394,7 @@ contributors across the globe, there is almost always someone available to help. | envoy.httpRetryCount | int | `3` | Maximum number of retries for each HTTP request | | envoy.httpUpstreamLingerTimeout | string | `nil` | Time in seconds to block Envoy worker thread while an upstream HTTP connection is closing. If set to 0, the connection is closed immediately (with TCP RST). If set to -1, the connection is closed asynchronously in the background. | | envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s | -| envoy.image | object | `{"digest":"sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa","useDigest":true}` | Envoy container image. | -| envoy.initContainers | list | `[]` | Init containers added to the cilium Envoy DaemonSet. | +| envoy.image | object | `{"digest":"sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9","useDigest":true}` | Envoy container image. | | envoy.initialFetchTimeoutSeconds | int | `30` | Time in seconds after which the initial fetch on an xDS stream is considered timed out | | envoy.livenessProbe.enabled | bool | `true` | Enable liveness probe for cilium-envoy | | envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe | @@ -483,7 +406,6 @@ contributors across the globe, there is almost always someone available to help. | envoy.log.path | string | `""` | Path to a separate Envoy log file, if any. Defaults to /dev/stdout. | | envoy.maxConcurrentRetries | int | `128` | Maximum number of concurrent retries on Envoy clusters | | envoy.maxConnectionDurationSeconds | int | `0` | Set Envoy HTTP option max_connection_duration seconds. Default 0 (disable) | -| envoy.maxGlobalDownstreamConnections | int | `50000` | Maximum number of global downstream connections | | envoy.maxRequestsPerConnection | int | `0` | ProxyMaxRequestsPerConnection specifies the max_requests_per_connection setting for Envoy | | envoy.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for cilium-envoy. | | envoy.podAnnotations | object | `{}` | Annotations to be added to envoy pods | @@ -517,7 +439,6 @@ contributors across the globe, there is almost always someone available to help. | envoy.terminationGracePeriodSeconds | int | `1` | Configure termination grace period for cilium-envoy DaemonSet. | | envoy.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for envoy scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | | envoy.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":2},"type":"RollingUpdate"}` | cilium-envoy update strategy ref: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/#updating-a-daemonset | -| envoy.useOriginalSourceAddress | bool | `true` | For cases when CiliumEnvoyConfig is not used directly (Ingress, Gateway), configures Cilium BPF Metadata listener filter to use the original source address when extracting the metadata for a request. | | envoy.xffNumTrustedHopsL7PolicyEgress | int | `0` | Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the egress L7 policy enforcement Envoy listeners. | | envoy.xffNumTrustedHopsL7PolicyIngress | int | `0` | Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the ingress L7 policy enforcement Envoy listeners. | | envoyConfig.enabled | bool | `false` | Enable CiliumEnvoyConfig CRD CiliumEnvoyConfig CRD can also be implicitly enabled by other options. | @@ -561,13 +482,12 @@ contributors across the globe, there is almost always someone available to help. | hubble.dropEventEmitter.interval | string | `"2m"` | - Minimum time between emitting same events. | | hubble.dropEventEmitter.reasons | list | `["auth_required","policy_denied"]` | - Drop reasons to emit events for. ref: https://docs.cilium.io/en/stable/_api/v1/flow/README/#dropreason | | hubble.enabled | bool | `true` | Enable Hubble (true by default). | -| hubble.export | object | `{"dynamic":{"config":{"configMapName":"cilium-flowlog-config","content":[{"aggregationInterval":"0s","excludeFilters":[],"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false},"static":{"aggregationInterval":"0s","allowList":[],"denyList":[],"enabled":false,"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}}` | Hubble flows export. | -| hubble.export.dynamic | object | `{"config":{"configMapName":"cilium-flowlog-config","content":[{"aggregationInterval":"0s","excludeFilters":[],"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false}` | - Dynamic exporters configuration. Dynamic exporters may be reconfigured without a need of agent restarts. | +| hubble.export | object | `{"dynamic":{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false},"static":{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}}` | Hubble flows export. | +| hubble.export.dynamic | object | `{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false}` | - Dynamic exporters configuration. Dynamic exporters may be reconfigured without a need of agent restarts. | | hubble.export.dynamic.config.configMapName | string | `"cilium-flowlog-config"` | -- Name of configmap with configuration that may be altered to reconfigure exporters within a running agents. | -| hubble.export.dynamic.config.content | list | `[{"aggregationInterval":"0s","excludeFilters":[],"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}]` | -- Exporters configuration in YAML format. | +| hubble.export.dynamic.config.content | list | `[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}]` | -- Exporters configuration in YAML format. | | hubble.export.dynamic.config.createConfigMap | bool | `true` | -- True if helm installer should create config map. Switch to false if you want to self maintain the file content. | -| hubble.export.static | object | `{"aggregationInterval":"0s","allowList":[],"denyList":[],"enabled":false,"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}` | - Static exporter configuration. Static exporter is bound to agent lifecycle. | -| hubble.export.static.aggregationInterval | string | `"0s"` | - Defines the interval at which to aggregate before exporting Hubble flows. Aggregation feature is only enabled when fieldAggregate is specified and aggregationInterval > 0s. | +| hubble.export.static | object | `{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}` | - Static exporter configuration. Static exporter is bound to agent lifecycle. | | hubble.export.static.fileCompress | bool | `false` | - Enable compression of rotated files. | | hubble.export.static.fileMaxBackups | int | `5` | - Defines max number of backup/rotated files. | | hubble.export.static.fileMaxSizeMb | int | `10` | - Defines max file size of output file before it gets rotated. | @@ -615,12 +535,9 @@ contributors across the globe, there is almost always someone available to help. | hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. | | hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay | | hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay | -| hubble.relay.image | object | `{"digest":"sha256:5ee21d57b6ef2aa6db67e603a735fdceb162454b352b7335b651456e308f681b","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.19.3","useDigest":true}` | Hubble-relay container image. | +| hubble.relay.image | object | `{"digest":"sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.18.6","useDigest":true}` | Hubble-relay container image. | | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. | | hubble.relay.listenPort | string | `"4245"` | Port to listen to. | -| hubble.relay.logOptions | object | `{"format":null,"level":null}` | Logging configuration for hubble-relay. | -| hubble.relay.logOptions.format | string | text-ts | Log format for hubble-relay. Valid values are: text, text-ts, json, json-ts. | -| hubble.relay.logOptions.level | string | info | Log level for hubble-relay. Valid values are: debug, info, warn, error. | | hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | | hubble.relay.podAnnotations | object | `{}` | Annotations to be added to hubble-relay pods | | hubble.relay.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ | @@ -630,9 +547,7 @@ contributors across the globe, there is almost always someone available to help. | hubble.relay.podLabels | object | `{}` | Labels to be added to hubble-relay pods | | hubble.relay.podSecurityContext | object | `{"fsGroup":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | hubble-relay pod security context | | hubble.relay.pprof.address | string | `"localhost"` | Configure pprof listen address for hubble-relay | -| hubble.relay.pprof.blockProfileRate | int | `0` | Enable goroutine blocking profiling for hubble-relay and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) | | hubble.relay.pprof.enabled | bool | `false` | Enable pprof for hubble-relay | -| hubble.relay.pprof.mutexProfileFraction | int | `0` | Enable mutex contention profiling for hubble-relay and set the fraction of sampled events (set to 1 to sample all events) | | hubble.relay.pprof.port | int | `6062` | Configure pprof listen port for hubble-relay | | hubble.relay.priorityClassName | string | `""` | The priority class to use for hubble-relay | | hubble.relay.prometheus | object | `{"enabled":false,"port":9966,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null}}` | Enable prometheus metrics for hubble-relay on the configured port at /metrics | @@ -726,14 +641,13 @@ contributors across the globe, there is almost always someone available to help. | hubble.ui.tls.client.cert | string | `""` | base64 encoded PEM values for the Hubble UI client certificate (deprecated). Use existingSecret instead. | | hubble.ui.tls.client.existingSecret | string | `""` | Name of the Secret containing the client certificate and key for Hubble UI If specified, cert and key are ignored. | | hubble.ui.tls.client.key | string | `""` | base64 encoded PEM values for the Hubble UI client key (deprecated). Use existingSecret instead. | -| hubble.ui.tmpVolume | object | `{}` | Configure temporary volume for hubble-ui | | hubble.ui.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | | hubble.ui.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for hubble-ui | | hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. | | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd`, `kvstore` or `doublewrite-readkvstore` / `doublewrite-readcrd` for migrating between identity backends). | | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. | | identityManagementMode | string | `"agent"` | Control whether CiliumIdentities are created by the agent ("agent"), the operator ("operator") or both ("both"). "Both" should be used only to migrate between "agent" and "operator". Operator-managed identities is a beta feature. | -| image | object | `{"digest":"sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.3","useDigest":true}` | Agent container image. | +| image | object | `{"digest":"sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.18.6","useDigest":true}` | Agent container image. | | imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images | | ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set | | ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. | @@ -768,11 +682,6 @@ contributors across the globe, there is almost always someone available to help. | ipam.installUplinkRoutesForDelegatedIPAM | bool | `false` | Install ingress/egress routes through uplink on host for Pods when working with delegated IPAM plugin. | | ipam.mode | string | `"cluster-pool"` | Configure IP Address Management mode. ref: https://docs.cilium.io/en/stable/network/concepts/ipam/ | | ipam.multiPoolPreAllocation | string | `""` | Pre-allocation settings for IPAM in Multi-Pool mode | -| ipam.nodeSpec | object | `{"ipamMaxAllocate":null,"ipamMinAllocate":null,"ipamPreAllocate":null,"ipamStaticIPTags":[]}` | NodeSpec configuration for the IPAM | -| ipam.nodeSpec.ipamMaxAllocate | string | `nil` | IPAM max allocate @schema type: [null, integer] @schema | -| ipam.nodeSpec.ipamMinAllocate | string | `nil` | IPAM min allocate @schema type: [null, integer] @schema | -| ipam.nodeSpec.ipamPreAllocate | string | `nil` | IPAM pre allocate @schema type: [null, integer] @schema | -| ipam.nodeSpec.ipamStaticIPTags | list | `[]` | IPAM static IP tags (currently only works with AWS and Azure) | | ipam.operator.autoCreateCiliumPodIPPools | object | `{}` | IP pools to auto-create in multi-pool IPAM mode. | | ipam.operator.clusterPoolIPv4MaskSize | int | `24` | IPv4 CIDR mask size to delegate to individual nodes for IPAM. | | ipam.operator.clusterPoolIPv4PodCIDRList | list | `["10.0.0.0/8"]` | IPv4 CIDR list range to delegate to individual nodes for IPAM. | @@ -821,13 +730,12 @@ contributors across the globe, there is almost always someone available to help. | livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe | | livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe | | livenessProbe.requireK8sConnectivity | bool | `false` | whether to require k8s connectivity as part of the check. | -| loadBalancer | object | `{"acceleration":"disabled","l7":{"algorithm":"round_robin","backend":"disabled","ports":[]},"serviceTopology":false}` | Configure service load balancing | +| loadBalancer | object | `{"acceleration":"disabled","l7":{"algorithm":"round_robin","backend":"disabled","ports":[]}}` | Configure service load balancing | | loadBalancer.acceleration | string | `"disabled"` | acceleration is the option to accelerate service handling via XDP Applicable values can be: disabled (do not use XDP), native (XDP BPF program is run directly out of the networking driver's early receive path), or best-effort (use native mode XDP acceleration on devices that support it). | | loadBalancer.l7 | object | `{"algorithm":"round_robin","backend":"disabled","ports":[]}` | L7 LoadBalancer | | loadBalancer.l7.algorithm | string | `"round_robin"` | Default LB algorithm The default LB algorithm to be used for services, which can be overridden by the service annotation (e.g. service.cilium.io/lb-l7-algorithm) Applicable values: round_robin, least_request, random | | loadBalancer.l7.backend | string | `"disabled"` | Enable L7 service load balancing via envoy proxy. The request to a k8s service, which has specific annotation e.g. service.cilium.io/lb-l7, will be forwarded to the local backend proxy to be load balanced to the service endpoints. Please refer to docs for supported annotations for more configuration. Applicable values: - envoy: Enable L7 load balancing via envoy proxy. This will automatically set enable-envoy-config as well. - disabled: Disable L7 load balancing by way of service annotation. | | loadBalancer.l7.ports | list | `[]` | List of ports from service to be automatically redirected to above backend. Any service exposing one of these ports will be automatically redirected. Fine-grained control can be achieved by using the service annotation. | -| loadBalancer.serviceTopology | bool | `false` | serviceTopology enables K8s Topology Aware Hints -based service endpoints filtering | | localRedirectPolicies.addressMatcherCIDRs | string | `nil` | Limit the allowed addresses in Address Matcher rule of Local Redirect Policies to the given CIDRs. @schema@ type: [null, array] @schema@ | | localRedirectPolicies.enabled | bool | `false` | Enable local redirect policies. | | localRedirectPolicy | bool | `false` | Enable Local Redirect Policy (deprecated, please use 'localRedirectPolicies.enabled' instead) | @@ -836,18 +744,19 @@ contributors across the globe, there is almost always someone available to help. | monitor | object | `{"enabled":false}` | cilium-monitor sidecar. | | monitor.enabled | bool | `false` | Enable the cilium-monitor sidecar. | | name | string | `"cilium"` | Agent daemonset name. | -| namespaceOverride | string | `""` | namespaceOverride allows to override the destination namespace for Cilium resources. | +| namespaceOverride | string | `""` | namespaceOverride allows to override the destination namespace for Cilium resources. This property allows to use Cilium as part of an Umbrella Chart with different targets. | | nat.mapStatsEntries | int | `32` | Number of the top-k SNAT map connections to track in Cilium statedb. | | nat.mapStatsInterval | string | `"30s"` | Interval between how often SNAT map is counted for stats. | | nat46x64Gateway | object | `{"enabled":false}` | Configure standalone NAT46/NAT64 gateway | | nat46x64Gateway.enabled | bool | `false` | Enable RFC6052-prefixed translation | | nodeIPAM.enabled | bool | `false` | Configure Node IPAM ref: https://docs.cilium.io/en/stable/network/node-ipam/ | -| nodePort | object | `{"addresses":null,"autoProtectPortRange":true,"bindProtection":true,"enableHealthCheck":true,"enableHealthCheckLoadBalancerIP":false}` | Configure N-S k8s service loadbalancing | +| nodePort | object | `{"addresses":null,"autoProtectPortRange":true,"bindProtection":true,"enableHealthCheck":true,"enableHealthCheckLoadBalancerIP":false,"enabled":false}` | Configure N-S k8s service loadbalancing | | nodePort.addresses | string | `nil` | List of CIDRs for choosing which IP addresses assigned to native devices are used for NodePort load-balancing. By default this is empty and the first suitable, preferably private, IPv4 and IPv6 address assigned to each device is used. Example: addresses: ["192.168.1.0/24", "2001::/64"] | | nodePort.autoProtectPortRange | bool | `true` | Append NodePort range to ip_local_reserved_ports if clash with ephemeral ports is detected. | | nodePort.bindProtection | bool | `true` | Set to true to prevent applications binding to service ports. | | nodePort.enableHealthCheck | bool | `true` | Enable healthcheck nodePort server for NodePort services | | nodePort.enableHealthCheckLoadBalancerIP | bool | `false` | Enable access of the healthcheck nodePort on the LoadBalancerIP. Needs EnableHealthCheck to be enabled | +| nodePort.enabled | bool | `false` | Enable the Cilium NodePort service implementation. | | nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for cilium-agent. | | nodeSelectorLabels | bool | `false` | Enable/Disable use of node label based identity | | nodeinit.affinity | object | `{}` | Affinity for cilium-nodeinit | @@ -857,7 +766,7 @@ contributors across the globe, there is almost always someone available to help. | nodeinit.extraEnv | list | `[]` | Additional nodeinit environment variables. | | nodeinit.extraVolumeMounts | list | `[]` | Additional nodeinit volumeMounts. | | nodeinit.extraVolumes | list | `[]` | Additional nodeinit volumes. | -| nodeinit.image | object | `{"digest":"sha256:50b9cf9c280096b59b80d2fc8ee6638facef79ac18998a22f0cbc40d5d28c16f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"1763560095-8f36c34","useDigest":true}` | node-init image. | +| nodeinit.image | object | `{"digest":"sha256:5bdca3c2dec2c79f58d45a7a560bf1098c2126350c901379fe850b7f78d3d757","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"1755531540-60ee83e","useDigest":true}` | node-init image. | | nodeinit.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for nodeinit pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | | nodeinit.podAnnotations | object | `{}` | Annotations to be added to node-init pods. | | nodeinit.podLabels | object | `{}` | Labels to be added to node-init pods. | @@ -870,7 +779,6 @@ contributors across the globe, there is almost always someone available to help. | nodeinit.startup | object | `{"postScript":"","preScript":""}` | startup offers way to customize startup nodeinit script (pre and post position) | | nodeinit.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for nodeinit scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | | nodeinit.updateStrategy | object | `{"type":"RollingUpdate"}` | node-init update strategy | -| nodeinit.waitForCloudInit | bool | `false` | wait for Cloud init to finish on the host and assume the node has cloud init installed | | operator.affinity | object | `{"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"io.cilium/app":"operator"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-operator | | operator.annotations | object | `{}` | Annotations to be added to all top-level cilium-operator objects (resources under templates/cilium-operator) | | operator.dashboards | object | `{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null}` | Grafana dashboards for cilium-operator grafana can import dashboards based on the label and value ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards | @@ -885,7 +793,7 @@ contributors across the globe, there is almost always someone available to help. | operator.hostNetwork | bool | `true` | HostNetwork setting | | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. | | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. | -| operator.image | object | `{"alibabacloudDigest":"sha256:176321a65123373ff8c7823b25183102cbad98375e8d6c80b96d68b6e8491103","awsDigest":"sha256:a53dcbfb77282bf2ddd3abbe60f6d49762e7c1389a36cb35b71d504644a56640","azureDigest":"sha256:699c1571a3df1a98882ee13610d47cffb7b34ee7e8d276096db798a5f6c7e4cb","genericDigest":"sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.19.3","useDigest":true}` | cilium-operator image. | +| operator.image | object | `{"alibabacloudDigest":"sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c","awsDigest":"sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb","azureDigest":"sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1","genericDigest":"sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.18.6","useDigest":true}` | cilium-operator image. | | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. | | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods | @@ -896,12 +804,10 @@ contributors across the globe, there is almost always someone available to help. | operator.podLabels | object | `{}` | Labels to be added to cilium-operator pods | | operator.podSecurityContext | object | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Security context to be added to cilium-operator pods | | operator.pprof.address | string | `"localhost"` | Configure pprof listen address for cilium-operator | -| operator.pprof.blockProfileRate | int | `0` | Enable goroutine blocking profiling for cilium-operator and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) | | operator.pprof.enabled | bool | `false` | Enable pprof for cilium-operator | -| operator.pprof.mutexProfileFraction | int | `0` | Enable mutex contention profiling for cilium-operator and set the fraction of sampled events (set to 1 to sample all events) | | operator.pprof.port | int | `6061` | Configure pprof listen port for cilium-operator | | operator.priorityClassName | string | `""` | The priority class to use for cilium-operator | -| operator.prometheus | object | `{"enabled":true,"metricsService":false,"port":9963,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null},"tls":{"enabled":false,"server":{"existingSecret":"","mtls":{"enabled":false}}}}` | Enable prometheus metrics for cilium-operator on the configured port at /metrics | +| operator.prometheus | object | `{"enabled":true,"metricsService":false,"port":9963,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null}}` | Enable prometheus metrics for cilium-operator on the configured port at /metrics | | operator.prometheus.serviceMonitor.annotations | object | `{}` | Annotations to add to ServiceMonitor cilium-operator | | operator.prometheus.serviceMonitor.enabled | bool | `false` | Enable service monitors. This requires the prometheus CRDs to be available (see https://github.com/prometheus-operator/prometheus-operator/blob/main/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml) | | operator.prometheus.serviceMonitor.interval | string | `"10s"` | Interval for scrape metrics. | @@ -910,8 +816,6 @@ contributors across the globe, there is almost always someone available to help. | operator.prometheus.serviceMonitor.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor cilium-operator | | operator.prometheus.serviceMonitor.relabelings | string | `nil` | Relabeling configs for the ServiceMonitor cilium-operator | | operator.prometheus.serviceMonitor.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. | -| operator.prometheus.tls | object | `{"enabled":false,"server":{"existingSecret":"","mtls":{"enabled":false}}}` | TLS configuration for Prometheus | -| operator.prometheus.tls.server.existingSecret | string | `""` | Name of the Secret containing the certificate, key and CA files for the Prometheus server. | | operator.removeNodeTaints | bool | `true` | Remove Cilium node taint from Kubernetes nodes that have a healthy Cilium pod running. | | operator.replicas | int | `2` | Number of replicas to run for the cilium-operator deployment | | operator.resources | object | `{}` | cilium-operator resource limits & requests ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | @@ -924,30 +828,25 @@ contributors across the globe, there is almost always someone available to help. | operator.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for cilium-operator | | operator.unmanagedPodWatcher.intervalSeconds | int | `15` | Interval, in seconds, to check if there are any pods that are not managed by Cilium. | | operator.unmanagedPodWatcher.restart | bool | `true` | Restart any pod that are not managed by Cilium. | -| operator.unmanagedPodWatcher.selector | string | `nil` | Selector for pods that should be restarted when not managed by Cilium. If not set, defaults to built-in selector "k8s-app=kube-dns". Set to empty string to select all pods. @schema type: [null, string] @schema | | operator.updateStrategy | object | `{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"50%"},"type":"RollingUpdate"}` | cilium-operator update strategy | | pmtuDiscovery.enabled | bool | `false` | Enable path MTU discovery to send ICMP fragmentation-needed replies to the client. | -| pmtuDiscovery.packetizationLayerPMTUDMode | string | `"blackhole"` | Enable kernel probing path MTU discovery for Pods which uses different message sizes to search for correct MTU value. Valid values are: always, blackhole, disabled and unset (or empty). If value is 'unset' or left empty then will not try to override setting. | | podAnnotations | object | `{}` | Annotations to be added to agent pods | | podLabels | object | `{}` | Labels to be added to agent pods | | podSecurityContext | object | `{"appArmorProfile":{"type":"Unconfined"},"seccompProfile":{"type":"Unconfined"}}` | Security Context for cilium-agent pods. | | podSecurityContext.appArmorProfile | object | `{"type":"Unconfined"}` | AppArmorProfile options for the `cilium-agent` and init containers | | policyCIDRMatchMode | string | `nil` | policyCIDRMatchMode is a list of entities that may be selected by CIDR selector. The possible value is "nodes". | -| policyDenyResponse | string | `"none"` | Configure what the response should be to pod egress traffic denied by network policy. Possible values: - none (default) - icmp | | policyEnforcementMode | string | `"default"` | The agent can be put into one of the three policy enforcement modes: default, always and never. ref: https://docs.cilium.io/en/stable/security/policy/intro/#policy-enforcement-modes | | pprof.address | string | `"localhost"` | Configure pprof listen address for cilium-agent | -| pprof.blockProfileRate | int | `0` | Enable goroutine blocking profiling for cilium-agent and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) | | pprof.enabled | bool | `false` | Enable pprof for cilium-agent | -| pprof.mutexProfileFraction | int | `0` | Enable mutex contention profiling for cilium-agent and set the fraction of sampled events (set to 1 to sample all events) | | pprof.port | int | `6060` | Configure pprof listen port for cilium-agent | | preflight.affinity | object | `{"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-preflight | | preflight.annotations | object | `{}` | Annotations to be added to all top-level preflight objects (resources under templates/cilium-preflight) | | preflight.enabled | bool | `false` | Enable Cilium pre-flight resources (required for upgrade) | -| preflight.envoy.image | object | `{"digest":"sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa","useDigest":true}` | Envoy pre-flight image. | +| preflight.envoy.image | object | `{"digest":"sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9","useDigest":true}` | Envoy pre-flight image. | | preflight.extraEnv | list | `[]` | Additional preflight environment variables. | | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. | | preflight.extraVolumes | list | `[]` | Additional preflight volumes. | -| preflight.image | object | `{"digest":"sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.3","useDigest":true}` | Cilium pre-flight image. | +| preflight.image | object | `{"digest":"sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.18.6","useDigest":true}` | Cilium pre-flight image. | | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods | | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ | @@ -991,37 +890,24 @@ contributors across the globe, there is almost always someone available to help. | sctp | object | `{"enabled":false}` | SCTP Configuration Values | | sctp.enabled | bool | `false` | Enable SCTP support. NOTE: Currently, SCTP support does not support rewriting ports or multihoming. | | secretsNamespaceAnnotations | object | `{}` | Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) | -| secretsNamespaceLabels | object | `{}` | Labels to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) | | securityContext.allowPrivilegeEscalation | bool | `false` | disable privilege escalation | | securityContext.capabilities.applySysctlOverwrites | list | `["SYS_ADMIN","SYS_CHROOT","SYS_PTRACE"]` | capabilities for the `apply-sysctl-overwrites` init container | -| securityContext.capabilities.ciliumAgent | list | `["CHOWN","KILL","NET_ADMIN","NET_RAW","IPC_LOCK","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE","DAC_OVERRIDE","FOWNER","SETGID","SETUID","SYSLOG"]` | Capabilities for the `cilium-agent` container | +| securityContext.capabilities.ciliumAgent | list | `["CHOWN","KILL","NET_ADMIN","NET_RAW","IPC_LOCK","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE","DAC_OVERRIDE","FOWNER","SETGID","SETUID"]` | Capabilities for the `cilium-agent` container | | securityContext.capabilities.cleanCiliumState | list | `["NET_ADMIN","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE"]` | Capabilities for the `clean-cilium-state` init container | | securityContext.capabilities.mountCgroup | list | `["SYS_ADMIN","SYS_CHROOT","SYS_PTRACE"]` | Capabilities for the `mount-cgroup` init container | | securityContext.privileged | bool | `false` | Run the pod with elevated privileges | | securityContext.seLinuxOptions | object | `{"level":"s0","type":"spc_t"}` | SELinux options for the `cilium-agent` and init containers | | serviceAccounts | object | Component's fully qualified name. | Define serviceAccount names for components. | | serviceAccounts.clustermeshcertgen | object | `{"annotations":{},"automount":true,"create":true,"name":"clustermesh-apiserver-generate-certs"}` | Clustermeshcertgen is used if clustermesh.apiserver.tls.auto.method=cronJob | -| serviceAccounts.corednsMCSAPI | object | `{"annotations":{},"automount":true,"create":true,"name":"cilium-coredns-mcsapi-autoconfig"}` | CorednsMCSAPI is used if clustermesh.mcsapi.corednsAutoConfigure.enabled=true | | serviceAccounts.hubblecertgen | object | `{"annotations":{},"automount":true,"create":true,"name":"hubble-generate-certs"}` | Hubblecertgen is used if hubble.tls.auto.method=cronJob | | serviceAccounts.nodeinit.enabled | bool | `false` | Enabled is temporary until https://github.com/cilium/cilium-cli/issues/1396 is implemented. Cilium CLI doesn't create the SAs for node-init, thus the workaround. Helm is not affected by this issue. Name and automount can be configured, if enabled is set to true. Otherwise, they are ignored. Enabled can be removed once the issue is fixed. Cilium-nodeinit DS must also be fixed. | -| serviceAccounts.ztunnel | object | `{"annotations":{},"automount":false,"create":true,"name":"ztunnel-cilium"}` | Ztunnel is used if encryption.type=ztunnel | | serviceNoBackendResponse | string | `"reject"` | Configure what the response should be to traffic for a service without backends. Possible values: - reject (default) - drop | | sleepAfterInit | bool | `false` | Do not run Cilium agent when running with clean mode. Useful to completely uninstall Cilium as it will stop Cilium from starting and create artifacts in the node. | | socketLB | object | `{"enabled":false}` | Configure socket LB | | socketLB.enabled | bool | `false` | Enable socket LB | -| standaloneDnsProxy | object | `{"annotations":{},"automountServiceAccountToken":false,"debug":false,"enabled":false,"image":{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"","tag":"","useDigest":true},"nodeSelector":{"kubernetes.io/os":"linux"},"rollOutPods":false,"serverPort":10095,"tolerations":[],"updateStrategy":{"rollingUpdate":{"maxSurge":2,"maxUnavailable":0},"type":"RollingUpdate"}}` | Standalone DNS Proxy Configuration Note: The standalone DNS proxy uses the agent's dnsProxy.* configuration for DNS settings (proxyPort, enableDnsCompression) to ensure consistency. | -| standaloneDnsProxy.annotations | object | `{}` | Standalone DNS proxy annotations | -| standaloneDnsProxy.automountServiceAccountToken | bool | `false` | Standalone DNS proxy auto mount service account token | -| standaloneDnsProxy.debug | bool | `false` | Standalone DNS proxy debug mode | -| standaloneDnsProxy.enabled | bool | `false` | Enable standalone DNS proxy (alpha feature) | -| standaloneDnsProxy.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"","tag":"","useDigest":true}` | Standalone DNS proxy image | -| standaloneDnsProxy.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Standalone DNS proxy Node Selector | -| standaloneDnsProxy.rollOutPods | bool | `false` | Roll out Standalone DNS proxy automatically when configmap is updated. | -| standaloneDnsProxy.serverPort | int | `10095` | Standalone DNS proxy server port | -| standaloneDnsProxy.tolerations | list | `[]` | Standalone DNS proxy tolerations | -| standaloneDnsProxy.updateStrategy | object | `{"rollingUpdate":{"maxSurge":2,"maxUnavailable":0},"type":"RollingUpdate"}` | Standalone DNS proxy update strategy | | startupProbe.failureThreshold | int | `300` | failure threshold of startup probe. Allow Cilium to take up to 600s to start up (300 attempts with 2s between attempts). | | startupProbe.periodSeconds | int | `2` | interval between checks of the startup probe | +| svcSourceRangeCheck | bool | `true` | Enable check of service source ranges (currently, only for LoadBalancer). | | synchronizeK8sNodes | bool | `true` | Synchronize Kubernetes nodes to kvstore and perform CNP GC. | | sysctlfix | object | `{"enabled":true}` | Configure sysctl override described in #20072. | | sysctlfix.enabled | bool | `true` | Enable the sysctl override. When enabled, the init container will mount the /proc of the host so that the `sysctlfix` utility can execute. | @@ -1043,12 +929,11 @@ contributors across the globe, there is almost always someone available to help. | tls.secretsNamespace | object | `{"create":true,"name":"cilium-secrets"}` | Configures where secrets used in CiliumNetworkPolicies will be looked for | | tls.secretsNamespace.create | bool | `true` | Create secrets namespace for TLS Interception secrets. | | tls.secretsNamespace.name | string | `"cilium-secrets"` | Name of TLS Interception secret namespace. | -| tmpVolume | object | `{}` | Configure temporary volume for cilium-agent | | tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for agent scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | | tunnelPort | int | Port 8472 for VXLAN, Port 6081 for Geneve | Configure VXLAN and Geneve tunnel port. | | tunnelProtocol | string | `"vxlan"` | Tunneling protocol to use in tunneling mode and for ad-hoc tunnels. Possible values: - "" - vxlan - geneve | | tunnelSourcePortRange | string | 0-0 to let the kernel driver decide the range | Configure VXLAN and Geneve tunnel source port range hint. | -| underlayProtocol | string | `"ipv4"` | IP family for the underlay. Possible values: - "ipv4" - "ipv6" | +| underlayProtocol | string | `"ipv4"` | IP family for the underlay. | | updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":2},"type":"RollingUpdate"}` | Cilium agent update strategy | | upgradeCompatibility | string | `nil` | upgradeCompatibility helps users upgrading to ensure that the configMap for Cilium will not change critical values to ensure continued operation This flag is not required for new installations. For example: '1.7', '1.8', '1.9' | | vtep.cidr | string | `""` | A space separated list of VTEP device CIDRs, for example "1.1.1.0/24 1.1.2.0/24" | diff --git a/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml b/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml index 90ebf4ac..52439049 100644 --- a/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml +++ b/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml @@ -167,8 +167,6 @@ staticResources: circuitBreakers: thresholds: - maxRetries: {{ .Values.envoy.maxConcurrentRetries }} - maxConnections: {{ .Values.envoy.clusterMaxConnections }} - maxRequests: {{ .Values.envoy.clusterMaxRequests }} lbPolicy: "CLUSTER_PROVIDED" typedExtensionProtocolOptions: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: @@ -185,8 +183,6 @@ staticResources: circuitBreakers: thresholds: - maxRetries: {{ .Values.envoy.maxConcurrentRetries }} - maxConnections: {{ .Values.envoy.clusterMaxConnections }} - maxRequests: {{ .Values.envoy.clusterMaxRequests }} lbPolicy: "CLUSTER_PROVIDED" typedExtensionProtocolOptions: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: @@ -208,8 +204,6 @@ staticResources: circuitBreakers: thresholds: - maxRetries: {{ .Values.envoy.maxConcurrentRetries }} - maxConnections: {{ .Values.envoy.clusterMaxConnections }} - maxRequests: {{ .Values.envoy.clusterMaxRequests }} lbPolicy: "CLUSTER_PROVIDED" typedExtensionProtocolOptions: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: @@ -226,8 +220,6 @@ staticResources: circuitBreakers: thresholds: - maxRetries: {{ .Values.envoy.maxConcurrentRetries }} - maxConnections: {{ .Values.envoy.clusterMaxConnections }} - maxRequests: {{ .Values.envoy.clusterMaxRequests }} lbPolicy: "CLUSTER_PROVIDED" typedExtensionProtocolOptions: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: @@ -300,7 +292,7 @@ overloadManager: - name: "envoy.resource_monitors.global_downstream_max_connections" typedConfig: "@type": "type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig" - max_active_downstream_connections: "{{ .Values.envoy.maxGlobalDownstreamConnections }}" + max_active_downstream_connections: "50000" applicationLogConfig: logFormat: {{- if .Values.envoy.log.format_json }} @@ -312,4 +304,3 @@ admin: address: pipe: path: "/var/run/cilium/envoy/sockets/admin.sock" - mode: 0660 diff --git a/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash b/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash index 68e6b50b..aa63cac8 100644 --- a/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash +++ b/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash @@ -156,14 +156,6 @@ fi iptables -w -t nat -D POSTROUTING -m comment --comment "ip-masq: ensure nat POSTROUTING directs all non-LOCAL destination traffic to our custom IP-MASQ chain" -m addrtype ! --dst-type LOCAL -j IP-MASQ || true {{- end }} -{{- if .Values.nodeinit.waitForCloudInit }} -echo "Waiting for cloud-init..." -if command -v cloud-init >/dev/null 2>&1; then - cloud-init status --wait - echo "cloud-init completed!" -fi -{{- end }} - {{- if not (eq .Values.nodeinit.bootstrapFile "") }} mkdir -p {{ .Values.nodeinit.bootstrapFile | dir | quote }} date > {{ .Values.nodeinit.bootstrapFile | quote }} diff --git a/packages/system/cilium/charts/cilium/templates/_extensions.tpl b/packages/system/cilium/charts/cilium/templates/_extensions.tpl index 8c0e5c20..bd8ba80b 100644 --- a/packages/system/cilium/charts/cilium/templates/_extensions.tpl +++ b/packages/system/cilium/charts/cilium/templates/_extensions.tpl @@ -21,24 +21,6 @@ dnsPolicy: {{ .Values.dnsPolicy }} {{- end }} {{- end }} -{{/* -Allow packagers to add extra volumes to cilium-operator. -*/}} -{{- define "cilium-operator.volumes.extra" }} -{{- end }} - -{{- define "cilium-operator.volumeMounts.extra" }} -{{- end }} - -{{/* -Allow packagers to set securityContext for cilium-operator. -*/}} -{{- define "cilium.operator.securityContext" }} -{{- with .Values.operator.securityContext }} -{{ toYaml . }} -{{- end }} -{{- end }} - {{/* Intentionally empty to allow downstream chart packagers to add extra containers to hubble-relay without having to modify the deployment manifest @@ -90,87 +72,3 @@ Allow packagers to add extra configuration to certgen. */}} {{- define "certgen.config.extra" -}} {{- end }} - -{{/* -Allow packagers to add extra arguments to the clustermesh-apiserver apiserver container. -*/}} -{{- define "clustermesh.apiserver.args.extra" -}} -{{- end }} - -{{/* -Allow packagers to add extra arguments to the clustermesh-apiserver kvstoremesh container. -*/}} -{{- define "clustermesh.kvstoremesh.args.extra" -}} -{{- end }} - -{{/* -Allow packagers to add init containers to the cilium-envoy pods. -*/}} -{{- define "envoy.initContainers" -}} -{{- end }} - -{{/* -Allow packagers to add extra args to the cilium-envoy container. -*/}} -{{- define "envoy.args.extra" -}} -{{- end }} - -{{/* -Allow packagers to add extra env vars to the cilium-envoy container. -*/}} -{{- define "envoy.env.extra" -}} -{{- end }} - -{{/* -Allow packagers to add extra volume mounts to the cilium-envoy container. -*/}} -{{- define "envoy.volumeMounts.extra" -}} -{{- end }} - -{{/* -Allow packagers to add extra host path mounts to the cilium-envoy container. -*/}} -{{- define "envoy.hostPathMounts.extra" -}} -{{- end }} - - -{{/* -Allow packagers to define set of ports for cilium-envoy container. -The template needs to allow overriding ports spec not just adding. -*/}} -{{- define "envoy.ports" -}} - {{- if .Values.envoy.prometheus.enabled }} - ports: - - name: envoy-metrics - containerPort: {{ .Values.envoy.prometheus.port }} - hostPort: {{ .Values.envoy.prometheus.port }} - protocol: TCP - {{- if and .Values.envoy.debug.admin.enabled .Values.envoy.debug.admin.port }} - - name: envoy-admin - containerPort: {{ .Values.envoy.debug.admin.port }} - hostPort: {{ .Values.envoy.debug.admin.port }} - protocol: TCP - {{- end }} - {{- end }} -{{- end }} - -{{/* -Allow packagers to define update strategy for cilium-envoy pods. -*/}} -{{- define "envoy.updateStrategy" -}} -{{- with .Values.envoy.updateStrategy }} -updateStrategy: - {{- toYaml . | trim | nindent 2 }} - {{- end }} -{{- end }} - -{{/* -Allow packagers to define affinity for cilium-envoy pods. -*/}} -{{- define "envoy.affinity" -}} -{{- with .Values.envoy.affinity }} -affinity: - {{- toYaml . | nindent 2 }} -{{- end }} -{{- end }} - diff --git a/packages/system/cilium/charts/cilium/templates/_helpers.tpl b/packages/system/cilium/charts/cilium/templates/_helpers.tpl index e90aa482..ba91c353 100644 --- a/packages/system/cilium/charts/cilium/templates/_helpers.tpl +++ b/packages/system/cilium/charts/cilium/templates/_helpers.tpl @@ -131,16 +131,12 @@ To override the namespace and configMap when using `auto`: {{- define "k8sServiceHost" }} {{- $configmapName := default "cluster-info" .Values.k8sServiceLookupConfigMapName }} {{- $configmapNamespace := default "kube-public" .Values.k8sServiceLookupNamespace }} - {{- if eq .Values.k8sServiceHost "auto" }} + {{- if and (eq .Values.k8sServiceHost "auto") (lookup "v1" "ConfigMap" $configmapNamespace $configmapName) }} {{- $configmap := (lookup "v1" "ConfigMap" $configmapNamespace $configmapName) }} - {{- if $configmap }} - {{- $kubeconfig := get $configmap.data "kubeconfig" }} - {{- $k8sServer := get ($kubeconfig | fromYaml) "clusters" | mustFirst | dig "cluster" "server" "" }} - {{- $uri := (split "https://" $k8sServer)._1 | trim }} - {{- (split ":" $uri)._0 | quote }} - {{- else }} - {{- fail (printf "ConfigMap %s/%s not found, please create it or set k8sServiceHost to a valid value" $configmapNamespace $configmapName) }} - {{- end }} + {{- $kubeconfig := get $configmap.data "kubeconfig" }} + {{- $k8sServer := get ($kubeconfig | fromYaml) "clusters" | mustFirst | dig "cluster" "server" "" }} + {{- $uri := (split "https://" $k8sServer)._1 | trim }} + {{- (split ":" $uri)._0 | quote }} {{- else }} {{- .Values.k8sServiceHost | quote }} {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml index 57b13447..eaca204e 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml @@ -94,6 +94,7 @@ rules: - cilium.io resources: - ciliumloadbalancerippools + - ciliumbgppeeringpolicies - ciliumbgpnodeconfigs - ciliumbgpadvertisements - ciliumbgppeerconfigs diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml index fff1b384..c706da51 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml @@ -10,7 +10,6 @@ {{- $kubeProxyReplacement := (coalesce .Values.kubeProxyReplacement "false") -}} {{- $envoyDS := eq (include "envoyDaemonSetEnabled" .) "true" -}} -{{- $buildDaemonConfig := or (kindIs "invalid" .Values.daemon.configSources) (not (regexMatch "^config-map:[^,]+$" .Values.daemon.configSources)) -}} --- apiVersion: apps/v1 @@ -57,6 +56,19 @@ spec: # ensure pods roll when configmap updates cilium.io/cilium-configmap-checksum: {{ include (print $.Template.BasePath "/cilium-configmap.yaml") . | sha256sum | quote }} {{- end }} + {{- if not .Values.securityContext.privileged }} + {{- if semverCompare "<1.30.0" (printf "%d.%d.0" (semver .Capabilities.KubeVersion.Version).Major (semver .Capabilities.KubeVersion.Version).Minor) }} + # Set app AppArmor's profile to "unconfined". The value of this annotation + # can be modified as long users know which profiles they have available + # in AppArmor. + container.apparmor.security.beta.kubernetes.io/cilium-agent: "unconfined" + container.apparmor.security.beta.kubernetes.io/clean-cilium-state: "unconfined" + {{- if .Values.cgroup.autoMount.enabled }} + container.apparmor.security.beta.kubernetes.io/mount-cgroup: "unconfined" + container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: "unconfined" + {{- end }} + {{- end }} + {{- end }} {{- with .Values.podAnnotations }} {{- toYaml . | nindent 8 }} {{- end }} @@ -122,7 +134,7 @@ spec: httpGet: host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }} path: /healthz - port: health + port: {{ .Values.healthPort }} scheme: HTTP httpHeaders: - name: "brief" @@ -142,7 +154,7 @@ spec: httpGet: host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }} path: /healthz - port: health + port: {{ .Values.healthPort }} scheme: HTTP httpHeaders: - name: "brief" @@ -165,7 +177,7 @@ spec: httpGet: host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }} path: /healthz - port: health + port: {{ .Values.healthPort }} scheme: HTTP httpHeaders: - name: "brief" @@ -238,17 +250,12 @@ spec: resources: {{- toYaml . | trim | nindent 10 }} {{- end }} + {{- if or .Values.prometheus.enabled (or .Values.hubble.metrics.enabled .Values.hubble.metrics.dynamic.enabled) }} ports: - - name: health - containerPort: {{ .Values.healthPort }} - hostPort: {{ .Values.healthPort }} - protocol: TCP - {{- if .Values.hubble.enabled }} - name: peer-service containerPort: {{ .Values.hubble.peerService.targetPort }} hostPort: {{ .Values.hubble.peerService.targetPort }} protocol: TCP - {{- end }} {{- if .Values.prometheus.enabled }} - name: prometheus containerPort: {{ .Values.prometheus.port }} @@ -273,6 +280,7 @@ spec: hostPort: {{ .Values.hubble.metrics.port }} protocol: TCP {{- end }} + {{- end }} securityContext: {{- if .Values.securityContext.privileged }} privileged: true @@ -367,10 +375,6 @@ spec: - name: cilium-ipsec-secrets mountPath: {{ .Values.encryption.ipsec.mountPath }} {{- end }} - {{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }} - - name: cilium-ztunnel-secrets - mountPath: /etc/ztunnel - {{- end }} {{- if .Values.kubeConfigPath }} - name: kube-config mountPath: {{ .Values.kubeConfigPath }} @@ -386,14 +390,8 @@ spec: mountPath: /var/lib/cilium/tls/hubble readOnly: true {{- end }} - {{- if $buildDaemonConfig }} - name: tmp mountPath: /tmp - {{- else }} - - name: cilium-config-path - mountPath: /tmp/cilium/config-map - readOnly: true - {{- end }} {{- range .Values.extraHostPathMounts }} - name: {{ .name }} mountPath: {{ .mountPath }} @@ -449,7 +447,6 @@ spec: {{- toYaml .Values.extraContainers | nindent 6 }} {{- end }} initContainers: - {{- if $buildDaemonConfig }} - name: config image: {{ include "cilium.image" .Values.image | quote }} imagePullPolicy: {{ .Values.image.pullPolicy }} @@ -516,17 +513,6 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} terminationMessagePolicy: FallbackToLogsOnError - securityContext: - {{- if .Values.securityContext.privileged }} - privileged: true - {{- else }} - capabilities: - add: - - NET_ADMIN - drop: - - ALL - {{- end}} - {{- end }} {{- if .Values.cgroup.autoMount.enabled }} # Required to mount cgroup2 filesystem on the underlying Kubernetes node. # We use nsenter command with host's cgroup and mount namespaces enabled. @@ -538,15 +524,12 @@ spec: value: {{ .Values.cgroup.hostRoot }} - name: BIN_PATH value: {{ .Values.cni.binPath }} - {{- if .Values.cgroup.autoMount.resources }} + {{- with .Values.cgroup.autoMount.resources }} resources: - {{- toYaml .Values.cgroup.autoMount.resources | trim | nindent 10 }} - {{- else if .Values.initResources }} - resources: - {{- toYaml .Values.initResources | trim | nindent 10 }} + {{- toYaml . | trim | nindent 10 }} {{- end }} command: - - bash + - sh - -ec # The statically linked Go program binary is invoked to avoid any # dependency on utilities like sh and mount that can be missing on certain @@ -592,7 +575,7 @@ spec: - name: BIN_PATH value: {{ .Values.cni.binPath }} command: - - bash + - sh - -ec # The statically linked Go program binary is invoked to avoid any # dependency on utilities like sh that can be missing on certain @@ -660,7 +643,7 @@ spec: {{- toYaml . | trim | nindent 10 }} {{- end }} command: - - bash + - sh - -c - | until test -s {{ (print "/tmp/cilium-bootstrap.d/" (.Values.nodeinit.bootstrapFile | base)) | quote }}; do @@ -838,7 +821,7 @@ spec: {{- end }} {{- if and .Values.clustermesh.config.enabled (not (and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled )) }} hostAliases: - {{- range $_, $cluster := (include "clustermesh-clusters" . | fromJson) }} + {{- range $cluster := .Values.clustermesh.config.clusters }} {{- range $ip := $cluster.ips }} - ip: {{ $ip }} hostnames: [ "{{ $cluster.name }}.{{ $.Values.clustermesh.config.domain }}" ] @@ -846,20 +829,9 @@ spec: {{- end }} {{- end }} volumes: - {{- if $buildDaemonConfig }} - # For sharing configuration between the "config" initContainer and the agent + # For sharing configuration between the "config" initContainer and the agent - name: tmp - {{- if .Values.tmpVolume }} - {{- toYaml .Values.tmpVolume | nindent 8 }} - {{- else }} emptyDir: {} - {{- end }} - {{- else }} - # To read the configuration from the config map - - name: cilium-config-path - configMap: - name: {{ trimPrefix "config-map:" .Values.daemon.configSources }} - {{- end }} # To keep state between restarts / upgrades - name: cilium-run hostPath: @@ -1020,11 +992,6 @@ spec: secret: secretName: {{ .Values.encryption.ipsec.secretName }} {{- end }} - {{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }} - - name: cilium-ztunnel-secrets - secret: - secretName: cilium-ztunnel-secrets - {{- end }} {{- if .Values.cni.configMap }} - name: cni-configuration configMap: diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/role.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/role.yaml index df60d89b..89266e0d 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-agent/role.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/role.yaml @@ -120,7 +120,7 @@ rules: - watch {{- end}} -{{- if and .Values.agent (not .Values.preflight.enabled) .Values.serviceAccounts.cilium.create $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }} +{{- if and .Values.operator.enabled .Values.serviceAccounts.operator.create $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml index 5caf2f15..c76350b3 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml @@ -126,7 +126,7 @@ subjects: namespace: {{ include "cilium.namespace" . }} {{- end}} -{{- if and .Values.agent (not .Values.preflight.enabled) .Values.serviceAccounts.cilium.create $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }} +{{- if and (not .Values.preflight.enabled) $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding diff --git a/packages/system/cilium/charts/cilium/templates/cilium-ca-secret.yaml b/packages/system/cilium/charts/cilium/templates/cilium-ca-secret.yaml index 91569863..7dd15d02 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-ca-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-ca-secret.yaml @@ -11,13 +11,8 @@ kind: Secret metadata: name: {{ .commonCASecretName }} namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} - cilium.io/helm-template-non-idempotent: "true" - {{- with .Values.nonIdempotentAnnotations }} - annotations: + labels: {{- toYaml . | nindent 4 }} {{- end }} data: diff --git a/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml b/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml index 5d76944d..a9bb1cd9 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml @@ -33,6 +33,12 @@ {{- end }} {{- $defaultBpfCtTcpMax = 0 -}} {{- $defaultBpfCtAnyMax = 0 -}} + {{- $defaultKubeProxyReplacement = "probe" -}} +{{- end -}} + +{{- /* Default values when 1.9 was initially deployed */ -}} +{{- if semverCompare ">=1.9" (default "1.9" .Values.upgradeCompatibility) -}} + {{- $defaultKubeProxyReplacement = "probe" -}} {{- end -}} {{- /* Default values when 1.10 was initially deployed */ -}} @@ -46,6 +52,7 @@ {{- if .Values.azure.enabled }} {{- $azureUsePrimaryAddress = "false" -}} {{- end }} + {{- $defaultKubeProxyReplacement = "disabled" -}} {{- $defaultDNSProxyEnableTransparentMode = "true" -}} {{- end -}} @@ -64,10 +71,6 @@ {{- end }} {{- end -}} {{- $ipam := (coalesce .Values.ipam.mode $defaultIPAM) -}} -{{- if .Values.eni.enabled }} - {{- $ipam = "eni" -}} -{{- end }} - {{- $bpfCtTcpMax := (coalesce .Values.bpf.ctTcpMax $defaultBpfCtTcpMax) -}} {{- $bpfCtAnyMax := (coalesce .Values.bpf.ctAnyMax $defaultBpfCtAnyMax) -}} {{- $stringValueKPR := (toString .Values.kubeProxyReplacement) -}} @@ -255,14 +258,6 @@ data: operator-prometheus-serve-addr: ":{{ .Values.operator.prometheus.port }}" enable-metrics: "true" {{- end }} -{{- if and .Values.operator.prometheus.enabled .Values.operator.prometheus.tls.enabled }} - operator-prometheus-enable-tls: "true" - operator-prometheus-tls-cert-file: /var/lib/cilium/tls/prometheus/server.crt - operator-prometheus-tls-key-file: /var/lib/cilium/tls/prometheus/server.key - {{- if .Values.operator.prometheus.tls.server.mtls.enabled }} - operator-prometheus-tls-client-ca-files: /var/lib/cilium/tls/prometheus/client-ca.crt - {{- end }} -{{- end }} {{- if .Values.operator.skipCRDCreation }} skip-crd-creation: "true" @@ -461,12 +456,6 @@ data: # policy map (per endpoint) bpf-policy-map-max: "{{ .Values.bpf.policyMapMax | int }}" {{- end }} -{{- if has (kindOf .Values.bpf.policyMapPressureMetricsThreshold) (list "int64" "float64") }} - bpf-policy-map-pressure-metrics-threshold: {{ .Values.bpf.policyMapPressureMetricsThreshold | quote }} -{{- end }} -{{- if .Values.endpointPolicyUpdateTimeoutDuration }} - endpoint-policy-update-timeout: {{ .Values.endpointPolicyUpdateTimeoutDuration | quote }} -{{- end }} {{- if hasKey .Values.bpf "policyStatsMapMax" }} # bpf-policy-stats-map-max specifies the maximum number of entries in global # policy stats map @@ -516,7 +505,7 @@ data: cluster-name: {{ .Values.cluster.name | quote }} {{- if hasKey .Values.cluster "id" }} - # Unique ID of the cluster. Must be unique across all connected clusters and + # Unique ID of the cluster. Must be unique across all conneted clusters and # in the range of 1 and 255. Only relevant when building a mesh of clusters. cluster-id: "{{ .Values.cluster.id }}" {{- end }} @@ -537,7 +526,7 @@ data: {{- end }} {{- end }} - routing-mode: {{ .Values.routingMode | default (ternary "native" "tunnel" (or .Values.eni.enabled .Values.gke.enabled)) | quote }} + routing-mode: {{ .Values.routingMode | default (ternary "native" "tunnel" .Values.gke.enabled) | quote }} tunnel-protocol: {{ .Values.tunnelProtocol | default "vxlan" | quote }} {{- if eq .Values.routingMode "native" }} @@ -569,10 +558,6 @@ data: service-no-backend-response: "{{ .Values.serviceNoBackendResponse }}" {{- end}} -{{- if .Values.policyDenyResponse }} - policy-deny-response: "{{ .Values.policyDenyResponse }}" -{{- end}} - {{- if .Values.MTU }} mtu: {{ .Values.MTU | quote }} {{- end }} @@ -590,35 +575,6 @@ data: {{- end }} ec2-api-endpoint: {{ .Values.eni.ec2APIEndpoint | quote }} eni-tags: {{ .Values.eni.eniTags | toRawJson | quote }} -{{- if .Values.eni.nodeSpec }} - {{- if ne .Values.eni.nodeSpec.firstInterfaceIndex nil }} - eni-first-interface-index: {{ .Values.eni.nodeSpec.firstInterfaceIndex | quote }} - {{- end }} - {{- if .Values.eni.nodeSpec.subnetIDs }} - eni-subnet-ids: {{ .Values.eni.nodeSpec.subnetIDs | join "," | quote }} - {{- end }} - {{- if .Values.eni.nodeSpec.subnetTags }} - eni-subnet-tags: {{ .Values.eni.nodeSpec.subnetTags | join "," | quote }} - {{- end }} - {{- if .Values.eni.nodeSpec.securityGroups }} - eni-security-groups: {{ .Values.eni.nodeSpec.securityGroups | join "," | quote }} - {{- end }} - {{- if .Values.eni.nodeSpec.securityGroupTags }} - eni-security-group-tags: {{ .Values.eni.nodeSpec.securityGroupTags | join "," | quote }} - {{- end }} - {{- if .Values.eni.nodeSpec.excludeInterfaceTags }} - eni-exclude-interface-tags: {{ .Values.eni.nodeSpec.excludeInterfaceTags | join "," | quote }} - {{- end }} - {{- if .Values.eni.nodeSpec.usePrimaryAddress }} - eni-use-primary-address: "true" - {{- end }} - {{- if .Values.eni.nodeSpec.disablePrefixDelegation }} - eni-disable-prefix-delegation: "true" - {{- end }} - {{- if ne .Values.eni.nodeSpec.deleteOnTermination nil }} - eni-delete-on-termination: {{ .Values.eni.nodeSpec.deleteOnTermination | quote }} - {{- end }} -{{- end }} {{- if .Values.eni.subnetIDsFilter }} subnet-ids-filter: {{ .Values.eni.subnetIDsFilter | join " " | quote }} {{- end }} @@ -644,39 +600,17 @@ data: {{- end }} azure-use-primary-address: {{ $azureUsePrimaryAddress | quote }} {{- end }} -{{- if .Values.azure.nodeSpec.azureInterfaceName }} - azure-interface-name: {{ .Values.azure.nodeSpec.azureInterfaceName | quote }} -{{- end }} {{- if .Values.alibabacloud.enabled }} enable-endpoint-routes: "true" auto-create-cilium-node-resource: "true" {{- end }} -{{- if .Values.alibabacloud.nodeSpec.vSwitches }} - alibabacloud-vswitches: {{ .Values.alibabacloud.nodeSpec.vSwitches | join "," | quote }} -{{- end }} -{{- if .Values.alibabacloud.nodeSpec.vSwitchTags }} - alibabacloud-vswitch-tags: {{ .Values.alibabacloud.nodeSpec.vSwitchTags | join "," | quote }} -{{- end }} -{{- if .Values.alibabacloud.nodeSpec.securityGroups }} - alibabacloud-security-groups: {{ .Values.alibabacloud.nodeSpec.securityGroups | join "," | quote }} -{{- end }} -{{- if .Values.alibabacloud.nodeSpec.securityGroupTags }} - alibabacloud-security-group-tags: {{ .Values.alibabacloud.nodeSpec.securityGroupTags | join "," | quote }} -{{- end }} {{- if hasKey .Values "l7Proxy" }} # Enables L7 proxy for L7 policy enforcement and visibility enable-l7-proxy: {{ .Values.l7Proxy | quote }} {{- end }} -{{- if hasKey .Values "standaloneDnsProxy" }} - {{- if .Values.standaloneDnsProxy.enabled }} - enable-standalone-dns-proxy: {{ .Values.standaloneDnsProxy.enabled | quote }} - standalone-dns-proxy-server-port: {{ .Values.standaloneDnsProxy.serverPort | quote }} - {{- end }} -{{- end }} - {{- if ne $cniChainingMode "none" }} # Enable chaining with another CNI plugin # @@ -753,8 +687,6 @@ data: {{- if .Values.encryption.wireguard.persistentKeepalive }} wireguard-persistent-keepalive: {{ .Values.encryption.wireguard.persistentKeepalive | quote }} {{- end }} - {{- else if eq .Values.encryption.type "ztunnel" }} - enable-ztunnel: {{ .Values.encryption.enabled | quote }} {{- end }} {{- if .Values.encryption.nodeEncryption }} encrypt-node: {{ .Values.encryption.nodeEncryption | quote }} @@ -762,20 +694,11 @@ data: {{- end }} {{- if .Values.encryption.strictMode.enabled }} - # --- DEPRECATED: Please use encryption.strictMode.egress.enabled instead - enable-encryption-strict-mode-egress: {{ .Values.encryption.strictMode.enabled | quote }} - encryption-strict-egress-cidr: {{ .Values.encryption.strictMode.cidr | quote }} - encryption-strict-egress-allow-remote-node-identities: {{ .Values.encryption.strictMode.allowRemoteNodeIdentities | quote }} -{{- end }} + enable-encryption-strict-mode: {{ .Values.encryption.strictMode.enabled | quote }} -{{- if .Values.encryption.strictMode.ingress.enabled }} - enable-encryption-strict-mode-ingress: {{ .Values.encryption.strictMode.ingress.enabled | quote }} -{{- end }} + encryption-strict-mode-cidr: {{ .Values.encryption.strictMode.cidr | quote }} -{{- if .Values.encryption.strictMode.egress.enabled }} - enable-encryption-strict-mode-egress: {{ .Values.encryption.strictMode.egress.enabled | quote }} - encryption-strict-egress-cidr: {{ .Values.encryption.strictMode.egress.cidr | quote }} - encryption-strict-egress-allow-remote-node-identities: {{ .Values.encryption.strictMode.egress.allowRemoteNodeIdentities | quote }} + encryption-strict-mode-allow-remote-node-identities: {{ .Values.encryption.strictMode.allowRemoteNodeIdentities | quote }} {{- end }} enable-xt-socket-fallback: {{ .Values.enableXTSocketFallback | quote }} @@ -850,10 +773,6 @@ data: kube-proxy-replacement-healthz-bind-address: {{ default "" .Values.kubeProxyReplacementHealthzBindAddr | quote}} {{- end }} -{{- if hasKey .Values "enableNoServiceEndpointsRoutable" }} - enable-no-service-endpoints-routable: {{ .Values.enableNoServiceEndpointsRoutable | quote }} -{{- end }} - {{- if $socketLB }} {{- if hasKey $socketLB "enabled" }} bpf-lb-sock: {{ $socketLB.enabled | quote }} @@ -870,6 +789,9 @@ data: {{- end }} {{- if hasKey .Values "nodePort" }} +{{- if eq $kubeProxyReplacement "false" }} + enable-node-port: {{ .Values.nodePort.enabled | quote }} +{{- end }} {{- if hasKey .Values.nodePort "range" }} node-port-range: {{ get .Values.nodePort "range" | quote }} {{- end }} @@ -908,18 +830,24 @@ data: {{- end }} {{- if hasKey .Values.loadBalancer "serviceTopology" }} enable-service-topology: {{ .Values.loadBalancer.serviceTopology | quote }} -{{- end }} +# {{- end }} + +{{- if hasKey .Values.loadBalancer "protocolDifferentiation" }} + bpf-lb-proto-diff: {{ .Values.loadBalancer.protocolDifferentiation.enabled | quote }} {{- end }} +{{- end }} {{- if hasKey .Values.maglev "tableSize" }} bpf-lb-maglev-table-size: {{ .Values.maglev.tableSize | quote}} {{- end }} {{- if hasKey .Values.maglev "hashSeed" }} bpf-lb-maglev-hash-seed: {{ .Values.maglev.hashSeed | quote}} {{- end }} - -{{- if .Values.bpf.monitorTraceIPOption }} - ip-tracing-option-type: {{ .Values.bpf.monitorTraceIPOption | quote }} +{{- if .Values.sessionAffinity }} + enable-session-affinity: {{ .Values.sessionAffinity | quote }} +{{- end }} +{{- if .Values.svcSourceRangeCheck }} + enable-svc-source-range-check: {{ .Values.svcSourceRangeCheck | quote }} {{- end }} {{- if hasKey .Values "l2NeighDiscovery" }} @@ -932,16 +860,12 @@ data: pprof: {{ .Values.pprof.enabled | quote }} pprof-address: {{ .Values.pprof.address | quote }} pprof-port: {{ .Values.pprof.port | quote }} - pprof-mutex-profile-fraction: {{ .Values.pprof.mutexProfileFraction | quote }} - pprof-block-profile-rate: {{ .Values.pprof.blockProfileRate | quote }} {{- end }} {{- if .Values.operator.pprof.enabled }} operator-pprof: {{ .Values.operator.pprof.enabled | quote }} operator-pprof-address: {{ .Values.operator.pprof.address | quote }} operator-pprof-port: {{ .Values.operator.pprof.port | quote }} - operator-pprof-mutex-profile-fraction: {{ .Values.operator.pprof.mutexProfileFraction | quote }} - operator-pprof-block-profile-rate: {{ .Values.operator.pprof.blockProfileRate | quote }} {{- end }} {{- if .Values.logSystemLoad }} @@ -1049,10 +973,6 @@ data: # Capacity of the buffer to store recent events. hubble-event-buffer-capacity: {{ .Values.hubble.eventBufferCapacity | quote }} {{- end }} -{{- if hasKey .Values.hubble "lostEventSendInterval" }} - # Interval to send lost events from Observer server. - hubble-lost-event-send-interval: {{ include "validateDuration" .Values.hubble.lostEventSendInterval | quote }} -{{- end }} {{- if or .Values.hubble.metrics.enabled .Values.hubble.metrics.dynamic.enabled}} # Address to expose Hubble metrics (e.g. ":7070"). Metrics server will be disabled if this # field is not set. @@ -1120,10 +1040,8 @@ data: hubble-export-file-max-size-mb: {{ .Values.hubble.export.fileMaxSizeMb | default .Values.hubble.export.static.fileMaxSizeMb | quote }} hubble-export-file-max-backups: {{ .Values.hubble.export.fileMaxBackups | default .Values.hubble.export.static.fileMaxBackups | quote }} hubble-export-file-compress: {{ .Values.hubble.export.fileCompress | default .Values.hubble.export.static.fileCompress | quote }} - hubble-export-aggregation-interval: {{ include "validateDuration" .Values.hubble.export.aggregationInterval | default .Values.hubble.export.static.aggregationInterval | quote }} hubble-export-file-path: {{ .Values.hubble.export.static.filePath | quote }} hubble-export-fieldmask: {{ .Values.hubble.export.static.fieldMask | join " " | quote }} - hubble-export-fieldaggregate: {{ .Values.hubble.export.static.fieldAggregate | join " " | quote }} hubble-export-allowlist: {{ .Values.hubble.export.static.allowList | join " " | quote }} hubble-export-denylist: {{ .Values.hubble.export.static.denyList | join " " | quote }} {{- end }} @@ -1160,28 +1078,10 @@ data: disable-iptables-feeder-rules: {{ .Values.disableIptablesFeederRules | join " " | quote }} {{- end }} {{- if .Values.aksbyocni.enabled }} - {{- if or (not .Values.ipam.mode) (eq .Values.ipam.mode "cluster-pool") }} ipam: "cluster-pool" - {{- else if eq .Values.ipam.mode "multi-pool" }} - ipam: "multi-pool" - {{- end }} {{- else }} ipam: {{ $ipam | quote }} {{- end }} -{{- if .Values.ipam.nodeSpec }} - {{- if ne .Values.ipam.nodeSpec.ipamMinAllocate nil }} - ipam-min-allocate: {{ .Values.ipam.nodeSpec.ipamMinAllocate | quote }} - {{- end }} - {{- if ne .Values.ipam.nodeSpec.ipamPreAllocate nil }} - ipam-pre-allocate: {{ .Values.ipam.nodeSpec.ipamPreAllocate | quote }} - {{- end }} - {{- if ne .Values.ipam.nodeSpec.ipamMaxAllocate nil }} - ipam-max-allocate: {{ .Values.ipam.nodeSpec.ipamMaxAllocate | quote }} - {{- end }} - {{- if .Values.ipam.nodeSpec.ipamStaticIPTags }} - ipam-static-ip-tags: {{ .Values.ipam.nodeSpec.ipamStaticIPTags | join "," | quote }} - {{- end }} -{{- end }} {{- if .Values.ipam.multiPoolPreAllocation }} ipam-multi-pool-pre-allocation: {{ .Values.ipam.multiPoolPreAllocation | quote }} {{- end }} @@ -1192,10 +1092,18 @@ data: {{- if (eq $ipam "cluster-pool") }} {{- if .Values.ipv4.enabled }} + {{- if hasKey .Values.ipam.operator "clusterPoolIPv4PodCIDR" }} + {{- /* ipam.operator.clusterPoolIPv4PodCIDR removed in v1.14, remove this failsafe around v1.17 */ -}} + {{- fail "Value ipam.operator.clusterPoolIPv4PodCIDR removed, use ipam.operator.clusterPoolIPv4PodCIDRList instead" }} + {{- end }} cluster-pool-ipv4-cidr: {{ .Values.ipam.operator.clusterPoolIPv4PodCIDRList | join " " | quote }} cluster-pool-ipv4-mask-size: {{ .Values.ipam.operator.clusterPoolIPv4MaskSize | quote }} {{- end }} {{- if .Values.ipv6.enabled }} + {{- if hasKey .Values.ipam.operator "clusterPoolIPv6PodCIDR" }} + {{- /* ipam.operator.clusterPoolIPv6PodCIDR removed in v1.14, remove this failsafe around v1.17 */ -}} + {{- fail "Value ipam.operator.clusterPoolIPv6PodCIDR removed, use ipam.operator.clusterPoolIPv6PodCIDRList instead" }} + {{- end }} cluster-pool-ipv6-cidr: {{ .Values.ipam.operator.clusterPoolIPv6PodCIDRList | join " " | quote }} cluster-pool-ipv6-mask-size: {{ .Values.ipam.operator.clusterPoolIPv6MaskSize | quote }} {{- end }} @@ -1264,11 +1172,20 @@ data: crd-wait-timeout: {{ include "validateDuration" .Values.crdWaitTimeout | quote }} {{- end }} +{{- if .Values.enableK8sEndpointSlice }} + enable-k8s-endpoint-slice: {{ .Values.enableK8sEndpointSlice | quote }} +{{- end }} + {{- if hasKey .Values.k8s "serviceProxyName" }} # Configure service proxy name for Cilium. k8s-service-proxy-name: {{ .Values.k8s.serviceProxyName | quote }} {{- end }} +{{- if and .Values.customCalls .Values.customCalls.enabled }} + # Enable tail call hooks for custom eBPF programs. + enable-custom-calls: {{ .Values.customCalls.enabled | quote }} +{{- end }} + {{- if .Values.l2announcements.enabled }} # Enable L2 announcements enable-l2-announcements: {{ .Values.l2announcements.enabled | quote }} @@ -1305,8 +1222,6 @@ data: enable-pmtu-discovery: "true" {{- end }} - packetization-layer-pmtud-mode: {{ .Values.pmtuDiscovery.packetizationLayerPMTUDMode | quote }} - {{- if not .Values.securityContext.privileged }} procfs: "/host/proc" {{- end }} @@ -1381,16 +1296,11 @@ data: {{- end }} {{- if .Values.operator.unmanagedPodWatcher.restart }} - {{- $interval := .Values.operator.unmanagedPodWatcher.intervalSeconds }} - unmanaged-pod-watcher-interval: {{ printf "%ds" (int $interval) | quote }} + unmanaged-pod-watcher-interval: {{ .Values.operator.unmanagedPodWatcher.intervalSeconds | quote }} {{- else }} unmanaged-pod-watcher-interval: "0" {{- end }} -{{- if ne .Values.operator.unmanagedPodWatcher.selector nil }} - pod-restart-selector: {{ .Values.operator.unmanagedPodWatcher.selector }} -{{- end }} - {{- if .Values.dnsProxy }} {{- if hasKey .Values.dnsProxy "enableTransparentMode" }} # explicit setting gets precedence @@ -1460,14 +1370,10 @@ data: proxy-xff-num-trusted-hops-egress: {{ .Values.envoy.xffNumTrustedHopsL7PolicyEgress | quote }} proxy-connect-timeout: {{ .Values.envoy.connectTimeoutSeconds | quote }} proxy-initial-fetch-timeout: {{ .Values.envoy.initialFetchTimeoutSeconds | quote }} - proxy-max-active-downstream-connections: {{ .Values.envoy.maxGlobalDownstreamConnections | quote }} proxy-max-requests-per-connection: {{ .Values.envoy.maxRequestsPerConnection | quote }} proxy-max-connection-duration-seconds: {{ .Values.envoy.maxConnectionDurationSeconds | quote }} proxy-idle-timeout-seconds: {{ .Values.envoy.idleTimeoutDurationSeconds | quote }} proxy-max-concurrent-retries: {{ .Values.envoy.maxConcurrentRetries | quote }} - proxy-use-original-source-address: {{ .Values.envoy.useOriginalSourceAddress | quote }} - proxy-cluster-max-connections: {{ .Values.envoy.clusterMaxConnections | quote }} - proxy-cluster-max-requests: {{ .Values.envoy.clusterMaxRequests | quote }} http-retry-count: {{ .Values.envoy.httpRetryCount | quote }} http-stream-idle-timeout: {{ .Values.envoy.streamIdleTimeoutDurationSeconds | quote }} @@ -1496,14 +1402,13 @@ data: {{- if hasKey .Values.clustermesh "maxConnectedClusters" }} max-connected-clusters: {{ .Values.clustermesh.maxConnectedClusters | quote }} {{- end }} - clustermesh-cache-ttl: {{ .Values.clustermesh.cacheTTL | quote }} clustermesh-enable-endpoint-sync: {{ .Values.clustermesh.enableEndpointSliceSynchronization | quote }} - clustermesh-enable-mcs-api: {{ (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) | quote }} - clustermesh-mcs-api-install-crds: {{ .Values.clustermesh.mcsapi.installCRDs | quote }} + clustermesh-enable-mcs-api: {{ .Values.clustermesh.enableMCSAPISupport | quote }} policy-default-local-cluster: {{ .Values.clustermesh.policyDefaultLocalCluster | quote }} nat-map-stats-entries: {{ .Values.nat.mapStatsEntries | quote }} nat-map-stats-interval: {{ .Values.nat.mapStatsInterval | quote }} + enable-internal-traffic-policy: {{ .Values.enableInternalTrafficPolicy | quote }} enable-lb-ipam: {{ .Values.enableLBIPAM | quote }} enable-non-default-deny-policies: {{ .Values.enableNonDefaultDenyPolicies | quote }} @@ -1515,14 +1420,6 @@ data: connectivity-probe-frequency-ratio: {{ .Values.connectivityProbeFrequencyRatio | quote }} {{- end }} -{{- if hasKey .Values "configDriftDetection" }} - enable-dynamic-config: {{ .Values.configDriftDetection.enabled | quote }} - enable-drift-checker: {{ .Values.configDriftDetection.driftChecker | quote }} - {{- if .Values.configDriftDetection.ignoredKeys }} - ignore-flags-drift-checker: {{ join "," .Values.configDriftDetection.ignoredKeys | quote }} - {{- end }} -{{- end }} - # Extra config allows adding arbitrary properties to the cilium config. # By putting it at the end of the ConfigMap, it's also possible to override existing properties. {{- if .Values.extraConfig }} diff --git a/packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml index 2afc2e97..a5decd02 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml @@ -22,7 +22,10 @@ spec: selector: matchLabels: k8s-app: cilium-envoy - {{- include "envoy.updateStrategy" . | nindent 2 }} + {{- with .Values.envoy.updateStrategy }} + updateStrategy: + {{- toYaml . | trim | nindent 4 }} + {{- end }} template: metadata: annotations: @@ -66,7 +69,6 @@ spec: securityContext: {{- toYaml . | nindent 8 }} {{- end }} - {{- include "envoy.initContainers" . | nindent 6 }} containers: - name: cilium-envoy image: {{ include "cilium.image" .Values.envoy.image | quote }} @@ -92,7 +94,6 @@ spec: {{- if .Values.envoy.log.path }} - '--log-path {{ .Values.envoy.log.path }}' {{- end }} - {{- include "envoy.args.extra" . | nindent 8 }} {{- with .Values.envoy.extraArgs }} {{- toYaml . | trim | nindent 8 }} {{- end }} @@ -156,7 +157,6 @@ spec: - name: KUBERNETES_SERVICE_PORT value: {{ include "k8sServicePort" . }} {{- end }} - {{- include "envoy.env.extra" . | nindent 8 }} {{- with .Values.envoy.extraEnv }} {{- toYaml . | trim | nindent 8 }} {{- end }} @@ -164,7 +164,19 @@ spec: resources: {{- toYaml . | trim | nindent 10 }} {{- end }} - {{- include "envoy.ports" . }} + {{- if .Values.envoy.prometheus.enabled }} + ports: + - name: envoy-metrics + containerPort: {{ .Values.envoy.prometheus.port }} + hostPort: {{ .Values.envoy.prometheus.port }} + protocol: TCP + {{- if and .Values.envoy.debug.admin.enabled .Values.envoy.debug.admin.port }} + - name: envoy-admin + containerPort: {{ .Values.envoy.debug.admin.port }} + hostPort: {{ .Values.envoy.debug.admin.port }} + protocol: TCP + {{- end }} + {{- end }} securityContext: {{- if .Values.envoy.securityContext.privileged }} privileged: true @@ -197,7 +209,6 @@ spec: mountPath: /sys/fs/bpf mountPropagation: HostToContainer {{- end }} - {{- include "envoy.volumeMounts.extra" . | nindent 8 }} {{- range .Values.envoy.extraHostPathMounts }} - name: {{ .name }} mountPath: {{ .mountPath }} @@ -221,7 +232,10 @@ spec: {{- if .Values.envoy.dnsPolicy }} dnsPolicy: {{ .Values.envoy.dnsPolicy }} {{- end }} - {{- include "envoy.affinity" . | nindent 6 }} + {{- with .Values.envoy.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} {{- with .Values.envoy.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -255,7 +269,6 @@ spec: path: /sys/fs/bpf type: DirectoryOrCreate {{- end }} - {{- include "envoy.hostPathMounts.extra" . | nindent 4 }} {{- range .Values.envoy.extraHostPathMounts }} - name: {{ .name }} hostPath: diff --git a/packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml b/packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml index 8da47943..6b982c28 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml @@ -32,5 +32,5 @@ spec: - name: envoy-metrics port: {{ .Values.envoy.prometheus.port }} protocol: TCP - targetPort: {{ .Values.envoy.prometheus.port }} + targetPort: envoy-metrics {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/cilium-ingress-service.yaml b/packages/system/cilium/charts/cilium/templates/cilium-ingress-service.yaml index f25afeee..5d16d7ca 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-ingress-service.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-ingress-service.yaml @@ -49,8 +49,8 @@ spec: externalTrafficPolicy: {{ .Values.ingressController.service.externalTrafficPolicy }} {{- end }} --- -apiVersion: discovery.k8s.io/v1 -kind: EndpointSlice +apiVersion: v1 +kind: Endpoints metadata: name: {{ .Values.ingressController.service.name }} namespace: {{ include "cilium.namespace" . }} @@ -65,10 +65,9 @@ metadata: annotations: {{- toYaml .Values.ingressController.service.annotations | nindent 4 }} {{- end }} -addressType: IPv4 -endpoints: +subsets: - addresses: - - "192.192.192.192" -ports: -- port: 9999 + - ip: "192.192.192.192" + ports: + - port: 9999 {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/cilium-nodeinit/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-nodeinit/daemonset.yaml index 4edbeada..add6ae5a 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-nodeinit/daemonset.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-nodeinit/daemonset.yaml @@ -122,8 +122,6 @@ spec: {{- if .Values.serviceAccounts.nodeinit.enabled }} serviceAccountName: {{ .Values.serviceAccounts.nodeinit.name | quote }} automountServiceAccountToken: {{ .Values.serviceAccounts.nodeinit.automount }} - {{- else }} - automountServiceAccountToken: false {{- end }} {{- with .Values.nodeinit.extraVolumes }} volumes: diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml index c147e2b5..4fcb5985 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml @@ -69,7 +69,7 @@ rules: resources: - endpointslices verbs: -{{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }} +{{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }} - create - update - delete @@ -78,17 +78,6 @@ rules: - get - list - watch -{{- if .Values.clustermesh.enableEndpointSliceSynchronization }} -- apiGroups: - - "" - resources: - # The controller needs to be able to set a service's finalizers to be able to create an EndpointSlice - # resource that is owned by the service and sets blockOwnerDeletion=true in its ownerRef. - # This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated. - - services/finalizers - verbs: - - update -{{- end }} - apiGroups: - "" resources: @@ -125,20 +114,6 @@ rules: - delete - patch {{- end }} -{{- if or .Values.ingressController.enabled .Values.gatewayAPI.enabled }} -- apiGroups: - - "discovery.k8s.io" - resources: - - endpointslices - verbs: - - get - - list - - watch - - create - - update - - delete - - patch -{{- end }} {{- if .Values.clustermesh.enableEndpointSliceSynchronization }} - apiGroups: - "" @@ -252,6 +227,7 @@ rules: - update resourceNames: - ciliumloadbalancerippools.cilium.io + - ciliumbgppeeringpolicies.cilium.io - ciliumbgpclusterconfigs.cilium.io - ciliumbgppeerconfigs.cilium.io - ciliumbgpadvertisements.cilium.io @@ -272,15 +248,12 @@ rules: - ciliuml2announcementpolicies.cilium.io - ciliumpodippools.cilium.io - ciliumgatewayclassconfigs.cilium.io -{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.installCRDs }} - - serviceimports.multicluster.x-k8s.io - - serviceexports.multicluster.x-k8s.io -{{- end }} - apiGroups: - cilium.io resources: - ciliumloadbalancerippools - ciliumpodippools + - ciliumbgppeeringpolicies - ciliumbgpclusterconfigs - ciliumbgpnodeconfigoverrides - ciliumbgppeerconfigs @@ -328,10 +301,6 @@ rules: - networking.k8s.io resources: - ingresses/status # To update ingress status with load balancer IP. - # The controller needs to be able to set ingress finalizers to be able to create a CiliumEnvoyConfig - # resource that is owned by the ingress, and set blockOwnerDeletion=true in its ownerRef. - # This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated. - - ingresses/finalizers verbs: - update {{- end }} @@ -383,7 +352,7 @@ rules: - update - patch {{- end }} -{{- if or .Values.gatewayAPI.enabled .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }} +{{- if or .Values.gatewayAPI.enabled .Values.clustermesh.enableMCSAPISupport }} - apiGroups: - multicluster.x-k8s.io resources: @@ -392,14 +361,14 @@ rules: - get - list - watch -{{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }} +{{- if .Values.clustermesh.enableMCSAPISupport }} - create - update - patch - delete {{- end }} {{- end }} -{{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }} +{{- if .Values.clustermesh.enableMCSAPISupport }} - apiGroups: - multicluster.x-k8s.io resources: @@ -407,15 +376,6 @@ rules: verbs: - update - patch -- apiGroups: - - multicluster.x-k8s.io - resources: - # The controller needs to be able to set serviceimport finalizers to be able to create a derived Service - # resource that is owned by the ServiceImport and sets blockOwnerDeletion=true in its ownerRef. - # This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated. - - serviceimports/finalizers - verbs: - - update - apiGroups: - multicluster.x-k8s.io resources: @@ -441,10 +401,4 @@ rules: - patch - delete {{- end }} -- apiGroups: - - cilium.io - resources: - - ciliumendpointslices - verbs: - - deletecollection {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml index f4cddff8..606807f3 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml @@ -98,7 +98,7 @@ spec: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }} + {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }} - name: CILIUM_CLUSTERMESH_CONFIG value: /var/lib/cilium/clustermesh/ {{- end }} @@ -170,7 +170,6 @@ spec: - name: AZURE_RESOURCE_GROUP value: {{ .Values.azure.resourceGroup }} {{- end }} - {{- if .Values.azure.clientID }} - name: AZURE_CLIENT_ID valueFrom: secretKeyRef: @@ -182,15 +181,11 @@ spec: name: cilium-azure key: AZURE_CLIENT_SECRET {{- end }} - {{- end }} {{- with .Values.operator.extraEnv }} {{- toYaml . | nindent 8 }} {{- end }} - ports: - - name: health - containerPort: 9234 - hostPort: 9234 {{- if .Values.operator.prometheus.enabled }} + ports: - name: prometheus containerPort: {{ .Values.operator.prometheus.port }} {{- if .Values.operator.hostNetwork }} @@ -204,7 +199,7 @@ spec: host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }} {{- end }} path: /healthz - port: health + port: 9234 scheme: HTTP initialDelaySeconds: 60 periodSeconds: 10 @@ -215,7 +210,7 @@ spec: host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }} {{- end }} path: /healthz - port: health + port: 9234 scheme: HTTP initialDelaySeconds: 0 periodSeconds: 5 @@ -235,7 +230,7 @@ spec: readOnly: true {{- end }} {{- end }} - {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }} + {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }} - name: clustermesh-secrets mountPath: /var/lib/cilium/clustermesh readOnly: true @@ -250,11 +245,6 @@ spec: mountPath: {{ dir .Values.authentication.mutual.spire.agentSocketPath }} readOnly: true {{- end }} - {{- if and .Values.operator.prometheus.enabled .Values.operator.prometheus.tls.enabled }} - - name: prometheus-tls - mountPath: /var/lib/cilium/tls/prometheus - readOnly: true - {{- end }} {{- range .Values.operator.extraHostPathMounts }} - name: {{ .name }} mountPath: {{ .mountPath }} @@ -266,15 +256,13 @@ spec: {{- with .Values.operator.extraVolumeMounts }} {{- toYaml . | nindent 8 }} {{- end }} - {{- include "cilium-operator.volumeMounts.extra" . | nindent 8 }} {{- with .Values.operator.resources }} resources: {{- toYaml . | trim | nindent 10 }} {{- end }} - {{- $sc := include "cilium.operator.securityContext" . | trim }} - {{- if $sc }} + {{- with .Values.operator.securityContext }} securityContext: - {{- $sc | nindent 10 }} + {{- toYaml . | trim | nindent 10 }} {{- end }} terminationMessagePolicy: FallbackToLogsOnError hostNetwork: {{ .Values.operator.hostNetwork }} @@ -307,25 +295,23 @@ spec: nodeSelector: {{- toYaml . | trim | nindent 8 }} {{- end }} - {{- if and (or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.config.enabled (not (and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled )) }} + {{- if and (or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.config.enabled (not (and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled )) }} hostAliases: - {{- range $_, $cluster := (include "clustermesh-clusters" . | fromJson) }} + {{- range $cluster := .Values.clustermesh.config.clusters }} {{- range $ip := $cluster.ips }} - ip: {{ $ip }} hostnames: [ "{{ $cluster.name }}.{{ $.Values.clustermesh.config.domain }}" ] {{- end }} {{- end }} {{- end }} - {{- if or (.Values.operator.tolerations) (hasKey .Values "agentNotReadyTaintKey") }} - tolerations: {{- with .Values.operator.tolerations }} + tolerations: {{- toYaml . | trim | nindent 8 }} {{- end }} {{- if hasKey .Values "agentNotReadyTaintKey" }} - key: {{ .Values.agentNotReadyTaintKey }} operator: Exists {{ end}} - {{- end}} volumes: # To read the configuration from the config map - name: cilium-config-path @@ -374,7 +360,7 @@ spec: {{- with .Values.operator.extraVolumes }} {{- toYaml . | nindent 6 }} {{- end }} - {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }} + {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }} # To read the clustermesh configuration - name: clustermesh-secrets projected: @@ -431,25 +417,4 @@ spec: path: local-etcd-client-ca.crt {{- end }} {{- end }} - {{- if and .Values.operator.prometheus.enabled .Values.operator.prometheus.tls.enabled }} - # To read the prometheus configuration - - name: prometheus-tls - projected: - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - sources: - - secret: - name: {{ .Values.operator.prometheus.tls.server.existingSecret }} - optional: true - items: - - key: tls.crt - path: server.crt - - key: tls.key - path: server.key - {{- if .Values.operator.prometheus.tls.server.mtls.enabled }} - - key: ca.crt - path: client-ca.crt - {{- end }} - {{- end }} - {{- include "cilium-operator.volumes.extra" . | nindent 6 }} {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/role.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/role.yaml index 11515ced..8f7acd9f 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-operator/role.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/role.yaml @@ -83,35 +83,3 @@ rules: - update - patch {{- end }} - -{{- if and .Values.operator.enabled .Values.serviceAccounts.operator.create }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cilium-operator-ztunnel - namespace: {{ include "cilium.namespace" . }} - {{- with .Values.operator.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} - labels: - app.kubernetes.io/part-of: cilium - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} -rules: -# ZTunnel DaemonSet management permissions -# Note: These permissions must always be granted (not conditional on encryption.type) -# because the controller needs to clean up stale DaemonSets when ztunnel is disabled. -- apiGroups: - - apps - resources: - - daemonsets - verbs: - - create - - delete - - get - - list - - watch -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml index 22ac17bc..56b89209 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml @@ -77,29 +77,3 @@ subjects: name: {{ .Values.serviceAccounts.operator.name | quote }} namespace: {{ include "cilium.namespace" . }} {{- end }} - -{{- if and .Values.operator.enabled .Values.serviceAccounts.operator.create }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cilium-operator-ztunnel - namespace: {{ include "cilium.namespace" . }} - labels: - app.kubernetes.io/part-of: cilium - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.operator.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-operator-ztunnel -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccounts.operator.name | quote }} - namespace: {{ include "cilium.namespace" . }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/cilium-operator/secret.yaml b/packages/system/cilium/charts/cilium/templates/cilium-operator/secret.yaml index 6346e136..4ac55d7a 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-operator/secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-operator/secret.yaml @@ -1,6 +1,5 @@ {{- if .Values.operator.enabled }} {{- if .Values.azure.enabled }} -{{- if .Values.azure.clientID }} apiVersion: v1 kind: Secret metadata: @@ -20,4 +19,3 @@ data: AZURE_CLIENT_SECRET: {{ default "" .Values.azure.clientSecret | b64enc | quote }} {{- end }} {{- end }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/cilium-preflight/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/cilium-preflight/clusterrole.yaml index fbf511cd..bf0f07da 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-preflight/clusterrole.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-preflight/clusterrole.yaml @@ -94,6 +94,7 @@ rules: - cilium.io resources: - ciliumloadbalancerippools + - ciliumbgppeeringpolicies - ciliumbgpnodeconfigs - ciliumbgpadvertisements - ciliumbgppeerconfigs diff --git a/packages/system/cilium/charts/cilium/templates/cilium-secrets-namespace.yaml b/packages/system/cilium/charts/cilium/templates/cilium-secrets-namespace.yaml index 600ccfeb..944b0629 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-secrets-namespace.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-secrets-namespace.yaml @@ -20,9 +20,6 @@ metadata: {{- with $.Values.commonLabels }} {{- toYaml . | nindent 4 }} {{- end }} - {{- with $.Values.secretsNamespaceLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} annotations: {{- with $.Values.secretsNamespaceAnnotations }} {{- toYaml . | nindent 4 }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/clusterrole.yaml index 88288eb8..8565f585 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/clusterrole.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/clusterrole.yaml @@ -50,7 +50,7 @@ rules: - get - list - watch -{{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }} +{{- if .Values.clustermesh.enableMCSAPISupport }} - apiGroups: - multicluster.x-k8s.io resources: diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/deployment.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/deployment.yaml index 1146209a..b0366e3b 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/deployment.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/deployment.yaml @@ -137,7 +137,6 @@ spec: - --advertise-client-urls=https://localhost:2379 - --initial-cluster-token=$(INITIAL_CLUSTER_TOKEN) - --auto-compaction-retention=1 - - --enable-grpc-gateway=false {{- if .Values.clustermesh.apiserver.metrics.etcd.enabled }} - --listen-metrics-urls=http://0.0.0.0:{{ .Values.clustermesh.apiserver.metrics.etcd.port }} - --metrics={{ .Values.clustermesh.apiserver.metrics.etcd.mode }} @@ -209,13 +208,12 @@ spec: - --prometheus-serve-addr=:{{ .Values.clustermesh.apiserver.metrics.port }} - --controller-group-metrics=all {{- end }} - {{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }} + {{- if .Values.clustermesh.enableMCSAPISupport }} - --clustermesh-enable-mcs-api {{- end }} {{- if .Values.ciliumEndpointSlice.enabled }} - --enable-cilium-endpoint-slice {{- end }} - {{- include "clustermesh.apiserver.args.extra" . | nindent 8 }} {{- with .Values.clustermesh.apiserver.extraArgs }} {{- toYaml . | trim | nindent 8 }} {{- end }} @@ -305,14 +303,12 @@ spec: {{- if hasKey .Values.clustermesh "maxConnectedClusters" }} - --max-connected-clusters={{ .Values.clustermesh.maxConnectedClusters }} {{- end }} - - --clustermesh-cache-ttl={{ .Values.clustermesh.cacheTTL }} - --health-port={{ .Values.clustermesh.apiserver.kvstoremesh.healthPort }} {{- if .Values.clustermesh.apiserver.metrics.kvstoremesh.enabled }} - --prometheus-serve-addr=:{{ .Values.clustermesh.apiserver.metrics.kvstoremesh.port }} - --controller-group-metrics=all {{- end }} - --enable-heartbeat={{ eq "true" (include "identityAllocationCRD" .) | ternary "false" "true" }} - {{- include "clustermesh.kvstoremesh.args.extra" . | nindent 8 }} {{- with .Values.clustermesh.apiserver.kvstoremesh.extraArgs }} {{- toYaml . | trim | nindent 8 }} {{- end }} @@ -509,7 +505,7 @@ spec: {{- end }} {{- if and .Values.clustermesh.config.enabled .Values.clustermesh.apiserver.kvstoremesh.enabled }} hostAliases: - {{- range $_, $cluster := (include "clustermesh-clusters" . | fromJson) }} + {{- range $cluster := .Values.clustermesh.config.clusters }} {{- range $ip := $cluster.ips }} - ip: {{ $ip }} hostnames: [ "{{ $cluster.name }}.{{ $.Values.clustermesh.config.domain }}" ] diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/service.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/service.yaml index 5e20234b..6ef3f63f 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/service.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/service.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (not .Values.clustermesh.apiserver.service.externallyCreated) }} +{{- if and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") }} apiVersion: v1 kind: Service metadata: diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/_job-spec.tpl b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/_job-spec.tpl index 2fdccf47..7ba8cb12 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/_job-spec.tpl +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/_job-spec.tpl @@ -9,18 +9,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - securityContext: - seccompProfile: - type: RuntimeDefault containers: - name: certgen image: {{ include "cilium.image" .Values.certgen.image | quote }} imagePullPolicy: {{ .Values.certgen.image.pullPolicy }} - securityContext: - capabilities: - drop: - - ALL - allowPrivilegeEscalation: false {{- with .Values.certgen.resources }} resources: {{- toYaml . | nindent 12 }} @@ -92,7 +84,7 @@ spec: volumeMounts: {{- toYaml . | nindent 10 }} {{- end }} - hostNetwork: false + hostNetwork: true {{- with .Values.certgen.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -104,6 +96,7 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + serviceAccount: {{ .Values.serviceAccounts.clustermeshcertgen.name | quote }} serviceAccountName: {{ .Values.serviceAccounts.clustermeshcertgen.name | quote }} automountServiceAccountToken: {{ .Values.serviceAccounts.clustermeshcertgen.automount }} {{- with .Values.imagePullSecrets }} @@ -115,11 +108,9 @@ spec: volumes: {{- toYaml . | nindent 6 }} {{- end }} - {{- with .Values.certgen.affinity }} affinity: + {{- with .Values.certgen.affinity }} {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.certgen.ttlSecondsAfterFinished }} - ttlSecondsAfterFinished: {{ . }} - {{- end }} + ttlSecondsAfterFinished: {{ .Values.certgen.ttlSecondsAfterFinished }} {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/cronjob.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/cronjob.yaml index 4b88d92c..ebda21bd 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/cronjob.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/cronjob.yaml @@ -16,8 +16,6 @@ metadata: {{- end }} spec: schedule: {{ .Values.clustermesh.apiserver.tls.auto.schedule | quote }} - successfulJobsHistoryLimit: {{ .Values.certgen.cronJob.successfulJobsHistoryLimit }} - failedJobsHistoryLimit: {{ .Values.certgen.cronJob.failedJobsHistoryLimit }} concurrencyPolicy: Forbid jobTemplate: {{- include "clustermesh-apiserver-generate-certs.job.spec" . | nindent 4 }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/job.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/job.yaml index 574aee13..72f8dc60 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/job.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/job.yaml @@ -1,18 +1,9 @@ {{- if and (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal")) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") }} -{{/* -Because Kubernetes job specs are immutable, Helm will fail patch this job if -the spec changes between releases. To avoid breaking the upgrade path, we -generate a name for the job here which is based on the checksum of the spec. -This will cause the name of the job to change if its content changes, -and in turn cause Helm to do delete the old job and replace it with a new one. -*/}} -{{- $jobSpec := include "clustermesh-apiserver-generate-certs.job.spec" . -}} -{{- $checkSum := $jobSpec | sha256sum | trunc 10 -}} --- apiVersion: batch/v1 kind: Job metadata: - name: clustermesh-apiserver-generate-certs-{{$checkSum}} + name: clustermesh-apiserver-generate-certs namespace: {{ include "cilium.namespace" . }} labels: k8s-app: clustermesh-apiserver-generate-certs @@ -20,14 +11,13 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} app.kubernetes.io/part-of: cilium - {{- if or .Values.certgen.annotations.job .Values.clustermesh.annotations }} annotations: + "helm.sh/hook": post-install,post-upgrade {{- with .Values.certgen.annotations.job }} - {{- toYaml . | nindent 4 }} + {{- toYaml . | nindent 4 }} {{- end }} {{- with .Values.clustermesh.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - {{- end }} -{{ $jobSpec }} +{{ include "clustermesh-apiserver-generate-certs.job.spec" . }} {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/role.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/role.yaml index 1f6dc153..6e822701 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/role.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-cronjob/role.yaml @@ -38,6 +38,7 @@ rules: - clustermesh-apiserver-admin-cert - clustermesh-apiserver-remote-cert - clustermesh-apiserver-local-cert + - clustermesh-apiserver-client-cert verbs: - update {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/admin-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/admin-secret.yaml index 49325d14..fa49c9ce 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/admin-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/admin-secret.yaml @@ -8,16 +8,12 @@ kind: Secret metadata: name: clustermesh-apiserver-admin-cert namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} + labels: {{- toYaml . | nindent 4 }} {{- end }} - cilium.io/helm-template-non-idempotent: "true" - annotations: {{- with .Values.clustermesh.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.nonIdempotentAnnotations }} + annotations: {{- toYaml . | nindent 4 }} {{- end }} type: kubernetes.io/tls diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/local-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/local-secret.yaml index 3d34bd68..0589a9e7 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/local-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/local-secret.yaml @@ -8,16 +8,12 @@ kind: Secret metadata: name: clustermesh-apiserver-local-cert namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} + labels: {{- toYaml . | nindent 4 }} {{- end }} - cilium.io/helm-template-non-idempotent: "true" - annotations: {{- with .Values.clustermesh.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.nonIdempotentAnnotations }} + annotations: {{- toYaml . | nindent 4 }} {{- end }} type: kubernetes.io/tls diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/remote-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/remote-secret.yaml index 11bfc51d..42afe0fe 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/remote-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/remote-secret.yaml @@ -8,16 +8,12 @@ kind: Secret metadata: name: clustermesh-apiserver-remote-cert namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} + labels: {{- toYaml . | nindent 4 }} {{- end }} - cilium.io/helm-template-non-idempotent: "true" - annotations: {{- with .Values.clustermesh.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.nonIdempotentAnnotations }} + annotations: {{- toYaml . | nindent 4 }} {{- end }} type: kubernetes.io/tls diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml index 0df9a20d..e49478cb 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml @@ -10,16 +10,12 @@ kind: Secret metadata: name: clustermesh-apiserver-server-cert namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} + labels: {{- toYaml . | nindent 4 }} {{- end }} - cilium.io/helm-template-non-idempotent: "true" - annotations: {{- with .Values.clustermesh.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.nonIdempotentAnnotations }} + annotations: {{- toYaml . | nindent 4 }} {{- end }} type: kubernetes.io/tls diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/users-configmap.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/users-configmap.yaml index d742e4e7..c736eb1e 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/users-configmap.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-apiserver/users-configmap.yaml @@ -1,5 +1,5 @@ {{- if and - (and .Values.clustermesh.useAPIServer .Values.clustermesh.config.enabled (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (eq "true" (include "identityAllocationCRD" .))) + (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (eq "true" (include "identityAllocationCRD" .))) (ne .Values.clustermesh.apiserver.tls.authMode "legacy") }} --- @@ -21,7 +21,7 @@ metadata: data: users.yaml: | users: - {{- range (include "clustermesh-clusters" . | fromJson) }} + {{- range .Values.clustermesh.config.clusters }} - name: remote-{{ .name }} role: remote {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-config/_helpers.tpl b/packages/system/cilium/charts/cilium/templates/clustermesh-config/_helpers.tpl index abe9bdb8..47c3393c 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-config/_helpers.tpl +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-config/_helpers.tpl @@ -43,26 +43,3 @@ key-file: /var/lib/cilium/clustermesh/{{ $prefix }}etcd-client.key cert-file: /var/lib/cilium/clustermesh/{{ $prefix }}etcd-client.crt {{- end }} {{- end }} - -{{- define "clustermesh-clusters" }} -{{- $clusters := dict }} -{{- if kindIs "map" .Values.clustermesh.config.clusters }} - {{- range $name, $cluster := deepCopy .Values.clustermesh.config.clusters }} - {{- if ne $cluster.enabled false }} - {{- $_ := unset $cluster "enabled" }} - {{- $_ = set $cluster "name" $name }} - {{- $_ = set $clusters $name $cluster }} - {{- end }} - {{- end }} -{{- else if kindIs "slice" .Values.clustermesh.config.clusters }} - {{- range $cluster := deepCopy .Values.clustermesh.config.clusters }} - {{- if ne $cluster.enabled false }} - {{- $_ := unset $cluster "enabled" }} - {{- $_ := set $clusters $cluster.name $cluster }} - {{- end }} - {{- end }} -{{- else }} - {{- fail (printf "unknown type %s for clustermesh.config.clusters" (kindOf .Values.clustermesh.config.clusters)) }} -{{- end }} -{{- toJson $clusters }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-config/clustermesh-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-config/clustermesh-secret.yaml index d60d6f1c..5a3a7aa8 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-config/clustermesh-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-config/clustermesh-secret.yaml @@ -18,7 +18,7 @@ data: {{- $kvstoremesh := and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled }} {{- $override := ternary (printf "https://clustermesh-apiserver.%s.svc:2379" (include "cilium.namespace" .)) "" $kvstoremesh }} {{- $local_etcd := and $kvstoremesh (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "external") }} - {{- range (include "clustermesh-clusters" . | fromJson) }} + {{- range .Values.clustermesh.config.clusters }} {{ .name }}: {{ include "clustermesh-config-generate-etcd-cfg" (list . $.Values.clustermesh.config.domain $override $local_etcd $.Values.etcd ) | b64enc }} {{- /* The parenthesis around .tls are required, since it can be null: https://stackoverflow.com/a/68807258 */}} {{- if and (eq $override "") (.tls).cert (.tls).key }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-config/kvstoremesh-secret.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-config/kvstoremesh-secret.yaml index 2828cfd2..3cdc7828 100644 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-config/kvstoremesh-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/clustermesh-config/kvstoremesh-secret.yaml @@ -15,7 +15,7 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} data: - {{- range (include "clustermesh-clusters" . | fromJson) }} + {{- range .Values.clustermesh.config.clusters }} {{ .name }}: {{ include "clustermesh-config-generate-etcd-cfg" (list . $.Values.clustermesh.config.domain "" false $.Values.etcd ) | b64enc }} {{- /* The parenthesis around .tls are required, since it can be null: https://stackoverflow.com/a/68807258 */}} {{- if and (.tls).cert (.tls).key }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrole.yaml deleted file mode 100644 index 08fcea1b..00000000 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrole.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: coredns-mcsapi - labels: - app.kubernetes.io/part-of: cilium - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} - annotations: - {{/* - We have to leave CoreDNS RBAC to be able to read MCS-API resources - as we would leave a broken CoreDNS installation otherwise - */}} - helm.sh/resource-policy: keep - {{- with .Values.clustermesh.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} -rules: -- apiGroups: - - multicluster.x-k8s.io - resources: - - serviceimports - verbs: - - list - - watch -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrolebinding.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrolebinding.yaml deleted file mode 100644 index 7a1867f5..00000000 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/clusterrolebinding.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }} -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: coredns-mcsapi - labels: - app.kubernetes.io/part-of: cilium - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} - annotations: - {{/* - We have to leave CoreDNS RBAC to be able to read MCS-API resources - as we would leave a broken CoreDNS installation otherwise - */}} - helm.sh/resource-policy: keep - {{- with .Values.clustermesh.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: coredns-mcsapi -subjects: -- kind: ServiceAccount - name: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.serviceAccountName | quote }} - namespace: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace | quote }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrole.yaml deleted file mode 100644 index ac339f9f..00000000 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrole.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }} -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: cilium-coredns-mcsapi-autoconfig - {{- with .Values.commonLabels }} - labels: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.clustermesh.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -rules: -# note: namespaces permission are needed to initialize and verify that the kubernetes client works. -- apiGroups: - - "" - resources: - - "namespaces" - verbs: - - "get" -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrolebinding.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrolebinding.yaml deleted file mode 100644 index 4b70ccf4..00000000 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-clusterrolebinding.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }} -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: cilium-coredns-mcsapi-autoconfig - {{- with .Values.commonLabels }} - labels: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.clustermesh.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cilium-coredns-mcsapi-autoconfig -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccounts.corednsMCSAPI.name | quote }} - namespace: {{ include "cilium.namespace" . }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-role.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-role.yaml deleted file mode 100644 index 52f42fae..00000000 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-role.yaml +++ /dev/null @@ -1,36 +0,0 @@ -{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }} -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: cilium-coredns-mcsapi-autoconfig - namespace: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace }} - {{- with .Values.commonLabels }} - labels: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.clustermesh.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -rules: -- apiGroups: - - "" - resources: - - "configmaps" - verbs: - - "update" - - "patch" - - "get" - resourceNames: - - "{{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.configMapName }}" -- apiGroups: - - "apps" - resources: - - "deployments" - verbs: - - "patch" - - "update" - - "get" - resourceNames: - - "{{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.deploymentName }}" -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-rolebinding.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-rolebinding.yaml deleted file mode 100644 index f5caf1a1..00000000 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-rolebinding.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }} -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: cilium-coredns-mcsapi-autoconfig - namespace: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace }} - {{- with .Values.commonLabels }} - labels: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.clustermesh.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-coredns-mcsapi-autoconfig -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccounts.corednsMCSAPI.name | quote }} - namespace: {{ include "cilium.namespace" . }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-serviceaccount.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-serviceaccount.yaml deleted file mode 100644 index 4e572a13..00000000 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job-serviceaccount.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled .Values.serviceAccounts.corednsMCSAPI.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ .Values.serviceAccounts.corednsMCSAPI.name | quote }} - namespace: {{ include "cilium.namespace" . }} - {{- with .Values.commonLabels }} - labels: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- if or .Values.serviceAccounts.corednsMCSAPI.annotations .Values.clustermesh.annotations }} - annotations: - {{- with .Values.clustermesh.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.serviceAccounts.corednsMCSAPI.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job.yaml b/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job.yaml deleted file mode 100644 index 9f9c3ccd..00000000 --- a/packages/system/cilium/charts/cilium/templates/clustermesh-coredns-mcsapi/job.yaml +++ /dev/null @@ -1,82 +0,0 @@ -{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.corednsAutoConfigure.enabled }} ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: cilium-coredns-mcsapi-autoconfig - namespace: {{ include "cilium.namespace" . }} - labels: - k8s-app: cilium-coredns-mcsapi-autoconfig - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} - app.kubernetes.io/part-of: cilium - annotations: - "helm.sh/hook": post-install,post-upgrade - {{- with .Values.clustermesh.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - template: - metadata: - labels: - k8s-app: cilium-coredns-mcsapi-autoconfig - {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - containers: - - name: autoconfig - image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }} - imagePullPolicy: {{ .Values.clustermesh.apiserver.image.pullPolicy }} - {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.resources }} - resources: - {{- toYaml . | nindent 10 }} - {{- end }} - command: - - /usr/bin/clustermesh-apiserver - args: - - mcsapi-coredns-cfg - - --coredns-deployment-name={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.deploymentName }} - - --coredns-configmap-name={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.configMapName }} - - --coredns-namespace={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace }} - - --coredns-cluster-domain={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.clusterDomain }} - - --coredns-clusterset-domain={{ .Values.clustermesh.mcsapi.corednsAutoConfigure.coredns.clustersetDomain }} - {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.extraArgs }} - {{- toYaml . | trim | nindent 12 }} - {{- end }} - {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.extraVolumeMounts }} - volumeMounts: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if .Values.clustermesh.mcsapi.corednsAutoConfigure.priorityClassName }} - priorityClassName: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.priorityClassName }} - {{- end }} - {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ .Values.serviceAccounts.corednsMCSAPI.name | quote }} - automountServiceAccountToken: true - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - restartPolicy: OnFailure - {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.extraVolumes }} - volumes: - {{- toYaml . | nindent 6 }} - {{- end }} - {{- with .Values.clustermesh.mcsapi.corednsAutoConfigure.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - ttlSecondsAfterFinished: {{ .Values.clustermesh.mcsapi.corednsAutoConfigure.ttlSecondsAfterFinished }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/hubble-relay/configmap.yaml b/packages/system/cilium/charts/cilium/templates/hubble-relay/configmap.yaml index 9df77bae..26b6219a 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble-relay/configmap.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble-relay/configmap.yaml @@ -29,8 +29,6 @@ data: pprof: {{ .Values.hubble.relay.pprof.enabled | quote }} pprof-address: {{ .Values.hubble.relay.pprof.address | quote }} pprof-port: {{ .Values.hubble.relay.pprof.port | quote }} - pprof-mutex-profile-fraction: {{ .Values.hubble.relay.pprof.mutexProfileFraction | quote }} - pprof-block-profile-rate: {{ .Values.hubble.relay.pprof.blockProfileRate | quote }} {{- end }} {{- if .Values.hubble.relay.prometheus.enabled }} metrics-listen-address: ":{{ .Values.hubble.relay.prometheus.port }}" @@ -46,10 +44,4 @@ data: disable-client-tls: true {{- end }} {{- include "hubble-relay.config.tls" . | nindent 4 }} - {{- if .Values.hubble.relay.logOptions.format }} - log-format: {{ .Values.hubble.relay.logOptions.format }} - {{- end }} - {{- if .Values.hubble.relay.logOptions.level }} - log-level: {{ .Values.hubble.relay.logOptions.level }} - {{- end }} {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/hubble-ui/clusterrole.yaml b/packages/system/cilium/charts/cilium/templates/hubble-ui/clusterrole.yaml index ebb8cbd6..b8607bd9 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble-ui/clusterrole.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble-ui/clusterrole.yaml @@ -14,6 +14,14 @@ metadata: {{- end }} rules: +- apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - get + - list + - watch - apiGroups: - "" resources: @@ -35,4 +43,12 @@ rules: - get - list - watch +- apiGroups: + - cilium.io + resources: + - "*" + verbs: + - get + - list + - watch {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/hubble-ui/deployment.yaml b/packages/system/cilium/charts/cilium/templates/hubble-ui/deployment.yaml index 07a94dce..c3b3dc5a 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble-ui/deployment.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble-ui/deployment.yaml @@ -74,11 +74,11 @@ spec: livenessProbe: httpGet: path: /healthz - port: http + port: 8081 readinessProbe: httpGet: path: / - port: http + port: 8081 {{- with .Values.hubble.ui.frontend.resources }} resources: {{- toYaml . | trim | nindent 10 }} @@ -184,12 +184,8 @@ spec: defaultMode: 420 name: hubble-ui-nginx name: hubble-ui-nginx-conf - - name: tmp-dir - {{- if .Values.hubble.ui.tmpVolume }} - {{- toYaml .Values.hubble.ui.tmpVolume | nindent 8 }} - {{- else }} - emptyDir: {} - {{- end }} + - emptyDir: {} + name: tmp-dir {{- if .Values.hubble.relay.tls.server.enabled }} - name: hubble-ui-client-certs {{- if .Values.hubble.ui.standalone.enabled }} diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/_job-spec.tpl b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/_job-spec.tpl index 06fb3347..72a1f3d8 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/_job-spec.tpl +++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/_job-spec.tpl @@ -137,6 +137,7 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + serviceAccount: {{ .Values.serviceAccounts.hubblecertgen.name | quote }} serviceAccountName: {{ .Values.serviceAccounts.hubblecertgen.name | quote }} automountServiceAccountToken: {{ .Values.serviceAccounts.hubblecertgen.automount }} {{- with .Values.imagePullSecrets }} @@ -148,11 +149,9 @@ spec: volumes: {{- toYaml . | nindent 6 }} {{- end }} - {{- with .Values.certgen.affinity }} affinity: + {{- with .Values.certgen.affinity }} {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.certgen.ttlSecondsAfterFinished }} - ttlSecondsAfterFinished: {{ . }} - {{- end }} + ttlSecondsAfterFinished: {{ .Values.certgen.ttlSecondsAfterFinished }} {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/cronjob.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/cronjob.yaml index b49c00a6..697806c6 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/cronjob.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/cronjob.yaml @@ -23,8 +23,6 @@ metadata: {{- end }} spec: schedule: {{ .Values.hubble.tls.auto.schedule | quote }} - successfulJobsHistoryLimit: {{ .Values.certgen.cronJob.successfulJobsHistoryLimit }} - failedJobsHistoryLimit: {{ .Values.certgen.cronJob.failedJobsHistoryLimit }} concurrencyPolicy: Forbid jobTemplate: {{- include "hubble-generate-certs.job.spec" . | nindent 4 }} diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/job.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/job.yaml index 96371916..5e4e67ff 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/job.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-cronjob/job.yaml @@ -1,18 +1,9 @@ {{- if and .Values.hubble.enabled .Values.hubble.tls.enabled .Values.hubble.tls.auto.enabled (eq .Values.hubble.tls.auto.method "cronJob") }} -{{/* -Because Kubernetes job specs are immutable, Helm will fail patch this job if -the spec changes between releases. To avoid breaking the upgrade path, we -generate a name for the job here which is based on the checksum of the spec. -This will cause the name of the job to change if its content changes, -and in turn cause Helm to do delete the old job and replace it with a new one. -*/}} -{{- $jobSpec := include "hubble-generate-certs.job.spec" . -}} -{{- $checkSum := $jobSpec | sha256sum | trunc 10 -}} --- apiVersion: batch/v1 kind: Job metadata: - name: hubble-generate-certs-{{$checkSum}} + name: hubble-generate-certs namespace: {{ include "cilium.namespace" . }} labels: k8s-app: hubble-generate-certs @@ -21,14 +12,13 @@ metadata: {{- with .Values.commonLabels }} {{- toYaml . | nindent 4 }} {{- end }} - {{- if or .Values.certgen.annotations.job .Values.hubble.annotations }} annotations: + "helm.sh/hook": post-install,post-upgrade {{- with .Values.certgen.annotations.job }} - {{- toYaml . | nindent 4 }} + {{- toYaml . | nindent 4 }} {{- end }} {{- with .Values.hubble.annotations }} - {{- toYaml . | nindent 4 }} + {{- toYaml . | nindent 4 }} {{- end }} - {{- end }} -{{ $jobSpec }} +{{ include "hubble-generate-certs.job.spec" . }} {{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/metrics-server-secret.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/metrics-server-secret.yaml index d334b986..0cc13efa 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/metrics-server-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/metrics-server-secret.yaml @@ -10,17 +10,13 @@ kind: Secret metadata: name: hubble-metrics-server-certs namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} + labels: {{- toYaml . | nindent 4 }} {{- end }} - cilium.io/helm-template-non-idempotent: "true" - annotations: {{- with .Values.hubble.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.nonIdempotentAnnotations }} + annotations: {{- toYaml . | nindent 4 }} {{- end }} type: kubernetes.io/tls diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml index 6f001dc9..fa0c908e 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml @@ -17,17 +17,13 @@ kind: Secret metadata: name: hubble-relay-client-certs namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} + labels: {{- toYaml . | nindent 4 }} {{- end }} - cilium.io/helm-template-non-idempotent: "true" - annotations: {{- with .Values.hubble.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.nonIdempotentAnnotations }} + annotations: {{- toYaml . | nindent 4 }} {{- end }} type: kubernetes.io/tls diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-server-secret.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-server-secret.yaml index 229148a0..986b3cac 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-server-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/relay-server-secret.yaml @@ -10,17 +10,13 @@ kind: Secret metadata: name: hubble-relay-server-certs namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} + labels: {{- toYaml . | nindent 4 }} {{- end }} - cilium.io/helm-template-non-idempotent: "true" - annotations: {{- with .Values.hubble.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.nonIdempotentAnnotations }} + annotations: {{- toYaml . | nindent 4 }} {{- end }} type: kubernetes.io/tls diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/server-secret.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/server-secret.yaml index 4d214a56..b7bedb89 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/server-secret.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/server-secret.yaml @@ -18,17 +18,13 @@ kind: Secret metadata: name: hubble-server-certs namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} + labels: {{- toYaml . | nindent 4 }} {{- end }} - cilium.io/helm-template-non-idempotent: "true" - annotations: {{- with .Values.hubble.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.nonIdempotentAnnotations }} + annotations: {{- toYaml . | nindent 4 }} {{- end }} type: kubernetes.io/tls diff --git a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/ui-client-certs.yaml b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/ui-client-certs.yaml index 8c1b40aa..e1f62ead 100644 --- a/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/ui-client-certs.yaml +++ b/packages/system/cilium/charts/cilium/templates/hubble/tls-helm/ui-client-certs.yaml @@ -10,17 +10,13 @@ metadata: name: hubble-ui-client-certs namespace: {{ include "cilium.namespace" . }} - labels: {{- with .Values.commonLabels }} + labels: {{- toYaml . | nindent 4 }} {{- end }} - cilium.io/helm-template-non-idempotent: "true" - annotations: {{- with .Values.hubble.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.nonIdempotentAnnotations }} + annotations: {{- toYaml . | nindent 4 }} {{- end }} type: kubernetes.io/tls diff --git a/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/configmap.yaml b/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/configmap.yaml deleted file mode 100644 index 9d65c1a8..00000000 --- a/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/configmap.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.standaloneDnsProxy.enabled }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: standalone-dns-proxy-config - namespace: {{ include "cilium.namespace" . }} - {{- with .Values.commonLabels }} - labels: - {{- toYaml . | nindent 4 }} - {{- end }} - - {{- with .Values.standaloneDnsProxy.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -data: - # Use the same L7 proxy and DNS settings as the agent for consistency - enable-l7-proxy: {{ .Values.l7Proxy | quote }} - debug: {{ .Values.standaloneDnsProxy.debug | quote }} - enable-standalone-dns-proxy: {{ .Values.standaloneDnsProxy.enabled | quote }} - enable-ipv4: {{ .Values.ipv4.enabled | quote }} - enable-ipv6: {{ .Values.ipv6.enabled | quote }} - standalone-dns-proxy-server-port: {{ .Values.standaloneDnsProxy.serverPort | quote }} - # DNS proxy configuration inherited from agent settings - tofqdns-proxy-port: {{ .Values.dnsProxy.proxyPort | quote }} - tofqdns-enable-dns-compression: {{ .Values.dnsProxy.enableDnsCompression | quote }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/daemonset.yaml deleted file mode 100644 index 7ea150a4..00000000 --- a/packages/system/cilium/charts/cilium/templates/standalone-dns-proxy/daemonset.yaml +++ /dev/null @@ -1,80 +0,0 @@ -{{- if .Values.standaloneDnsProxy.enabled }} ---- -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: standalone-dns-proxy - namespace: {{ include "cilium.namespace" . }} - {{- with .Values.standaloneDnsProxy.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} - labels: - k8s-app: standalone-dns-proxy - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: standalone-dns-proxy - name: standalone-dns-proxy - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - minReadySeconds: 5 - {{- with .Values.standaloneDnsProxy.updateStrategy }} - updateStrategy: - {{- toYaml . | nindent 4 }} - {{- end }} - selector: - matchLabels: - k8s-app: standalone-dns-proxy - template: - metadata: - annotations: - {{- if .Values.standaloneDnsProxy.rollOutPods }} - # ensure pods roll when configmap updates - cilium.io/standalone-dns-proxy-configmap-checksum: {{ include (print $.Template.BasePath "/standalone-dns-proxy/configmap.yaml") . | sha256sum | quote }} - {{- end }} - container.apparmor.security.beta.kubernetes.io/standalone-dns-proxy: "unconfined" - labels: - k8s-app: standalone-dns-proxy - name: standalone-dns-proxy - app.kubernetes.io/name: standalone-dns-proxy - app.kubernetes.io/part-of: cilium - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - hostNetwork: true - automountServiceAccountToken: {{ .Values.standaloneDnsProxy.automountServiceAccountToken }} - {{- with .Values.standaloneDnsProxy.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - tolerations: - - operator: Exists - {{- with .Values.standaloneDnsProxy.tolerations }} - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: standalone-dns-proxy - image: {{ include "cilium.image" .Values.standaloneDnsProxy.image | quote }} - args: - - --config-dir=/tmp/standalone-dns-proxy/config-map - imagePullPolicy: {{ .Values.standaloneDnsProxy.image.pullPolicy }} - volumeMounts: - - mountPath: /tmp/standalone-dns-proxy/config-map - name: standalone-dns-proxy-config-path - readOnly: true - - mountPath: /var/run/standalone-dns-proxy - name: runtime-dir - securityContext: - capabilities: - add: ["NET_ADMIN", "NET_RAW"] - drop: ["ALL"] - volumes: - - configMap: - defaultMode: 420 - name: standalone-dns-proxy-config - name: standalone-dns-proxy-config-path - - emptyDir: {} - name: runtime-dir -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/validate.yaml b/packages/system/cilium/charts/cilium/templates/validate.yaml index ac3164b6..4fff21a3 100644 --- a/packages/system/cilium/charts/cilium/templates/validate.yaml +++ b/packages/system/cilium/charts/cilium/templates/validate.yaml @@ -220,22 +220,3 @@ {{- end }} {{- end }} {{- end }} - -{{/* validate Standalone DNS Proxy */}} -{{- if .Values.standaloneDnsProxy.enabled }} - {{- if not .Values.dnsProxy.proxyPort }} - {{ fail "standaloneDnsProxy requires dnsProxy.proxyPort to be explicitly set (e.g., 10094)" }} - {{- end }} - {{- if eq (int .Values.dnsProxy.proxyPort) 0 }} - {{ fail "standaloneDnsProxy requires dnsProxy.proxyPort to be set to a non-zero value (e.g., 10094). The standalone DNS proxy uses the same DNS configuration as the agent." }} - {{- end }} -{{- end }} - -{{/* validate we don't run tproxy with netkit - see GH issue 39892 */}} -{{- if hasKey .Values "bpf" }} - {{- if and (hasKey .Values.bpf "tproxy") (hasKey .Values.bpf "datapathMode") }} - {{- if and (.Values.bpf.tproxy) (list "netkit" "netkit-l2" | has .Values.bpf.datapathMode) }} - {{ fail ".Values.bpf.tproxy cannot be enabled with .Values.bpf.datapathMode=netkit or .Values.bpf.datapathMode=netkit-l2" }} - {{- end }} - {{- end }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/ztunnel/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/ztunnel/daemonset.yaml deleted file mode 100644 index f9363068..00000000 --- a/packages/system/cilium/charts/cilium/templates/ztunnel/daemonset.yaml +++ /dev/null @@ -1,165 +0,0 @@ -{{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }} ---- -kind: DaemonSet -apiVersion: apps/v1 -metadata: - name: ztunnel-cilium - namespace: {{ include "cilium.namespace" . }} - {{- with .Values.encryption.ztunnel.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} - labels: - app: ztunnel-cilium - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: ztunnel-cilium - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - revisionHistoryLimit: 10 - selector: - matchLabels: - app: ztunnel-cilium - {{- with .Values.encryption.ztunnel.updateStrategy }} - updateStrategy: - {{- toYaml . | trim | nindent 4 }} - {{- end }} - template: - metadata: - annotations: - sidecar.istio.io/inject: "false" - {{- with .Values.encryption.ztunnel.podAnnotations }} - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - app: ztunnel-cilium - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: ztunnel-cilium - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.encryption.ztunnel.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - hostNetwork: true - dnsPolicy: ClusterFirst - containers: - - name: istio-proxy - image: {{ include "cilium.image" .Values.encryption.ztunnel.image | quote }} - imagePullPolicy: {{ .Values.encryption.ztunnel.image.pullPolicy }} - args: - - proxy - - ztunnel - env: - - name: XDS_ADDRESS - value: "https://localhost:15012" - - name: XDS_ROOT_CA - value: "/etc/ztunnel/bootstrap-root.crt" - - name: CA_ROOT_CA - value: "/etc/ztunnel/bootstrap-root.crt" - - name: CA_ADDRESS - value: {{ .Values.encryption.ztunnel.caAddress | quote }} - - name: ISTIO_META_DNS_CAPTURE - value: "false" - - name: INPOD_UDS - value: "/var/run/cilium/ztunnel.sock" - - name: NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: status.hostIP - - name: INSTANCE_IP - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: status.podIP - - name: ISTIO_META_ENABLE_HBONE - value: "true" - {{- with .Values.encryption.ztunnel.extraEnv }} - {{- toYaml . | trim | nindent 12 }} - {{- end }} - readinessProbe: - httpGet: - path: /healthz/ready - port: {{ .Values.encryption.ztunnel.healthPort }} - host: "127.0.0.1" - scheme: HTTP - initialDelaySeconds: {{ .Values.encryption.ztunnel.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.encryption.ztunnel.readinessProbe.periodSeconds }} - failureThreshold: {{ .Values.encryption.ztunnel.readinessProbe.failureThreshold }} - successThreshold: 1 - timeoutSeconds: 1 - {{- with .Values.encryption.ztunnel.resources }} - resources: - {{- toYaml . | trim | nindent 12 }} - {{- end }} - securityContext: - allowPrivilegeEscalation: true - capabilities: - add: - - NET_ADMIN - - SYS_ADMIN - - NET_RAW - drop: - - ALL - privileged: false - readOnlyRootFilesystem: true - runAsGroup: 1337 - runAsNonRoot: false - runAsUser: 0 - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /var/run/cilium - name: cilium-dir - readOnly: false - - mountPath: /etc/ztunnel - name: cilium-ztunnel-secrets - readOnly: true - {{- with .Values.encryption.ztunnel.extraVolumeMounts }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.encryption.ztunnel.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.encryption.ztunnel.nodeSelector }} - nodeSelector: - {{- toYaml . | trim | nindent 8 }} - {{- end }} - {{- with .Values.encryption.ztunnel.tolerations }} - tolerations: - {{- toYaml . | trim | nindent 8 }} - {{- end }} - priorityClassName: {{ include "cilium.priorityClass" (list $ .Values.encryption.ztunnel.priorityClassName "system-node-critical") }} - restartPolicy: Always - terminationGracePeriodSeconds: {{ .Values.encryption.ztunnel.terminationGracePeriodSeconds }} - {{- if .Values.serviceAccounts.ztunnel.create }} - serviceAccountName: {{ .Values.serviceAccounts.ztunnel.name | quote }} - automountServiceAccountToken: {{ .Values.serviceAccounts.ztunnel.automount }} - {{- else }} - automountServiceAccountToken: false - {{- end }} - volumes: - - name: cilium-dir - hostPath: - path: /var/run/cilium - type: DirectoryOrCreate - - name: cilium-ztunnel-secrets - secret: - secretName: cilium-ztunnel-secrets - defaultMode: 420 - items: - - key: bootstrap-root.crt - path: bootstrap-root.crt - mode: 420 - {{- with .Values.encryption.ztunnel.extraVolumes }} - {{- toYaml . | nindent 8 }} - {{- end }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml b/packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml deleted file mode 100644 index 520857dc..00000000 --- a/packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }} -{{- if .Values.encryption.ztunnel.secrets.bootstrapRootCert }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: cilium-ztunnel-secrets - namespace: {{ include "cilium.namespace" . }} - {{- with .Values.encryption.ztunnel.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} - labels: - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: ztunnel-cilium - {{- with .Values.commonLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} -type: Opaque -data: - bootstrap-root.crt: {{ .Values.encryption.ztunnel.secrets.bootstrapRootCert | b64enc }} -{{- end }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/templates/ztunnel/serviceaccount.yaml b/packages/system/cilium/charts/cilium/templates/ztunnel/serviceaccount.yaml deleted file mode 100644 index 4ef9e2bc..00000000 --- a/packages/system/cilium/charts/cilium/templates/ztunnel/serviceaccount.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") .Values.serviceAccounts.ztunnel.create }} ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ .Values.serviceAccounts.ztunnel.name | quote }} - namespace: {{ include "cilium.namespace" . }} - {{- with .Values.commonLabels }} - labels: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- if or .Values.serviceAccounts.ztunnel.annotations .Values.encryption.ztunnel.annotations }} - annotations: - {{- with .Values.encryption.ztunnel.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.serviceAccounts.ztunnel.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} diff --git a/packages/system/cilium/charts/cilium/values.schema.json b/packages/system/cilium/charts/cilium/values.schema.json index 65c84af5..fb1ea4c3 100644 --- a/packages/system/cilium/charts/cilium/values.schema.json +++ b/packages/system/cilium/charts/cilium/values.schema.json @@ -58,27 +58,6 @@ "properties": { "enabled": { "type": "boolean" - }, - "nodeSpec": { - "properties": { - "securityGroupTags": { - "items": {}, - "type": "array" - }, - "securityGroups": { - "items": {}, - "type": "array" - }, - "vSwitchTags": { - "items": {}, - "type": "array" - }, - "vSwitches": { - "items": {}, - "type": "array" - } - }, - "type": "object" } }, "type": "object" @@ -461,14 +440,6 @@ "properties": { "enabled": { "type": "boolean" - }, - "nodeSpec": { - "properties": { - "azureInterfaceName": { - "type": "string" - } - }, - "type": "object" } }, "type": "object" @@ -673,14 +644,6 @@ "monitorInterval": { "type": "string" }, - "monitorTraceIPOption": { - "minimum": 0, - "maximum": 255, - "type": [ - "null", - "integer" - ] - }, "natMax": { "type": [ "null", @@ -705,12 +668,6 @@ "integer" ] }, - "policyMapPressureMetricsThreshold": { - "type": [ - "null", - "number" - ] - }, "policyStatsMapMax": { "type": [ "null", @@ -757,17 +714,6 @@ }, "type": "object" }, - "cronJob": { - "properties": { - "failedJobsHistoryLimit": { - "type": "integer" - }, - "successfulJobsHistoryLimit": { - "type": "integer" - } - }, - "type": "object" - }, "extraVolumeMounts": { "items": {}, "type": "array" @@ -822,10 +768,7 @@ "type": "array" }, "ttlSecondsAfterFinished": { - "type": [ - "null", - "integer" - ] + "type": "integer" } }, "type": "object" @@ -1356,9 +1299,6 @@ "Cluster" ] }, - "externallyCreated": { - "type": "boolean" - }, "internalTrafficPolicy": { "enum": [ "Local", @@ -1429,6 +1369,17 @@ }, "type": "object" }, + "client": { + "properties": { + "cert": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "type": "object" + }, "enableSecrets": { "type": "boolean" }, @@ -1501,17 +1452,11 @@ }, "type": "object" }, - "cacheTTL": { - "type": "string" - }, "config": { "properties": { "clusters": { "items": {}, - "type": [ - "object", - "array" - ] + "type": "array" }, "domain": { "type": "string" @@ -1531,85 +1476,6 @@ "maxConnectedClusters": { "type": "integer" }, - "mcsapi": { - "properties": { - "corednsAutoConfigure": { - "properties": { - "affinity": { - "type": "object" - }, - "annotations": { - "type": "object" - }, - "coredns": { - "properties": { - "clusterDomain": { - "type": "string" - }, - "clustersetDomain": { - "type": "string" - }, - "configMapName": { - "type": "string" - }, - "deploymentName": { - "type": "string" - }, - "namespace": { - "type": "string" - }, - "serviceAccountName": { - "type": "string" - } - }, - "type": "object" - }, - "enabled": { - "type": "boolean" - }, - "extraArgs": { - "items": {}, - "type": "array" - }, - "extraVolumeMounts": { - "items": {}, - "type": "array" - }, - "extraVolumes": { - "items": {}, - "type": "array" - }, - "nodeSelector": { - "type": "object" - }, - "podLabels": { - "type": "object" - }, - "priorityClassName": { - "type": "string" - }, - "resources": { - "type": "object" - }, - "tolerations": { - "items": {}, - "type": "array" - }, - "ttlSecondsAfterFinished": { - "type": "integer" - } - }, - "type": "object" - }, - "enabled": { - "type": "boolean" - }, - "installCRDs": { - "type": "boolean" - } - }, - "type": "object" - }, "policyDefaultLocalCluster": { "type": "boolean" }, @@ -1671,27 +1537,10 @@ }, "resources": { "properties": { - "limits": { - "properties": { - "cpu": { - "type": [ - "integer", - "string" - ] - }, - "memory": { - "type": "string" - } - }, - "type": "object" - }, "requests": { "properties": { "cpu": { - "type": [ - "integer", - "string" - ] + "type": "string" }, "memory": { "type": "string" @@ -1714,21 +1563,6 @@ "object" ] }, - "configDriftDetection": { - "properties": { - "driftChecker": { - "type": "boolean" - }, - "enabled": { - "type": "boolean" - }, - "ignoredKeys": { - "items": {}, - "type": "array" - } - }, - "type": "object" - }, "connectivityProbeFrequencyRatio": { "type": [ "null", @@ -1744,6 +1578,14 @@ "crdWaitTimeout": { "type": "string" }, + "customCalls": { + "properties": { + "enabled": { + "type": "boolean" + } + }, + "type": "object" + }, "daemon": { "properties": { "allowedConfigOverrides": { @@ -1907,9 +1749,6 @@ "enableMasqueradeRouteSource": { "type": "boolean" }, - "enableNoServiceEndpointsRoutable": { - "type": "boolean" - }, "enableNonDefaultDenyPolicies": { "type": "boolean" }, @@ -1958,30 +1797,8 @@ "cidr": { "type": "string" }, - "egress": { - "properties": { - "allowRemoteNodeIdentities": { - "type": "boolean" - }, - "cidr": { - "type": "string" - }, - "enabled": { - "type": "boolean" - } - }, - "type": "object" - }, "enabled": { "type": "boolean" - }, - "ingress": { - "properties": { - "enabled": { - "type": "boolean" - } - }, - "type": "object" } }, "type": "object" @@ -1996,184 +1813,6 @@ } }, "type": "object" - }, - "ztunnel": { - "properties": { - "affinity": { - "type": "object" - }, - "annotations": { - "type": "object" - }, - "caAddress": { - "type": "string" - }, - "extraEnv": { - "items": {}, - "type": "array" - }, - "extraVolumeMounts": { - "items": {}, - "type": "array" - }, - "extraVolumes": { - "items": {}, - "type": "array" - }, - "healthPort": { - "type": "integer" - }, - "image": { - "properties": { - "digest": { - "type": [ - "null", - "string" - ] - }, - "override": { - "type": [ - "null", - "string" - ] - }, - "pullPolicy": { - "type": "string" - }, - "repository": { - "type": "string" - }, - "tag": { - "type": "string" - }, - "useDigest": { - "type": "boolean" - } - }, - "type": "object" - }, - "nodeSelector": { - "properties": { - "kubernetes.io/os": { - "type": "string" - } - }, - "type": "object" - }, - "podAnnotations": { - "type": "object" - }, - "podLabels": { - "type": "object" - }, - "priorityClassName": { - "type": [ - "null", - "string" - ] - }, - "readinessProbe": { - "properties": { - "failureThreshold": { - "type": "integer" - }, - "initialDelaySeconds": { - "type": "integer" - }, - "periodSeconds": { - "type": "integer" - } - }, - "type": "object" - }, - "resources": { - "properties": { - "requests": { - "properties": { - "cpu": { - "type": "string" - }, - "memory": { - "type": "string" - } - }, - "type": "object" - } - }, - "type": "object" - }, - "secrets": { - "properties": { - "bootstrapRootCert": { - "type": [ - "null", - "string" - ] - } - }, - "type": "object" - }, - "terminationGracePeriodSeconds": { - "type": "integer" - }, - "tolerations": { - "items": { - "anyOf": [ - { - "properties": { - "effect": { - "type": "string" - }, - "operator": { - "type": "string" - } - } - }, - { - "properties": { - "key": { - "type": "string" - }, - "operator": { - "type": "string" - } - } - }, - { - "properties": { - "effect": { - "type": "string" - }, - "operator": { - "type": "string" - } - } - } - ] - }, - "type": "array" - }, - "updateStrategy": { - "properties": { - "rollingUpdate": { - "properties": { - "maxSurge": { - "type": "integer" - }, - "maxUnavailable": { - "type": "integer" - } - }, - "type": "object" - }, - "type": { - "type": "string" - } - }, - "type": "object" - } - }, - "type": "object" } }, "type": "object" @@ -2189,9 +1828,6 @@ "endpointLockdownOnMapOverflow": { "type": "boolean" }, - "endpointPolicyUpdateTimeoutDuration": { - "type": "null" - }, "endpointRoutes": { "properties": { "enabled": { @@ -2233,49 +1869,6 @@ "items": {}, "type": "array" }, - "nodeSpec": { - "properties": { - "deleteOnTermination": { - "type": [ - "null", - "boolean" - ] - }, - "disablePrefixDelegation": { - "type": "boolean" - }, - "excludeInterfaceTags": { - "items": {}, - "type": "array" - }, - "firstInterfaceIndex": { - "type": [ - "null", - "integer" - ] - }, - "securityGroupTags": { - "items": {}, - "type": "array" - }, - "securityGroups": { - "items": {}, - "type": "array" - }, - "subnetIDs": { - "items": {}, - "type": "array" - }, - "subnetTags": { - "items": {}, - "type": "array" - }, - "usePrimaryAddress": { - "type": "boolean" - } - }, - "type": "object" - }, "subnetIDsFilter": { "items": {}, "type": "array" @@ -2418,12 +2011,6 @@ "string" ] }, - "clusterMaxConnections": { - "type": "integer" - }, - "clusterMaxRequests": { - "type": "integer" - }, "connectTimeoutSeconds": { "type": "integer" }, @@ -2517,10 +2104,6 @@ }, "type": "object" }, - "initContainers": { - "items": {}, - "type": "array" - }, "initialFetchTimeoutSeconds": { "type": "integer" }, @@ -2588,9 +2171,6 @@ "maxConnectionDurationSeconds": { "type": "integer" }, - "maxGlobalDownstreamConnections": { - "type": "integer" - }, "maxRequestsPerConnection": { "type": "integer" }, @@ -2813,9 +2393,6 @@ }, "type": "object" }, - "useOriginalSourceAddress": { - "type": "boolean" - }, "xffNumTrustedHopsL7PolicyEgress": { "type": "integer" }, @@ -3037,17 +2614,10 @@ "anyOf": [ { "properties": { - "aggregationInterval": { - "type": "string" - }, "excludeFilters": { "items": {}, "type": "array" }, - "fieldAggregate": { - "items": {}, - "type": "array" - }, "fieldMask": { "items": {}, "type": "array" @@ -3091,9 +2661,6 @@ }, "static": { "properties": { - "aggregationInterval": { - "type": "string" - }, "allowList": { "items": {}, "type": "array" @@ -3105,10 +2672,6 @@ "enabled": { "type": "boolean" }, - "fieldAggregate": { - "items": {}, - "type": "array" - }, "fieldMask": { "items": {}, "type": "array" @@ -3474,23 +3037,6 @@ "listenPort": { "type": "string" }, - "logOptions": { - "properties": { - "format": { - "type": [ - "null", - "string" - ] - }, - "level": { - "type": [ - "null", - "string" - ] - } - }, - "type": "object" - }, "nodeSelector": { "properties": { "kubernetes.io/os": { @@ -3554,15 +3100,9 @@ "address": { "type": "string" }, - "blockProfileRate": { - "type": "integer" - }, "enabled": { "type": "boolean" }, - "mutexProfileFraction": { - "type": "integer" - }, "port": { "type": "integer" } @@ -4140,9 +3680,6 @@ }, "type": "object" }, - "tmpVolume": { - "type": "object" - }, "tolerations": { "items": {}, "type": "array" @@ -4384,33 +3921,6 @@ "multiPoolPreAllocation": { "type": "string" }, - "nodeSpec": { - "properties": { - "ipamMaxAllocate": { - "type": [ - "null", - "integer" - ] - }, - "ipamMinAllocate": { - "type": [ - "null", - "integer" - ] - }, - "ipamPreAllocate": { - "type": [ - "null", - "integer" - ] - }, - "ipamStaticIPTags": { - "items": {}, - "type": "array" - } - }, - "type": "object" - }, "operator": { "properties": { "autoCreateCiliumPodIPPools": { @@ -4677,9 +4187,6 @@ } }, "type": "object" - }, - "serviceTopology": { - "type": "boolean" } }, "type": "object" @@ -4771,6 +4278,9 @@ }, "enableHealthCheckLoadBalancerIP": { "type": "boolean" + }, + "enabled": { + "type": "boolean" } }, "type": "object" @@ -4884,10 +4394,7 @@ "requests": { "properties": { "cpu": { - "type": [ - "integer", - "string" - ] + "type": "string" }, "memory": { "type": "string" @@ -4979,9 +4486,6 @@ } }, "type": "object" - }, - "waitForCloudInit": { - "type": "boolean" } }, "type": "object" @@ -5190,15 +4694,9 @@ "address": { "type": "string" }, - "blockProfileRate": { - "type": "integer" - }, "enabled": { "type": "boolean" }, - "mutexProfileFraction": { - "type": "integer" - }, "port": { "type": "integer" } @@ -5256,30 +4754,6 @@ } }, "type": "object" - }, - "tls": { - "properties": { - "enabled": { - "type": "boolean" - }, - "server": { - "properties": { - "existingSecret": { - "type": "string" - }, - "mtls": { - "properties": { - "enabled": { - "type": "boolean" - } - }, - "type": "object" - } - }, - "type": "object" - } - }, - "type": "object" } }, "type": "object" @@ -5392,12 +4866,6 @@ }, "restart": { "type": "boolean" - }, - "selector": { - "type": [ - "null", - "string" - ] } }, "type": "object" @@ -5434,9 +4902,6 @@ "properties": { "enabled": { "type": "boolean" - }, - "packetizationLayerPMTUDMode": { - "type": "string" } }, "type": "object" @@ -5475,9 +4940,6 @@ "array" ] }, - "policyDenyResponse": { - "type": "string" - }, "policyEnforcementMode": { "type": "string" }, @@ -5486,15 +4948,9 @@ "address": { "type": "string" }, - "blockProfileRate": { - "type": "integer" - }, "enabled": { "type": "boolean" }, - "mutexProfileFraction": { - "type": "integer" - }, "port": { "type": "integer" } @@ -5907,9 +5363,6 @@ "secretsNamespaceAnnotations": { "type": "object" }, - "secretsNamespaceLabels": { - "type": "object" - }, "securityContext": { "properties": { "allowPrivilegeEscalation": { @@ -5969,9 +5422,6 @@ { "type": "string" }, - { - "type": "string" - }, { "type": "string" } @@ -6087,23 +5537,6 @@ }, "type": "object" }, - "corednsMCSAPI": { - "properties": { - "annotations": { - "type": "object" - }, - "automount": { - "type": "boolean" - }, - "create": { - "type": "boolean" - }, - "name": { - "type": "string" - } - }, - "type": "object" - }, "envoy": { "properties": { "annotations": { @@ -6225,23 +5658,6 @@ } }, "type": "object" - }, - "ztunnel": { - "properties": { - "annotations": { - "type": "object" - }, - "automount": { - "type": "boolean" - }, - "create": { - "type": "boolean" - }, - "name": { - "type": "string" - } - }, - "type": "object" } }, "type": "object" @@ -6260,86 +5676,6 @@ }, "type": "object" }, - "standaloneDnsProxy": { - "properties": { - "annotations": { - "type": "object" - }, - "automountServiceAccountToken": { - "type": "boolean" - }, - "debug": { - "type": "boolean" - }, - "enabled": { - "type": "boolean" - }, - "image": { - "properties": { - "digest": { - "type": "string" - }, - "override": { - "type": [ - "null", - "string" - ] - }, - "pullPolicy": { - "type": "string" - }, - "repository": { - "type": "string" - }, - "tag": { - "type": "string" - }, - "useDigest": { - "type": "boolean" - } - }, - "type": "object" - }, - "nodeSelector": { - "properties": { - "kubernetes.io/os": { - "type": "string" - } - }, - "type": "object" - }, - "rollOutPods": { - "type": "boolean" - }, - "serverPort": { - "type": "integer" - }, - "tolerations": { - "items": {}, - "type": "array" - }, - "updateStrategy": { - "properties": { - "rollingUpdate": { - "properties": { - "maxSurge": { - "type": "integer" - }, - "maxUnavailable": { - "type": "integer" - } - }, - "type": "object" - }, - "type": { - "type": "string" - } - }, - "type": "object" - } - }, - "type": "object" - }, "startupProbe": { "properties": { "failureThreshold": { @@ -6351,6 +5687,9 @@ }, "type": "object" }, + "svcSourceRangeCheck": { + "type": "boolean" + }, "synchronizeK8sNodes": { "type": "boolean" }, @@ -6435,9 +5774,6 @@ }, "type": "object" }, - "tmpVolume": { - "type": "object" - }, "tolerations": { "items": { "anyOf": [ diff --git a/packages/system/cilium/charts/cilium/values.yaml b/packages/system/cilium/charts/cilium/values.yaml index 66f76982..eff7f902 100644 --- a/packages/system/cilium/charts/cilium/values.yaml +++ b/packages/system/cilium/charts/cilium/values.yaml @@ -6,6 +6,7 @@ # type: [null, string] # @schema # -- namespaceOverride allows to override the destination namespace for Cilium resources. +# This property allows to use Cilium as part of an Umbrella Chart with different targets. namespaceOverride: "" # @schema # type: [null, object] @@ -28,7 +29,7 @@ debug: # @schema # -- Configure verbosity levels for debug logging # This option is used to enable debug messages for operations related to such - # sub-system such as (e.g. kvstore, envoy, datapath, policy, or tagged), and flow is + # sub-system such as (e.g. kvstore, envoy, datapath or policy), and flow is # for enabling debug messages emitted per request, message and connection. # Multiple values can be set via a space-separated string (e.g. "datapath envoy"). # @@ -38,7 +39,6 @@ debug: # - envoy # - datapath # - policy - # - tagged verbose: ~ # -- Set the agent-internal metrics sampling frequency. This sets the # frequency of the internal sampling of the agent metrics. These are @@ -204,18 +204,6 @@ serviceAccounts: name: hubble-generate-certs automount: true annotations: {} - # -- CorednsMCSAPI is used if clustermesh.mcsapi.corednsAutoConfigure.enabled=true - corednsMCSAPI: - create: true - name: cilium-coredns-mcsapi-autoconfig - automount: true - annotations: {} - # -- Ztunnel is used if encryption.type=ztunnel - ztunnel: - create: true - name: ztunnel-cilium - automount: false - annotations: {} # -- Configure termination grace period for cilium-agent DaemonSet. terminationGracePeriodSeconds: 1 # -- Install the cilium agent resources. @@ -224,22 +212,6 @@ agent: true name: cilium # -- Roll out cilium agent pods automatically when configmap is updated. rollOutCiliumPods: false -# -- Configuration for the ConfigMap drift detection feature. -# When enabled, the agent continuously watches the cilium-config ConfigMap -# and exposes a cilium_drift_checker_config_delta Prometheus metric reporting -# the number of keys that differ between the ConfigMap and the agent's active -# settings. A non-zero value indicates that the agent has not yet applied all -# current ConfigMap changes and needs to be restarted. -configDriftDetection: - # -- Enable watching of the cilium-config ConfigMap and reflecting its - # contents into the agent's internal DynamicConfig table. - enabled: true - # -- Enable the drift checker which compares the DynamicConfig table against - # the agent's active settings and publishes the - # cilium_drift_checker_config_delta metric. - driftChecker: true - # -- List of config-map keys to ignore when computing the drift delta. - ignoredKeys: [] # -- Agent container image. image: # @schema @@ -247,10 +219,10 @@ image: # @schema override: ~ repository: "quay.io/cilium/cilium" - tag: "v1.19.3" + tag: "v1.18.6" pullPolicy: "IfNotPresent" # cilium-digest - digest: sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10 + digest: sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4 useDigest: true # -- Scheduling configurations for cilium pods scheduling: @@ -391,8 +363,6 @@ securityContext: - SETGID # Allow to execute program that changes UID (e.g. required for package installation) - SETUID - # Allow to read dmesg and get kernel pointers when kptr_restrict=1 - - SYSLOG # -- Capabilities for the `mount-cgroup` init container mountCgroup: # Only used for 'mount' cgroup @@ -463,16 +433,9 @@ azure: # clientID: 00000000-0000-0000-0000-000000000000 # clientSecret: 00000000-0000-0000-0000-000000000000 # userAssignedIdentityID: 00000000-0000-0000-0000-000000000000 - nodeSpec: - azureInterfaceName: "" alibabacloud: # -- Enable AlibabaCloud ENI integration enabled: false - nodeSpec: - vSwitches: [] - vSwitchTags: [] - securityGroups: [] - securityGroupTags: [] # -- Enable bandwidth manager to optimize TCP and UDP workloads and allow # for rate-limiting traffic from individual Pods with EDT (Earliest Departure # Time) through the "kubernetes.io/egress-bandwidth" Pod annotation. @@ -505,7 +468,8 @@ l2podAnnouncements: interface: "eth0" # -- A regular expression matching interfaces used for sending Gratuitous ARP pod announcements # interfacePattern: "" -# -- This feature set enables virtual BGP routers to be created via BGP CRDs. +# -- This feature set enables virtual BGP routers to be created via +# CiliumBGPPeeringPolicy CRDs. bgpControlPlane: # -- Enables the BGP control plane. enabled: false @@ -515,9 +479,9 @@ bgpControlPlane: create: false # -- The name of the secret namespace to which Cilium agents are given read access name: kube-system - # -- Status reporting settings + # -- Status reporting settings (BGPv2 only) statusReport: - # -- Enable/Disable BGP status reporting + # -- Enable/Disable BGPv2 status reporting # It is recommended to enable status reporting in general, but if you have any issue # such as high API server load, you can disable it by setting this to false. enabled: true @@ -527,7 +491,7 @@ bgpControlPlane: mode: "default" # -- IP pool to allocate the BGP router-id from when the mode is ip-pool. ipPool: "" - # -- Legacy BGP ORIGIN attribute settings + # -- Legacy BGP ORIGIN attribute settings (BGPv2 only) legacyOriginAttribute: # -- Enable/Disable advertising LoadBalancerIP routes with the legacy # BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0). @@ -537,11 +501,6 @@ pmtuDiscovery: # -- Enable path MTU discovery to send ICMP fragmentation-needed replies to # the client. enabled: false - # -- Enable kernel probing path MTU discovery for Pods which uses different message - # sizes to search for correct MTU value. - # Valid values are: always, blackhole, disabled and unset (or empty). If value - # is 'unset' or left empty then will not try to override setting. - packetizationLayerPMTUDMode: "blackhole" bpf: autoMount: # -- Enable automatic mount of BPF filesystem @@ -589,7 +548,7 @@ bpf: # Helm configuration for BPF events map rate limiting is experimental and might change # in upcoming releases. events: - # -- Default settings for all types of events except dbg. + # -- Default settings for all types of events except dbg and pcap. default: # @schema # type: [null, integer] @@ -649,12 +608,6 @@ bpf: # type: [null, integer] # @schema policyMapMax: 16384 - # -- (float64) Configure threshold for emitting pressure metrics of policy maps. - # @schema - # type: [null, number] - # @schema - # @default -- `0.1` - policyMapPressureMetricsThreshold: ~ # -- Configure the maximum number of entries in global policy stats map. # @schema # type: [null, integer] @@ -712,8 +665,7 @@ bpf: # type: [null, boolean] # @schema # -- (bool) Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules - # for implementing Layer 7 policy. Note this is incompatible with netkit (`bpf.datapathMode=netkit`, - # `bpf.datapathMode=netkit-l2`). + # for implementing Layer 7 policy. # @default -- `false` tproxy: ~ # @schema @@ -723,15 +675,6 @@ bpf: # [0] will allow all VLAN id's without any filtering. # @default -- `[]` vlanBypass: ~ - # -- Configure the IP tracing option type. - # This option is used to specify the IP option type to use for tracing. - # The value must be an integer between 0 and 255. - # @schema - # type: [null, integer] - # minimum: 0 - # maximum: 255 - # @schema - monitorTraceIPOption: 0 # -- (bool) Disable ExternalIP mitigation (CVE-2020-8554) # @default -- `false` disableExternalIPMitigation: false @@ -739,8 +682,7 @@ bpf: # supported kernels. # @default -- `true` enableTCX: true - # -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2). - # Note netkit is incompatible with TPROXY (`bpf.tproxy`). + # -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2) # @default -- `veth` datapathMode: veth # -- Enable BPF clock source probing for more efficient tick retrieval. @@ -828,17 +770,8 @@ cni: # -- Specifies the resources for the cni initContainer resources: requests: - # @schema - # type: [integer, string] - # @schema cpu: 100m memory: 10Mi - limits: - # @schema - # type: [integer, string] - # @schema - cpu: 1 - memory: 1Gi # -- Enable route MTU for pod netns when CNI chaining is used enableRouteMTUForCNIChaining: false # -- Enable the removal of iptables rules created by the AWS CNI VPC plugin. @@ -863,6 +796,10 @@ conntrackGCMaxInterval: "" # -- (string) Configure timeout in which Cilium will exit if CRDs are not available # @default -- `"5m"` crdWaitTimeout: "" +# -- Tail call hooks for custom eBPF programs. +customCalls: + # -- Enable tail call hooks for custom eBPF programs. + enabled: false daemon: # -- Configure where Cilium runtime state should be stored. runPath: "/var/run/cilium" @@ -905,12 +842,6 @@ daemon: # # By default, this functionality is enabled enableSourceIPVerification: true -# -- Configure temporary volume for cilium-agent -tmpVolume: {} -# emptyDir: -# sizeLimit: "100Mi" -# medium: "Memory" - # -- Specify which network interfaces can run the eBPF datapath. This means # that a packet sent from a pod to a destination outside the cluster will be # masqueraded (to an output device IPv4 address), if the output device runs the @@ -929,6 +860,9 @@ forceDeviceDetection: false # -- Enable setting identity mark for local traffic. # enableIdentityMark: true +# -- Enable Kubernetes EndpointSlice feature in Cilium if the cluster supports it. +# enableK8sEndpointSlice: true + # -- CiliumEndpointSlice configuration options. ciliumEndpointSlice: # -- Enable Cilium EndpointSlice feature. @@ -1108,33 +1042,20 @@ enableXTSocketFallback: true encryption: # -- Enable transparent network encryption. enabled: false - # -- Encryption method. Can be one of ipsec, wireguard or ztunnel. + # -- Encryption method. Can be either ipsec or wireguard. type: ipsec # -- Enable encryption for pure node to node traffic. # This option is only effective when encryption.type is set to "wireguard". nodeEncryption: false - # -- Configure the Encryption Pod2Pod strict mode. + # -- Configure the WireGuard Pod2Pod strict mode. strictMode: - # -- Enable Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.enabled) + # -- Enable WireGuard Pod2Pod strict mode. enabled: false - # -- CIDR for the Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.cidr) + # -- CIDR for the WireGuard Pod2Pod strict mode. cidr: "" - # -- Allow dynamic lookup of remote node identities. (deprecated: please use encryption.strictMode.egress.allowRemoteNodeIdentities) + # -- Allow dynamic lookup of remote node identities. # This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. allowRemoteNodeIdentities: false - egress: - # -- Enable strict egress encryption. - enabled: false - # -- CIDR for the Encryption Pod2Pod strict egress mode. - cidr: "" - # -- Allow dynamic lookup of remote node identities. - # This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. - allowRemoteNodeIdentities: false - ingress: - # -- Enable strict ingress encryption. - # When enabled, all unencrypted overlay ingress traffic will be dropped. - # This option is only applicable when WireGuard and tunneling are enabled. - enabled: false ipsec: # -- Name of the key file inside the Kubernetes secret configured via secretName. keyFile: keys @@ -1155,89 +1076,9 @@ encryption: wireguard: # -- Controls WireGuard PersistentKeepalive option. Set 0s to disable. persistentKeepalive: 0s - # -- ztunnel encryption configuration. - # ztunnel is Istio's purpose-built, per-node proxy for handling L4 traffic in ambient mesh mode. - # These settings only apply when encryption.type is set to "ztunnel". - ztunnel: - # -- ztunnel container image. - image: - # @schema - # type: [null, string] - # @schema - override: ~ - repository: "docker.io/istio/ztunnel" - tag: "1.28.0-distroless" - pullPolicy: "IfNotPresent" - # @schema - # type: [null, string] - # @schema - digest: ~ - useDigest: false - # -- CA server address for certificate requests. - caAddress: "https://localhost:15012" - # -- TCP port for the health API. - healthPort: 15021 - # -- ztunnel resource limits & requests. - resources: - requests: - cpu: 200m - memory: 512Mi - # -- ztunnel update strategy. - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - # -- Configure termination grace period for ztunnel DaemonSet. - terminationGracePeriodSeconds: 30 - # -- Readiness probe configuration. - readinessProbe: - initialDelaySeconds: 0 - periodSeconds: 10 - failureThreshold: 3 - # -- Node selector for ztunnel pods. - nodeSelector: - kubernetes.io/os: linux - # -- Node tolerations for ztunnel scheduling. - tolerations: - - effect: NoSchedule - operator: Exists - - key: CriticalAddonsOnly - operator: Exists - - effect: NoExecute - operator: Exists - # -- Affinity for ztunnel pods. - affinity: {} - # @schema - # type: [null, string] - # @schema - # -- The priority class to use for ztunnel pods. - priorityClassName: ~ - # -- Annotations to be added to all ztunnel resources. - annotations: {} - # -- Annotations to be added to ztunnel pods. - podAnnotations: {} - # -- Labels to be added to ztunnel pods. - podLabels: {} - # -- Additional ztunnel container environment variables. - extraEnv: [] - # -- Additional ztunnel volumes. - extraVolumes: [] - # -- Additional ztunnel volumeMounts. - extraVolumeMounts: [] - # -- ztunnel secrets configuration. - secrets: - # -- Base64-encoded bootstrap root certificate content. - # If not provided, the secret must be created manually before deploying. - # @schema - # type: [null, string] - # @schema - bootstrapRootCert: ~ endpointHealthChecking: # -- Enable connectivity health checking between virtual endpoints. enabled: true -# -- Max duration to wait for envoy to respond to configuration changes. Default "10s". -endpointPolicyUpdateTimeoutDuration: null endpointRoutes: # @schema # type: [boolean, string] @@ -1286,32 +1127,6 @@ eni: # -- Filter via AWS EC2 Instance tags (k=v) which will dictate which AWS EC2 Instances # are going to be used to create new ENIs instanceTagsFilter: [] - # -- NodeSpec configuration for the ENI - nodeSpec: - # -- First interface index to use for IP allocation - # @schema - # type: [null, integer] - # @schema - firstInterfaceIndex: ~ - # -- Subnet IDs to use for IP allocation - subnetIDs: [] - # -- Subnet tags to use for IP allocation - subnetTags: [] - # -- Security groups to use for IP allocation - securityGroups: [] - # -- Security group tags to use for IP allocation - securityGroupTags: [] - # -- Exclude interface tags to use for IP allocation - excludeInterfaceTags: [] - # -- Use primary address for IP allocation - usePrimaryAddress: false - # -- Disable prefix delegation for IP allocation - disablePrefixDelegation: false - # -- Delete ENI on termination - # @schema - # type: [null, boolean] - # @schema - deleteOnTermination: ~ # fragmentTracking enables IPv4 fragment tracking support in the datapath. # fragmentTracking: true gke: @@ -1327,8 +1142,6 @@ healthCheckICMPFailureThreshold: 3 hostFirewall: # -- Enables the enforcement of host policies in the eBPF datapath. enabled: false -# -- Enable routing to a service that has zero endpoints -enableNoServiceEndpointsRoutable: true # -- Configure socket LB socketLB: # -- Enable socket LB @@ -1352,15 +1165,12 @@ certgen: # @schema override: ~ repository: "quay.io/cilium/certgen" - tag: "v0.4.1" - digest: "sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697" + tag: "v0.3.1" + digest: "sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9" useDigest: true pullPolicy: "IfNotPresent" - # @schema - # type: [null, integer] - # @schema # -- Seconds after which the completed job pod will be deleted - ttlSecondsAfterFinished: null + ttlSecondsAfterFinished: 1800 # -- Labels to be added to hubble-certgen pods podLabels: {} # -- Annotations to be added to the hubble-certgen initial Job and CronJob @@ -1385,11 +1195,6 @@ certgen: extraVolumeMounts: [] # -- Affinity for certgen affinity: {} - cronJob: - # -- The number of successful finished jobs to keep - successfulJobsHistoryLimit: 3 - # -- The number of failed finished jobs to keep - failedJobsHistoryLimit: 1 hubble: # -- Enable Hubble (true by default). enabled: true @@ -1405,9 +1210,6 @@ hubble: # 2047, 4095, 8191, 16383, 32767, 65535 # eventBufferCapacity: "4095" - # -- The interval at which Hubble will send out lost events from the Observer server, if any. - # lostEventSendInterval: 1s - # -- Hubble metrics configuration. # See https://docs.cilium.io/en/stable/observability/metrics/#hubble-metrics # for more comprehensive documentation about Hubble metrics. @@ -1701,9 +1503,9 @@ hubble: # @schema override: ~ repository: "quay.io/cilium/hubble-relay" - tag: "v1.19.3" + tag: "v1.18.6" # hubble-relay-digest - digest: sha256:5ee21d57b6ef2aa6db67e603a735fdceb162454b352b7335b651456e308f681b + digest: sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e useDigest: true pullPolicy: "IfNotPresent" # -- Specifies the resources for the hubble-relay pods @@ -1914,24 +1716,6 @@ hubble: address: localhost # -- Configure pprof listen port for hubble-relay port: 6062 - # -- Enable mutex contention profiling for hubble-relay and set the fraction of sampled events (set to 1 to sample all events) - mutexProfileFraction: 0 - # -- Enable goroutine blocking profiling for hubble-relay and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) - blockProfileRate: 0 - # -- Logging configuration for hubble-relay. - logOptions: - # @schema - # type: [null, string] - # @schema - # -- Log format for hubble-relay. Valid values are: text, text-ts, json, json-ts. - # @default -- text-ts - format: ~ - # @schema - # type: [null, string] - # @schema - # -- Log level for hubble-relay. Valid values are: debug, info, warn, error. - # @default -- info - level: ~ ui: # -- Whether to enable the Hubble UI. enabled: false @@ -2127,11 +1911,6 @@ hubble: # - secretName: chart-example-tls # hosts: # - chart-example.local - # -- Configure temporary volume for hubble-ui - tmpVolume: {} - # emptyDir: - # # sizeLimit: "100Mi" - # # medium: "Memory" # -- Hubble flows export. export: # --- Static exporter configuration. @@ -2144,14 +1923,6 @@ hubble: # - source # - destination # - verdict - fieldAggregate: [] - # - time - # - source - # - destination - # - verdict - # --- Defines the interval at which to aggregate before exporting Hubble flows. - # Aggregation feature is only enabled when fieldAggregate is specified and aggregationInterval > 0s. - aggregationInterval: "0s" allowList: [] # - '{"verdict":["DROPPED","ERROR"]}' denyList: [] @@ -2177,8 +1948,6 @@ hubble: content: - name: all fieldMask: [] - fieldAggregate: [] - aggregationInterval: "0s" includeFilters: [] excludeFilters: [] filePath: "/var/run/cilium/hubble/events.log" @@ -2271,30 +2040,11 @@ ipam: # refill the bucket up to the burst size capacity. # @default -- `4.0` externalAPILimitQPS: ~ - # -- NodeSpec configuration for the IPAM - nodeSpec: - # -- IPAM min allocate - # @schema - # type: [null, integer] - # @schema - ipamMinAllocate: ~ - # -- IPAM pre allocate - # @schema - # type: [null, integer] - # @schema - ipamPreAllocate: ~ - # -- IPAM max allocate - # @schema - # type: [null, integer] - # @schema - ipamMaxAllocate: ~ - # -- IPAM static IP tags (currently only works with AWS and Azure) - ipamStaticIPTags: [] +# -- defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when +# no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none # @schema # type: [string] # @schema -# -- defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when -# no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none defaultLBServiceIPAM: lbipam nodeIPAM: # -- Configure Node IPAM @@ -2405,7 +2155,7 @@ maglev: {} # type: [null, boolean] # @schema # -- (bool) Enables masquerading of IPv4 traffic leaving the node from endpoints. -# @default -- `true` unless ipam eni mode is active +# @default -- `true` unless ipam eni mode is active enableIPv4Masquerade: ~ # -- Enables masquerading of IPv6 traffic leaving the node from endpoints. enableIPv6Masquerade: true @@ -2492,7 +2242,8 @@ loadBalancer: # -- serviceTopology enables K8s Topology Aware Hints -based service # endpoints filtering - serviceTopology: false + # serviceTopology: false + # -- L7 LoadBalancer l7: # -- Enable L7 service load balancing via envoy proxy. @@ -2515,6 +2266,8 @@ loadBalancer: algorithm: round_robin # -- Configure N-S k8s service loadbalancing nodePort: + # -- Enable the Cilium NodePort service implementation. + enabled: false # -- Port range to use for NodePort services. # range: "30000,32767" @@ -2558,10 +2311,6 @@ pprof: address: localhost # -- Configure pprof listen port for cilium-agent port: 6060 - # -- Enable mutex contention profiling for cilium-agent and set the fraction of sampled events (set to 1 to sample all events) - mutexProfileFraction: 0 - # -- Enable goroutine blocking profiling for cilium-agent and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) - blockProfileRate: 0 # -- Configure prometheus metrics on the configured port at /metrics prometheus: metricsService: false @@ -2686,12 +2435,6 @@ envoy: initialFetchTimeoutSeconds: 30 # -- Maximum number of concurrent retries on Envoy clusters maxConcurrentRetries: 128 - # -- Maximum number of connections on Envoy clusters - clusterMaxConnections: 1024 - # -- Maximum number of requests on Envoy clusters - clusterMaxRequests: 1024 - # -- Maximum number of global downstream connections - maxGlobalDownstreamConnections: 50000 # -- Maximum number of retries for each HTTP request httpRetryCount: 3 # -- ProxyMaxRequestsPerConnection specifies the max_requests_per_connection setting for Envoy @@ -2708,9 +2451,6 @@ envoy: xffNumTrustedHopsL7PolicyIngress: 0 # -- Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the egress L7 policy enforcement Envoy listeners. xffNumTrustedHopsL7PolicyEgress: 0 - # -- For cases when CiliumEnvoyConfig is not used directly (Ingress, Gateway), configures Cilium BPF Metadata listener filter - # to use the original source address when extracting the metadata for a request. - useOriginalSourceAddress: true # @schema # type: [null, string] # @schema @@ -2725,12 +2465,10 @@ envoy: # @schema override: ~ repository: "quay.io/cilium/cilium-envoy" - tag: "v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa" + tag: "v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9" pullPolicy: "IfNotPresent" - digest: "sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d" + digest: "sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86" useDigest: true - # -- Init containers added to the cilium Envoy DaemonSet. - initContainers: [] # -- Additional containers added to the cilium Envoy DaemonSet. extraContainers: [] # -- Additional envoy container arguments. @@ -2961,15 +2699,16 @@ resourceQuotas: pods: "15" # Need to document default ################## +#sessionAffinity: false # -- Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) secretsNamespaceAnnotations: {} -# -- Labels to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) -secretsNamespaceLabels: {} # -- Do not run Cilium agent when running with clean mode. Useful to completely # uninstall Cilium as it will stop Cilium from starting and create artifacts # in the node. sleepAfterInit: false +# -- Enable check of service source ranges (currently, only for LoadBalancer). +svcSourceRangeCheck: true # -- Synchronize Kubernetes nodes to kvstore and perform CNP GC. synchronizeK8sNodes: true # -- Configure TLS configuration in the agent. @@ -3052,9 +2791,6 @@ tls: # @default -- `"vxlan"` tunnelProtocol: "" # -- IP family for the underlay. -# Possible values: -# - "ipv4" -# - "ipv6" # @default -- `"ipv4"` underlayProtocol: "" # -- Enable native-routing mode or tunneling mode. @@ -3075,11 +2811,6 @@ tunnelSourcePortRange: 0-0 # - reject (default) # - drop serviceNoBackendResponse: reject -# -- Configure what the response should be to pod egress traffic denied by network policy. -# Possible values: -# - none (default) -# - icmp -policyDenyResponse: none # -- Configure the underlying network MTU to overwrite auto-detected MTU. # This value doesn't change the host network interface MTU i.e. eth0 or ens0. # It changes the MTU for cilium_net@cilium_host, cilium_host@cilium_net, @@ -3110,15 +2841,15 @@ operator: # @schema override: ~ repository: "quay.io/cilium/operator" - tag: "v1.19.3" + tag: "v1.18.6" # operator-generic-digest - genericDigest: sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd + genericDigest: sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af # operator-azure-digest - azureDigest: sha256:699c1571a3df1a98882ee13610d47cffb7b34ee7e8d276096db798a5f6c7e4cb + azureDigest: sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1 # operator-aws-digest - awsDigest: sha256:a53dcbfb77282bf2ddd3abbe60f6d49762e7c1389a36cb35b71d504644a56640 + awsDigest: sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb # operator-alibabacloud-digest - alibabacloudDigest: sha256:176321a65123373ff8c7823b25183102cbad98375e8d6c80b96d68b6e8491103 + alibabacloudDigest: sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c useDigest: true pullPolicy: "IfNotPresent" suffix: "" @@ -3257,10 +2988,6 @@ operator: address: localhost # -- Configure pprof listen port for cilium-operator port: 6061 - # -- Enable mutex contention profiling for cilium-operator and set the fraction of sampled events (set to 1 to sample all events) - mutexProfileFraction: 0 - # -- Enable goroutine blocking profiling for cilium-operator and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) - blockProfileRate: 0 # -- Enable prometheus metrics for cilium-operator on the configured port at # /metrics prometheus: @@ -3294,17 +3021,6 @@ operator: # @schema # -- Metrics relabeling configs for the ServiceMonitor cilium-operator metricRelabelings: ~ - # -- TLS configuration for Prometheus - tls: - enabled: false - server: - # -- Name of the Secret containing the certificate, key and CA files for the Prometheus server. - existingSecret: "" - mtls: - # When set to true enforces mutual TLS between Operator Prometheus server and its clients. - # False allow non-mutual TLS connections. - # This option has no effect when TLS is disabled. - enabled: false # -- Grafana dashboards for cilium-operator # grafana can import dashboards based on the label and value # ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards @@ -3338,12 +3054,6 @@ operator: # -- Interval, in seconds, to check if there are any pods that are not # managed by Cilium. intervalSeconds: 15 - # -- Selector for pods that should be restarted when not managed by Cilium. - # If not set, defaults to built-in selector "k8s-app=kube-dns". Set to empty string to select all pods. - # @schema - # type: [null, string] - # @schema - selector: ~ nodeinit: # -- Enable the node initialization DaemonSet enabled: false @@ -3354,8 +3064,8 @@ nodeinit: # @schema override: ~ repository: "quay.io/cilium/startup-script" - tag: "1763560095-8f36c34" - digest: "sha256:50b9cf9c280096b59b80d2fc8ee6638facef79ac18998a22f0cbc40d5d28c16f" + tag: "1755531540-60ee83e" + digest: "sha256:5bdca3c2dec2c79f58d45a7a560bf1098c2126350c901379fe850b7f78d3d757" useDigest: true pullPolicy: "IfNotPresent" # -- The priority class to use for the nodeinit pod. @@ -3398,9 +3108,6 @@ nodeinit: # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: requests: - # @schema - # type: [integer, string] - # @schema cpu: 100m memory: 100Mi # -- Security context to be added to nodeinit pods. @@ -3423,8 +3130,6 @@ nodeinit: # -- bootstrapFile is the location of the file where the bootstrap timestamp is # written by the node-init DaemonSet bootstrapFile: "/tmp/cilium-bootstrap.d/cilium-bootstrap-time" - # -- wait for Cloud init to finish on the host and assume the node has cloud init installed - waitForCloudInit: false # -- startup offers way to customize startup nodeinit script (pre and post position) startup: preScript: "" @@ -3443,9 +3148,9 @@ preflight: # @schema override: ~ repository: "quay.io/cilium/cilium" - tag: "v1.19.3" + tag: "v1.18.6" # cilium-digest - digest: sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10 + digest: sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4 useDigest: true pullPolicy: "IfNotPresent" envoy: @@ -3456,9 +3161,9 @@ preflight: # @schema override: ~ repository: "quay.io/cilium/cilium-envoy" - tag: "v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa" + tag: "v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9" pullPolicy: "IfNotPresent" - digest: "sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d" + digest: "sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86" useDigest: true # -- The priority class to use for the preflight pod. priorityClassName: "" @@ -3558,9 +3263,7 @@ enableCriticalPriorityClass: true # on AArch64 as the images do not currently ship a version of Envoy. #disableEnvoyVersionCheck: false clustermesh: - # -- Deploy clustermesh-apiserver for clustermesh. This option is typically - # used with ``clustermesh.config.enabled=true``. Refer to the - # ``clustermesh.config.enabled=true``documentation for more information. + # -- Deploy clustermesh-apiserver for clustermesh useAPIServer: false # -- The maximum number of clusters to support in a ClusterMesh. This value # cannot be changed on running clusters, and all clusters in a ClusterMesh @@ -3568,132 +3271,44 @@ clustermesh: # maximum allocatable cluster-local identities. # Supported values are 255 and 511. maxConnectedClusters: 255 - # -- The time to live for the cache of a remote cluster after connectivity is - # lost. If the connection is not re-established within this duration, the - # cached data is revoked to prevent stale state. If not specified or set to - # 0s, the cache is never revoked (default). - cacheTTL: "0s" # -- Enable the synchronization of Kubernetes EndpointSlices corresponding to # the remote endpoints of appropriately-annotated global services through ClusterMesh enableEndpointSliceSynchronization: false - # -- Enable Multi-Cluster Services API support (deprecated; use clustermesh.mcsapi.enabled) + # -- Enable Multi-Cluster Services API support enableMCSAPISupport: false # -- Control whether policy rules assume by default the local cluster if not explicitly selected - policyDefaultLocalCluster: true + policyDefaultLocalCluster: false # -- Annotations to be added to all top-level clustermesh objects (resources under templates/clustermesh-apiserver and templates/clustermesh-config) annotations: {} # -- Clustermesh explicit configuration. config: # -- Enable the Clustermesh explicit configuration. - # If set to false, you need to provide the following resources yourself: - # - (Secret) cilium-clustermesh (used by cilium-agent/cilium-operator to connect to - # the local etcd instance if KVStoreMesh is enabled or the remote clusters - # if KVStoreMesh is disabled) - # - (Secret) cilium-kvstoremesh (used by KVStoreMesh to connect to the remote clusters) - # - (ConfigMap) clustermesh-remote-users (used to create one etcd user per remote cluster - # if clustermesh-apiserver is used and `clustermesh.apiserver.tls.authMode` is not - # set to `legacy`) enabled: false # -- Default dns domain for the Clustermesh API servers # This is used in the case cluster addresses are not provided # and IPs are used. domain: mesh.cilium.io - # -- Clusters to be peered in the mesh. - # @schema - # type: [object, array] - # @schema + # -- List of clusters to be peered in the mesh. clusters: [] - # You can use a dict of clusters (recommended): # clusters: - # # -- Name of the cluster - # cluster1: - # # -- Whether to enable this cluster in the mesh. Optional, defaults to true. - # enabled: true - # # -- Address of the cluster, use this if you created DNS records for - # # the cluster Clustermesh API server. - # address: cluster1.mesh.cilium.io - # # -- Port of the cluster Clustermesh API server. - # port: 2379 - # # -- IPs of the cluster Clustermesh API server, use multiple ones when - # # you have multiple IPs to access the Clustermesh API server. - # ips: - # - 172.18.255.201 - # # -- (deprecated) base64 encoded PEM values for the cluster client certificate, private key and certificate authority. - # # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the - # # "remote" private key and certificate available in the local cluster are automatically used instead. - # tls: - # cert: "" - # key: "" - # caCert: "" - # - # Or alternatively you can use a list of clusters: - # clusters: - # # -- Name of the cluster + # # -- Name of the cluster # - name: cluster1 - # # -- Address of the cluster, use this if you created DNS records for - # # the cluster Clustermesh API server. + # # -- Address of the cluster, use this if you created DNS records for + # # the cluster Clustermesh API server. # address: cluster1.mesh.cilium.io - # # -- Port of the cluster Clustermesh API server. + # # -- Port of the cluster Clustermesh API server. # port: 2379 - # # -- IPs of the cluster Clustermesh API server, use multiple ones when - # # you have multiple IPs to access the Clustermesh API server. + # # -- IPs of the cluster Clustermesh API server, use multiple ones when + # # you have multiple IPs to access the Clustermesh API server. # ips: # - 172.18.255.201 - # # -- (deprecated) base64 encoded PEM values for the cluster client certificate, private key and certificate authority. - # # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the - # # "remote" private key and certificate available in the local cluster are automatically used instead. + # # -- base64 encoded PEM values for the cluster client certificate, private key and certificate authority. + # # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the + # # "remote" private key and certificate available in the local cluster are automatically used instead. # tls: # cert: "" # key: "" # caCert: "" - mcsapi: - # -- Enable Multi-Cluster Services API support - enabled: false - # -- Enabled MCS-API CRDs auto-installation - installCRDs: true - corednsAutoConfigure: - # -- Enable auto-configuration of CoreDNS for Multi-Cluster Services API. - # CoreDNS MUST be at least in version v1.12.2 to run this. - enabled: false - coredns: - # -- The Deployment for the cluster CoreDNS service - deploymentName: coredns - # -- The Service Account name for the cluster CoreDNS service - serviceAccountName: coredns - # -- The ConfigMap name for the cluster CoreDNS service - configMapName: coredns - # -- The namespace for the cluster CoreDNS service - namespace: kube-system - # -- The cluster domain for the cluster CoreDNS service - clusterDomain: cluster.local - # -- The clusterset domain for the cluster CoreDNS service - clustersetDomain: clusterset.local - # -- Additional arguments to `clustermesh-apiserver coredns-mcsapi-auto-configure`. - extraArgs: [] - # -- Seconds after which the completed job pod will be deleted - ttlSecondsAfterFinished: 1800 - # -- Labels to be added to coredns-mcsapi-autoconfig pods - podLabels: {} - # -- Annotations to be added to the coredns-mcsapi-autoconfig Job - annotations: {} - # -- Node selector for coredns-mcsapi-autoconfig - # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector - nodeSelector: {} - # -- Priority class for coredns-mcsapi-autoconfig - # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass - priorityClassName: "" - # -- Node tolerations for pod assignment on nodes with taints - # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ - tolerations: [] - # -- Resource limits for coredns-mcsapi-autoconfig - # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers - resources: {} - # -- Additional coredns-mcsapi-autoconfig volumes. - extraVolumes: [] - # -- Additional coredns-mcsapi-autoconfig volumeMounts. - extraVolumeMounts: [] - # -- Affinity for coredns-mcsapi-autoconfig - affinity: {} apiserver: # -- Clustermesh API server image. image: @@ -3702,9 +3317,9 @@ clustermesh: # @schema override: ~ repository: "quay.io/cilium/clustermesh-apiserver" - tag: "v1.19.3" + tag: "v1.18.6" # clustermesh-apiserver-digest - digest: sha256:a8136a7615d6c6041d3aa6f2674d17beaec238170d669507ccc05328a778e2b7 + digest: sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b useDigest: true pullPolicy: "IfNotPresent" # -- TCP port for the clustermesh-apiserver health API. @@ -3793,12 +3408,17 @@ clustermesh: # - "external": ``clustermesh-apiserver`` will sync remote cluster information to the etcd used as kvstore. This can't be enabled with crd identity allocation mode. kvstoreMode: "internal" service: - # -- (bool) Set externallyCreated to true to create the clustermesh-apiserver service outside this helm chart. - # For example after external load balancer controllers are created. - externallyCreated: false # -- The type of service used for apiserver access. type: NodePort # -- Optional port to use as the node port for apiserver access. + # + # WARNING: make sure to configure a different NodePort in each cluster if + # kube-proxy replacement is enabled, as Cilium is currently affected by a known + # bug (#24692) when NodePorts are handled by the KPR implementation. If a service + # with the same NodePort exists both in the local and the remote cluster, all + # traffic originating from inside the cluster and targeting the corresponding + # NodePort will be redirected to a local backend, regardless of whether the + # destination node belongs to the local or the remote cluster. nodePort: 32379 # -- Annotations for the clustermesh-apiserver service. # Example annotations to configure an internal load balancer on different cloud providers: @@ -3967,15 +3587,13 @@ clustermesh: # The "remote" certificate must be generated with CN=remote- # if provided manually. Cluster mode is meaningful only when the same # CA is shared across all clusters part of the mesh. - authMode: migration - # -- (deprecated) Allow users to provide their own certificates + authMode: legacy + # -- Allow users to provide their own certificates # Users may need to provide their certificates using # a mechanism that requires they provide their own secrets. # This setting does not apply to any of the auto-generated # mechanisms below, it only restricts the creation of secrets # via the `tls-provided` templates. - # This option is deprecated as secrets are expected to be created - # externally when 'auto' is not enabled. enableSecrets: true # -- Configure automatic TLS certificates generation. # A Kubernetes CronJob is used the generate any @@ -3984,14 +3602,7 @@ clustermesh: auto: # -- When set to true, automatically generate a CA and certificates to # enable mTLS between clustermesh-apiserver and external workload instances. - # - # When set to false you need to pre-create the following secrets: - # - clustermesh-apiserver-server-cert - # - clustermesh-apiserver-admin-cert - # - clustermesh-apiserver-remote-cert - # - clustermesh-apiserver-local-cert - # The above secret should at least contains the keys `tls.crt` and `tls.key` - # and optionally `ca.crt` if a CA bundle is not configured. + # If set to false, the certs to be provided by setting appropriate values below. enabled: true # Sets the method to auto-generate certificates. Supported values: # - helm: This method uses Helm to generate all certificates. @@ -4026,9 +3637,7 @@ clustermesh: # -- base64 encoded PEM values for the clustermesh-apiserver server certificate and private key. # Used if 'auto' is not enabled. server: - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. cert: "" - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. key: "" # -- Extra DNS names added to certificate when it's auto generated extraDnsNames: [] @@ -4037,16 +3646,17 @@ clustermesh: # -- base64 encoded PEM values for the clustermesh-apiserver admin certificate and private key. # Used if 'auto' is not enabled. admin: - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. cert: "" - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. + key: "" + # -- base64 encoded PEM values for the clustermesh-apiserver client certificate and private key. + # Used if 'auto' is not enabled. + client: + cert: "" key: "" # -- base64 encoded PEM values for the clustermesh-apiserver remote cluster certificate and private key. # Used if 'auto' is not enabled. remote: - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. cert: "" - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. key: "" # clustermesh-apiserver Prometheus metrics configuration metrics: @@ -4201,7 +3811,7 @@ authentication: # -- Enable authentication processing and garbage collection. # Note that if disabled, policy enforcement will still block requests that require authentication. # But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed. - enabled: false + enabled: true # -- Buffer size of the channel Cilium uses to receive authentication events from the signal map. queueSize: 1024 # -- Buffer size of the channel Cilium uses to receive certificate expiration events from auth handlers. @@ -4239,7 +3849,7 @@ authentication: override: ~ repository: "docker.io/library/busybox" tag: "1.37.0" - digest: "sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e" + digest: "sha256:2383baad1860bbe9d8a7a843775048fd07d8afe292b94bd876df64a69aae7cb1" useDigest: true pullPolicy: "IfNotPresent" # SPIRE agent configuration @@ -4253,8 +3863,8 @@ authentication: # @schema override: ~ repository: "ghcr.io/spiffe/spire-agent" - tag: "1.9.6" - digest: "sha256:5106ac601272a88684db14daf7f54b9a45f31f77bb16a906bd5e87756ee7b97c" + tag: "1.12.4" + digest: "sha256:163970884fba18860cac93655dc32b6af85a5dcf2ebb7e3e119a10888eff8fcd" useDigest: true pullPolicy: "IfNotPresent" # -- SPIRE agent service account @@ -4308,8 +3918,8 @@ authentication: # @schema override: ~ repository: "ghcr.io/spiffe/spire-server" - tag: "1.9.6" - digest: "sha256:59a0b92b39773515e25e68a46c40d3b931b9c1860bc445a79ceb45a805cab8b4" + tag: "1.12.4" + digest: "sha256:34147f27066ab2be5cc10ca1d4bfd361144196467155d46c45f3519f41596e49" useDigest: true pullPolicy: "IfNotPresent" # -- SPIRE server service account @@ -4394,41 +4004,3 @@ authentication: enableInternalTrafficPolicy: true # -- Enable LoadBalancer IP Address Management enableLBIPAM: true -# -- Standalone DNS Proxy Configuration -# Note: The standalone DNS proxy uses the agent's dnsProxy.* configuration -# for DNS settings (proxyPort, enableDnsCompression) to ensure consistency. -standaloneDnsProxy: - # -- Enable standalone DNS proxy (alpha feature) - enabled: false - # -- Roll out Standalone DNS proxy automatically when configmap is updated. - rollOutPods: false - # -- Standalone DNS proxy annotations - annotations: {} - # -- Standalone DNS proxy debug mode - debug: false - # -- Standalone DNS proxy server port - serverPort: 10095 - # -- Standalone DNS proxy Node Selector - nodeSelector: - kubernetes.io/os: linux - # -- Standalone DNS proxy tolerations - tolerations: [] - # -- Standalone DNS proxy auto mount service account token - automountServiceAccountToken: false - # -- Standalone DNS proxy update strategy - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 2 - maxUnavailable: 0 - # -- Standalone DNS proxy image - image: - # @schema - # type: [null, string] - # @schema - override: ~ - repository: "" - tag: "" - digest: "" - useDigest: true - pullPolicy: "IfNotPresent" diff --git a/packages/system/cilium/charts/cilium/values.yaml.tmpl b/packages/system/cilium/charts/cilium/values.yaml.tmpl index 8039b40c..83b87cfd 100644 --- a/packages/system/cilium/charts/cilium/values.yaml.tmpl +++ b/packages/system/cilium/charts/cilium/values.yaml.tmpl @@ -3,6 +3,7 @@ # type: [null, string] # @schema # -- namespaceOverride allows to override the destination namespace for Cilium resources. +# This property allows to use Cilium as part of an Umbrella Chart with different targets. namespaceOverride: "" # @schema # type: [null, object] @@ -26,7 +27,7 @@ debug: # @schema # -- Configure verbosity levels for debug logging # This option is used to enable debug messages for operations related to such - # sub-system such as (e.g. kvstore, envoy, datapath, policy, or tagged), and flow is + # sub-system such as (e.g. kvstore, envoy, datapath or policy), and flow is # for enabling debug messages emitted per request, message and connection. # Multiple values can be set via a space-separated string (e.g. "datapath envoy"). # @@ -36,7 +37,6 @@ debug: # - envoy # - datapath # - policy - # - tagged verbose: ~ # -- Set the agent-internal metrics sampling frequency. This sets the @@ -207,18 +207,6 @@ serviceAccounts: name: hubble-generate-certs automount: true annotations: {} - # -- CorednsMCSAPI is used if clustermesh.mcsapi.corednsAutoConfigure.enabled=true - corednsMCSAPI: - create: true - name: cilium-coredns-mcsapi-autoconfig - automount: true - annotations: {} - # -- Ztunnel is used if encryption.type=ztunnel - ztunnel: - create: true - name: ztunnel-cilium - automount: false - annotations: {} # -- Configure termination grace period for cilium-agent DaemonSet. terminationGracePeriodSeconds: 1 # -- Install the cilium agent resources. @@ -227,22 +215,6 @@ agent: true name: cilium # -- Roll out cilium agent pods automatically when configmap is updated. rollOutCiliumPods: false -# -- Configuration for the ConfigMap drift detection feature. -# When enabled, the agent continuously watches the cilium-config ConfigMap -# and exposes a cilium_drift_checker_config_delta Prometheus metric reporting -# the number of keys that differ between the ConfigMap and the agent's active -# settings. A non-zero value indicates that the agent has not yet applied all -# current ConfigMap changes and needs to be restarted. -configDriftDetection: - # -- Enable watching of the cilium-config ConfigMap and reflecting its - # contents into the agent's internal DynamicConfig table. - enabled: true - # -- Enable the drift checker which compares the DynamicConfig table against - # the agent's active settings and publishes the - # cilium_drift_checker_config_delta metric. - driftChecker: true - # -- List of config-map keys to ignore when computing the drift delta. - ignoredKeys: [] # -- Agent container image. image: # @schema @@ -396,8 +368,6 @@ securityContext: - SETGID # Allow to execute program that changes UID (e.g. required for package installation) - SETUID - # Allow to read dmesg and get kernel pointers when kptr_restrict=1 - - SYSLOG # -- Capabilities for the `mount-cgroup` init container mountCgroup: # Only used for 'mount' cgroup @@ -470,16 +440,9 @@ azure: # clientID: 00000000-0000-0000-0000-000000000000 # clientSecret: 00000000-0000-0000-0000-000000000000 # userAssignedIdentityID: 00000000-0000-0000-0000-000000000000 - nodeSpec: - azureInterfaceName: "" alibabacloud: # -- Enable AlibabaCloud ENI integration enabled: false - nodeSpec: - vSwitches: [] - vSwitchTags: [] - securityGroups: [] - securityGroupTags: [] # -- Enable bandwidth manager to optimize TCP and UDP workloads and allow # for rate-limiting traffic from individual Pods with EDT (Earliest Departure # Time) through the "kubernetes.io/egress-bandwidth" Pod annotation. @@ -512,7 +475,8 @@ l2podAnnouncements: interface: "eth0" # -- A regular expression matching interfaces used for sending Gratuitous ARP pod announcements # interfacePattern: "" -# -- This feature set enables virtual BGP routers to be created via BGP CRDs. +# -- This feature set enables virtual BGP routers to be created via +# CiliumBGPPeeringPolicy CRDs. bgpControlPlane: # -- Enables the BGP control plane. enabled: false @@ -522,9 +486,9 @@ bgpControlPlane: create: false # -- The name of the secret namespace to which Cilium agents are given read access name: kube-system - # -- Status reporting settings + # -- Status reporting settings (BGPv2 only) statusReport: - # -- Enable/Disable BGP status reporting + # -- Enable/Disable BGPv2 status reporting # It is recommended to enable status reporting in general, but if you have any issue # such as high API server load, you can disable it by setting this to false. enabled: true @@ -534,7 +498,7 @@ bgpControlPlane: mode: "default" # -- IP pool to allocate the BGP router-id from when the mode is ip-pool. ipPool: "" - # -- Legacy BGP ORIGIN attribute settings + # -- Legacy BGP ORIGIN attribute settings (BGPv2 only) legacyOriginAttribute: # -- Enable/Disable advertising LoadBalancerIP routes with the legacy # BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0). @@ -544,11 +508,6 @@ pmtuDiscovery: # -- Enable path MTU discovery to send ICMP fragmentation-needed replies to # the client. enabled: false - # -- Enable kernel probing path MTU discovery for Pods which uses different message - # sizes to search for correct MTU value. - # Valid values are: always, blackhole, disabled and unset (or empty). If value - # is 'unset' or left empty then will not try to override setting. - packetizationLayerPMTUDMode: "blackhole" bpf: autoMount: # -- Enable automatic mount of BPF filesystem @@ -596,7 +555,7 @@ bpf: # Helm configuration for BPF events map rate limiting is experimental and might change # in upcoming releases. events: - # -- Default settings for all types of events except dbg. + # -- Default settings for all types of events except dbg and pcap. default: # @schema # type: [null, integer] @@ -656,12 +615,6 @@ bpf: # type: [null, integer] # @schema policyMapMax: 16384 - # -- (float64) Configure threshold for emitting pressure metrics of policy maps. - # @schema - # type: [null, number] - # @schema - # @default -- `0.1` - policyMapPressureMetricsThreshold: ~ # -- Configure the maximum number of entries in global policy stats map. # @schema # type: [null, integer] @@ -719,8 +672,7 @@ bpf: # type: [null, boolean] # @schema # -- (bool) Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules - # for implementing Layer 7 policy. Note this is incompatible with netkit (`bpf.datapathMode=netkit`, - # `bpf.datapathMode=netkit-l2`). + # for implementing Layer 7 policy. # @default -- `false` tproxy: ~ # @schema @@ -730,15 +682,6 @@ bpf: # [0] will allow all VLAN id's without any filtering. # @default -- `[]` vlanBypass: ~ - # -- Configure the IP tracing option type. - # This option is used to specify the IP option type to use for tracing. - # The value must be an integer between 0 and 255. - # @schema - # type: [null, integer] - # minimum: 0 - # maximum: 255 - # @schema - monitorTraceIPOption: 0 # -- (bool) Disable ExternalIP mitigation (CVE-2020-8554) # @default -- `false` disableExternalIPMitigation: false @@ -746,8 +689,7 @@ bpf: # supported kernels. # @default -- `true` enableTCX: true - # -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2). - # Note netkit is incompatible with TPROXY (`bpf.tproxy`). + # -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2) # @default -- `veth` datapathMode: veth # -- Enable BPF clock source probing for more efficient tick retrieval. @@ -836,17 +778,8 @@ cni: # -- Specifies the resources for the cni initContainer resources: requests: - # @schema - # type: [integer, string] - # @schema cpu: 100m memory: 10Mi - limits: - # @schema - # type: [integer, string] - # @schema - cpu: 1 - memory: 1Gi # -- Enable route MTU for pod netns when CNI chaining is used enableRouteMTUForCNIChaining: false # -- Enable the removal of iptables rules created by the AWS CNI VPC plugin. @@ -871,6 +804,10 @@ conntrackGCMaxInterval: "" # -- (string) Configure timeout in which Cilium will exit if CRDs are not available # @default -- `"5m"` crdWaitTimeout: "" +# -- Tail call hooks for custom eBPF programs. +customCalls: + # -- Enable tail call hooks for custom eBPF programs. + enabled: false daemon: # -- Configure where Cilium runtime state should be stored. runPath: "/var/run/cilium" @@ -913,13 +850,6 @@ daemon: # # By default, this functionality is enabled enableSourceIPVerification: true - -# -- Configure temporary volume for cilium-agent -tmpVolume: {} - # emptyDir: - # sizeLimit: "100Mi" - # medium: "Memory" - # -- Specify which network interfaces can run the eBPF datapath. This means # that a packet sent from a pod to a destination outside the cluster will be # masqueraded (to an output device IPv4 address), if the output device runs the @@ -939,6 +869,9 @@ forceDeviceDetection: false # -- Enable setting identity mark for local traffic. # enableIdentityMark: true +# -- Enable Kubernetes EndpointSlice feature in Cilium if the cluster supports it. +# enableK8sEndpointSlice: true + # -- CiliumEndpointSlice configuration options. ciliumEndpointSlice: # -- Enable Cilium EndpointSlice feature. @@ -1123,33 +1056,20 @@ enableXTSocketFallback: true encryption: # -- Enable transparent network encryption. enabled: false - # -- Encryption method. Can be one of ipsec, wireguard or ztunnel. + # -- Encryption method. Can be either ipsec or wireguard. type: ipsec # -- Enable encryption for pure node to node traffic. # This option is only effective when encryption.type is set to "wireguard". nodeEncryption: false - # -- Configure the Encryption Pod2Pod strict mode. + # -- Configure the WireGuard Pod2Pod strict mode. strictMode: - # -- Enable Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.enabled) + # -- Enable WireGuard Pod2Pod strict mode. enabled: false - # -- CIDR for the Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.cidr) + # -- CIDR for the WireGuard Pod2Pod strict mode. cidr: "" - # -- Allow dynamic lookup of remote node identities. (deprecated: please use encryption.strictMode.egress.allowRemoteNodeIdentities) + # -- Allow dynamic lookup of remote node identities. # This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. allowRemoteNodeIdentities: false - egress: - # -- Enable strict egress encryption. - enabled: false - # -- CIDR for the Encryption Pod2Pod strict egress mode. - cidr: "" - # -- Allow dynamic lookup of remote node identities. - # This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. - allowRemoteNodeIdentities: false - ingress: - # -- Enable strict ingress encryption. - # When enabled, all unencrypted overlay ingress traffic will be dropped. - # This option is only applicable when WireGuard and tunneling are enabled. - enabled: false ipsec: # -- Name of the key file inside the Kubernetes secret configured via secretName. keyFile: keys @@ -1170,89 +1090,9 @@ encryption: wireguard: # -- Controls WireGuard PersistentKeepalive option. Set 0s to disable. persistentKeepalive: 0s - # -- ztunnel encryption configuration. - # ztunnel is Istio's purpose-built, per-node proxy for handling L4 traffic in ambient mesh mode. - # These settings only apply when encryption.type is set to "ztunnel". - ztunnel: - # -- ztunnel container image. - image: - # @schema - # type: [null, string] - # @schema - override: ~ - repository: "docker.io/istio/ztunnel" - tag: "1.28.0-distroless" - pullPolicy: "IfNotPresent" - # @schema - # type: [null, string] - # @schema - digest: ~ - useDigest: false - # -- CA server address for certificate requests. - caAddress: "https://localhost:15012" - # -- TCP port for the health API. - healthPort: 15021 - # -- ztunnel resource limits & requests. - resources: - requests: - cpu: 200m - memory: 512Mi - # -- ztunnel update strategy. - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - # -- Configure termination grace period for ztunnel DaemonSet. - terminationGracePeriodSeconds: 30 - # -- Readiness probe configuration. - readinessProbe: - initialDelaySeconds: 0 - periodSeconds: 10 - failureThreshold: 3 - # -- Node selector for ztunnel pods. - nodeSelector: - kubernetes.io/os: linux - # -- Node tolerations for ztunnel scheduling. - tolerations: - - effect: NoSchedule - operator: Exists - - key: CriticalAddonsOnly - operator: Exists - - effect: NoExecute - operator: Exists - # -- Affinity for ztunnel pods. - affinity: {} - # @schema - # type: [null, string] - # @schema - # -- The priority class to use for ztunnel pods. - priorityClassName: ~ - # -- Annotations to be added to all ztunnel resources. - annotations: {} - # -- Annotations to be added to ztunnel pods. - podAnnotations: {} - # -- Labels to be added to ztunnel pods. - podLabels: {} - # -- Additional ztunnel container environment variables. - extraEnv: [] - # -- Additional ztunnel volumes. - extraVolumes: [] - # -- Additional ztunnel volumeMounts. - extraVolumeMounts: [] - # -- ztunnel secrets configuration. - secrets: - # -- Base64-encoded bootstrap root certificate content. - # If not provided, the secret must be created manually before deploying. - # @schema - # type: [null, string] - # @schema - bootstrapRootCert: ~ endpointHealthChecking: # -- Enable connectivity health checking between virtual endpoints. enabled: true -# -- Max duration to wait for envoy to respond to configuration changes. Default "10s". -endpointPolicyUpdateTimeoutDuration: null endpointRoutes: # @schema # type: [boolean, string] @@ -1301,33 +1141,6 @@ eni: # -- Filter via AWS EC2 Instance tags (k=v) which will dictate which AWS EC2 Instances # are going to be used to create new ENIs instanceTagsFilter: [] - # -- NodeSpec configuration for the ENI - nodeSpec: - # -- First interface index to use for IP allocation - # @schema - # type: [null, integer] - # @schema - firstInterfaceIndex: ~ - # -- Subnet IDs to use for IP allocation - subnetIDs: [] - # -- Subnet tags to use for IP allocation - subnetTags: [] - # -- Security groups to use for IP allocation - securityGroups: [] - # -- Security group tags to use for IP allocation - securityGroupTags: [] - # -- Exclude interface tags to use for IP allocation - excludeInterfaceTags: [] - # -- Use primary address for IP allocation - usePrimaryAddress: false - # -- Disable prefix delegation for IP allocation - disablePrefixDelegation: false - # -- Delete ENI on termination - # @schema - # type: [null, boolean] - # @schema - deleteOnTermination: ~ - # fragmentTracking enables IPv4 fragment tracking support in the datapath. # fragmentTracking: true gke: @@ -1343,8 +1156,6 @@ healthCheckICMPFailureThreshold: 3 hostFirewall: # -- Enables the enforcement of host policies in the eBPF datapath. enabled: false -# -- Enable routing to a service that has zero endpoints -enableNoServiceEndpointsRoutable: true # -- Configure socket LB socketLB: # -- Enable socket LB @@ -1372,11 +1183,8 @@ certgen: digest: "${CERTGEN_DIGEST}" useDigest: true pullPolicy: "${PULL_POLICY}" - # @schema - # type: [null, integer] - # @schema # -- Seconds after which the completed job pod will be deleted - ttlSecondsAfterFinished: null + ttlSecondsAfterFinished: 1800 # -- Labels to be added to hubble-certgen pods podLabels: {} # -- Annotations to be added to the hubble-certgen initial Job and CronJob @@ -1401,11 +1209,6 @@ certgen: extraVolumeMounts: [] # -- Affinity for certgen affinity: {} - cronJob: - # -- The number of successful finished jobs to keep - successfulJobsHistoryLimit: 3 - # -- The number of failed finished jobs to keep - failedJobsHistoryLimit: 1 hubble: # -- Enable Hubble (true by default). enabled: true @@ -1421,9 +1224,6 @@ hubble: # 2047, 4095, 8191, 16383, 32767, 65535 # eventBufferCapacity: "4095" - # -- The interval at which Hubble will send out lost events from the Observer server, if any. - # lostEventSendInterval: 1s - # -- Hubble metrics configuration. # See https://docs.cilium.io/en/stable/observability/metrics/#hubble-metrics # for more comprehensive documentation about Hubble metrics. @@ -1930,24 +1730,6 @@ hubble: address: localhost # -- Configure pprof listen port for hubble-relay port: 6062 - # -- Enable mutex contention profiling for hubble-relay and set the fraction of sampled events (set to 1 to sample all events) - mutexProfileFraction: 0 - # -- Enable goroutine blocking profiling for hubble-relay and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) - blockProfileRate: 0 - # -- Logging configuration for hubble-relay. - logOptions: - # @schema - # type: [null, string] - # @schema - # -- Log format for hubble-relay. Valid values are: text, text-ts, json, json-ts. - # @default -- text-ts - format: ~ - # @schema - # type: [null, string] - # @schema - # -- Log level for hubble-relay. Valid values are: debug, info, warn, error. - # @default -- info - level: ~ ui: # -- Whether to enable the Hubble UI. enabled: false @@ -2143,13 +1925,6 @@ hubble: # - secretName: chart-example-tls # hosts: # - chart-example.local - - # -- Configure temporary volume for hubble-ui - tmpVolume: {} - # emptyDir: - # # sizeLimit: "100Mi" - # # medium: "Memory" - # -- Hubble flows export. export: # --- Static exporter configuration. @@ -2162,14 +1937,6 @@ hubble: # - source # - destination # - verdict - fieldAggregate: [] - # - time - # - source - # - destination - # - verdict - # --- Defines the interval at which to aggregate before exporting Hubble flows. - # Aggregation feature is only enabled when fieldAggregate is specified and aggregationInterval > 0s. - aggregationInterval: "0s" allowList: [] # - '{"verdict":["DROPPED","ERROR"]}' denyList: [] @@ -2195,8 +1962,6 @@ hubble: content: - name: all fieldMask: [] - fieldAggregate: [] - aggregationInterval: "0s" includeFilters: [] excludeFilters: [] filePath: "/var/run/cilium/hubble/events.log" @@ -2291,30 +2056,11 @@ ipam: # refill the bucket up to the burst size capacity. # @default -- `4.0` externalAPILimitQPS: ~ - # -- NodeSpec configuration for the IPAM - nodeSpec: - # -- IPAM min allocate - # @schema - # type: [null, integer] - # @schema - ipamMinAllocate: ~ - # -- IPAM pre allocate - # @schema - # type: [null, integer] - # @schema - ipamPreAllocate: ~ - # -- IPAM max allocate - # @schema - # type: [null, integer] - # @schema - ipamMaxAllocate: ~ - # -- IPAM static IP tags (currently only works with AWS and Azure) - ipamStaticIPTags: [] +# -- defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when +# no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none # @schema # type: [string] # @schema -# -- defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when -# no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none defaultLBServiceIPAM: lbipam nodeIPAM: # -- Configure Node IPAM @@ -2401,7 +2147,7 @@ localRedirectPolicy: false localRedirectPolicies: # -- Enable local redirect policies. enabled: false - + # -- Limit the allowed addresses in Address Matcher rule of # Local Redirect Policies to the given CIDRs. # @schema@ @@ -2431,7 +2177,7 @@ maglev: {} # type: [null, boolean] # @schema # -- (bool) Enables masquerading of IPv4 traffic leaving the node from endpoints. -# @default -- `true` unless ipam eni mode is active +# @default -- `true` unless ipam eni mode is active enableIPv4Masquerade: ~ # -- Enables masquerading of IPv6 traffic leaving the node from endpoints. enableIPv6Masquerade: true @@ -2520,7 +2266,7 @@ loadBalancer: # -- serviceTopology enables K8s Topology Aware Hints -based service # endpoints filtering - serviceTopology: false + # serviceTopology: false # -- L7 LoadBalancer l7: @@ -2544,6 +2290,8 @@ loadBalancer: algorithm: round_robin # -- Configure N-S k8s service loadbalancing nodePort: + # -- Enable the Cilium NodePort service implementation. + enabled: false # -- Port range to use for NodePort services. # range: "30000,32767" @@ -2588,10 +2336,6 @@ pprof: address: localhost # -- Configure pprof listen port for cilium-agent port: 6060 - # -- Enable mutex contention profiling for cilium-agent and set the fraction of sampled events (set to 1 to sample all events) - mutexProfileFraction: 0 - # -- Enable goroutine blocking profiling for cilium-agent and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) - blockProfileRate: 0 # -- Configure prometheus metrics on the configured port at /metrics prometheus: metricsService: false @@ -2716,12 +2460,6 @@ envoy: initialFetchTimeoutSeconds: 30 # -- Maximum number of concurrent retries on Envoy clusters maxConcurrentRetries: 128 - # -- Maximum number of connections on Envoy clusters - clusterMaxConnections: 1024 - # -- Maximum number of requests on Envoy clusters - clusterMaxRequests: 1024 - # -- Maximum number of global downstream connections - maxGlobalDownstreamConnections: 50000 # -- Maximum number of retries for each HTTP request httpRetryCount: 3 # -- ProxyMaxRequestsPerConnection specifies the max_requests_per_connection setting for Envoy @@ -2738,9 +2476,6 @@ envoy: xffNumTrustedHopsL7PolicyIngress: 0 # -- Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the egress L7 policy enforcement Envoy listeners. xffNumTrustedHopsL7PolicyEgress: 0 - # -- For cases when CiliumEnvoyConfig is not used directly (Ingress, Gateway), configures Cilium BPF Metadata listener filter - # to use the original source address when extracting the metadata for a request. - useOriginalSourceAddress: true # @schema # type: [null, string] # @schema @@ -2759,8 +2494,6 @@ envoy: pullPolicy: "${PULL_POLICY}" digest: "${CILIUM_ENVOY_DIGEST}" useDigest: true - # -- Init containers added to the cilium Envoy DaemonSet. - initContainers: [] # -- Additional containers added to the cilium Envoy DaemonSet. extraContainers: [] # -- Additional envoy container arguments. @@ -2993,16 +2726,17 @@ resourceQuotas: pods: "15" # Need to document default ################## +#sessionAffinity: false # -- Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) secretsNamespaceAnnotations: {} -# -- Labels to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) -secretsNamespaceLabels: {} # -- Do not run Cilium agent when running with clean mode. Useful to completely # uninstall Cilium as it will stop Cilium from starting and create artifacts # in the node. sleepAfterInit: false +# -- Enable check of service source ranges (currently, only for LoadBalancer). +svcSourceRangeCheck: true # -- Synchronize Kubernetes nodes to kvstore and perform CNP GC. synchronizeK8sNodes: true # -- Configure TLS configuration in the agent. @@ -3085,9 +2819,6 @@ tls: # @default -- `"vxlan"` tunnelProtocol: "" # -- IP family for the underlay. -# Possible values: -# - "ipv4" -# - "ipv6" # @default -- `"ipv4"` underlayProtocol: "" # -- Enable native-routing mode or tunneling mode. @@ -3108,11 +2839,6 @@ tunnelSourcePortRange: 0-0 # - reject (default) # - drop serviceNoBackendResponse: reject -# -- Configure what the response should be to pod egress traffic denied by network policy. -# Possible values: -# - none (default) -# - icmp -policyDenyResponse: none # -- Configure the underlying network MTU to overwrite auto-detected MTU. # This value doesn't change the host network interface MTU i.e. eth0 or ens0. # It changes the MTU for cilium_net@cilium_host, cilium_host@cilium_net, @@ -3198,7 +2924,7 @@ operator: # @schema # type: [null, array] # @schema - tolerations: + tolerations: - key: "node-role.kubernetes.io/control-plane" operator: Exists - key: "node-role.kubernetes.io/master" #deprecated @@ -3290,10 +3016,6 @@ operator: address: localhost # -- Configure pprof listen port for cilium-operator port: 6061 - # -- Enable mutex contention profiling for cilium-operator and set the fraction of sampled events (set to 1 to sample all events) - mutexProfileFraction: 0 - # -- Enable goroutine blocking profiling for cilium-operator and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) - blockProfileRate: 0 # -- Enable prometheus metrics for cilium-operator on the configured port at # /metrics prometheus: @@ -3327,17 +3049,6 @@ operator: # @schema # -- Metrics relabeling configs for the ServiceMonitor cilium-operator metricRelabelings: ~ - # -- TLS configuration for Prometheus - tls: - enabled: false - server: - # -- Name of the Secret containing the certificate, key and CA files for the Prometheus server. - existingSecret: "" - mtls: - # When set to true enforces mutual TLS between Operator Prometheus server and its clients. - # False allow non-mutual TLS connections. - # This option has no effect when TLS is disabled. - enabled: false # -- Grafana dashboards for cilium-operator # grafana can import dashboards based on the label and value # ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards @@ -3371,12 +3082,6 @@ operator: # -- Interval, in seconds, to check if there are any pods that are not # managed by Cilium. intervalSeconds: 15 - # -- Selector for pods that should be restarted when not managed by Cilium. - # If not set, defaults to built-in selector "k8s-app=kube-dns". Set to empty string to select all pods. - # @schema - # type: [null, string] - # @schema - selector: ~ nodeinit: # -- Enable the node initialization DaemonSet enabled: false @@ -3431,9 +3136,6 @@ nodeinit: # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: requests: - # @schema - # type: [integer, string] - # @schema cpu: 100m memory: 100Mi # -- Security context to be added to nodeinit pods. @@ -3458,8 +3160,6 @@ nodeinit: # -- bootstrapFile is the location of the file where the bootstrap timestamp is # written by the node-init DaemonSet bootstrapFile: "/tmp/cilium-bootstrap.d/cilium-bootstrap-time" - # -- wait for Cloud init to finish on the host and assume the node has cloud init installed - waitForCloudInit: false # -- startup offers way to customize startup nodeinit script (pre and post position) startup: preScript: "" @@ -3593,9 +3293,7 @@ enableCriticalPriorityClass: true # on AArch64 as the images do not currently ship a version of Envoy. #disableEnvoyVersionCheck: false clustermesh: - # -- Deploy clustermesh-apiserver for clustermesh. This option is typically - # used with ``clustermesh.config.enabled=true``. Refer to the - # ``clustermesh.config.enabled=true``documentation for more information. + # -- Deploy clustermesh-apiserver for clustermesh useAPIServer: false # -- The maximum number of clusters to support in a ClusterMesh. This value # cannot be changed on running clusters, and all clusters in a ClusterMesh @@ -3603,133 +3301,45 @@ clustermesh: # maximum allocatable cluster-local identities. # Supported values are 255 and 511. maxConnectedClusters: 255 - # -- The time to live for the cache of a remote cluster after connectivity is - # lost. If the connection is not re-established within this duration, the - # cached data is revoked to prevent stale state. If not specified or set to - # 0s, the cache is never revoked (default). - cacheTTL: "0s" # -- Enable the synchronization of Kubernetes EndpointSlices corresponding to # the remote endpoints of appropriately-annotated global services through ClusterMesh enableEndpointSliceSynchronization: false - # -- Enable Multi-Cluster Services API support (deprecated; use clustermesh.mcsapi.enabled) + # -- Enable Multi-Cluster Services API support enableMCSAPISupport: false # -- Control whether policy rules assume by default the local cluster if not explicitly selected - policyDefaultLocalCluster: true + policyDefaultLocalCluster: false # -- Annotations to be added to all top-level clustermesh objects (resources under templates/clustermesh-apiserver and templates/clustermesh-config) annotations: {} # -- Clustermesh explicit configuration. config: # -- Enable the Clustermesh explicit configuration. - # If set to false, you need to provide the following resources yourself: - # - (Secret) cilium-clustermesh (used by cilium-agent/cilium-operator to connect to - # the local etcd instance if KVStoreMesh is enabled or the remote clusters - # if KVStoreMesh is disabled) - # - (Secret) cilium-kvstoremesh (used by KVStoreMesh to connect to the remote clusters) - # - (ConfigMap) clustermesh-remote-users (used to create one etcd user per remote cluster - # if clustermesh-apiserver is used and `clustermesh.apiserver.tls.authMode` is not - # set to `legacy`) enabled: false # -- Default dns domain for the Clustermesh API servers # This is used in the case cluster addresses are not provided # and IPs are used. domain: mesh.cilium.io - # -- Clusters to be peered in the mesh. - # @schema - # type: [object, array] - # @schema + # -- List of clusters to be peered in the mesh. clusters: [] - # You can use a dict of clusters (recommended): # clusters: - # # -- Name of the cluster - # cluster1: - # # -- Whether to enable this cluster in the mesh. Optional, defaults to true. - # enabled: true - # # -- Address of the cluster, use this if you created DNS records for - # # the cluster Clustermesh API server. - # address: cluster1.mesh.cilium.io - # # -- Port of the cluster Clustermesh API server. - # port: 2379 - # # -- IPs of the cluster Clustermesh API server, use multiple ones when - # # you have multiple IPs to access the Clustermesh API server. - # ips: - # - 172.18.255.201 - # # -- (deprecated) base64 encoded PEM values for the cluster client certificate, private key and certificate authority. - # # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the - # # "remote" private key and certificate available in the local cluster are automatically used instead. - # tls: - # cert: "" - # key: "" - # caCert: "" - # - # Or alternatively you can use a list of clusters: - # clusters: - # # -- Name of the cluster + # # -- Name of the cluster # - name: cluster1 - # # -- Address of the cluster, use this if you created DNS records for - # # the cluster Clustermesh API server. + # # -- Address of the cluster, use this if you created DNS records for + # # the cluster Clustermesh API server. # address: cluster1.mesh.cilium.io - # # -- Port of the cluster Clustermesh API server. + # # -- Port of the cluster Clustermesh API server. # port: 2379 - # # -- IPs of the cluster Clustermesh API server, use multiple ones when - # # you have multiple IPs to access the Clustermesh API server. + # # -- IPs of the cluster Clustermesh API server, use multiple ones when + # # you have multiple IPs to access the Clustermesh API server. # ips: # - 172.18.255.201 - # # -- (deprecated) base64 encoded PEM values for the cluster client certificate, private key and certificate authority. - # # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the - # # "remote" private key and certificate available in the local cluster are automatically used instead. + # # -- base64 encoded PEM values for the cluster client certificate, private key and certificate authority. + # # These fields can (and should) be omitted in case the CA is shared across clusters. In that case, the + # # "remote" private key and certificate available in the local cluster are automatically used instead. # tls: # cert: "" # key: "" # caCert: "" - mcsapi: - # -- Enable Multi-Cluster Services API support - enabled: false - # -- Enabled MCS-API CRDs auto-installation - installCRDs: true - corednsAutoConfigure: - # -- Enable auto-configuration of CoreDNS for Multi-Cluster Services API. - # CoreDNS MUST be at least in version v1.12.2 to run this. - enabled: false - coredns: - # -- The Deployment for the cluster CoreDNS service - deploymentName: coredns - # -- The Service Account name for the cluster CoreDNS service - serviceAccountName: coredns - # -- The ConfigMap name for the cluster CoreDNS service - configMapName: coredns - # -- The namespace for the cluster CoreDNS service - namespace: kube-system - # -- The cluster domain for the cluster CoreDNS service - clusterDomain: cluster.local - # -- The clusterset domain for the cluster CoreDNS service - clustersetDomain: clusterset.local - # -- Additional arguments to `clustermesh-apiserver coredns-mcsapi-auto-configure`. - extraArgs: [] - # -- Seconds after which the completed job pod will be deleted - ttlSecondsAfterFinished: 1800 - # -- Labels to be added to coredns-mcsapi-autoconfig pods - podLabels: {} - # -- Annotations to be added to the coredns-mcsapi-autoconfig Job - annotations: {} - # -- Node selector for coredns-mcsapi-autoconfig - # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector - nodeSelector: {} - # -- Priority class for coredns-mcsapi-autoconfig - # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass - priorityClassName: "" - # -- Node tolerations for pod assignment on nodes with taints - # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ - tolerations: [] - # -- Resource limits for coredns-mcsapi-autoconfig - # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers - resources: {} - # -- Additional coredns-mcsapi-autoconfig volumes. - extraVolumes: [] - # -- Additional coredns-mcsapi-autoconfig volumeMounts. - extraVolumeMounts: [] - # -- Affinity for coredns-mcsapi-autoconfig - affinity: {} apiserver: # -- Clustermesh API server image. image: @@ -3835,12 +3445,17 @@ clustermesh: # - "external": ``clustermesh-apiserver`` will sync remote cluster information to the etcd used as kvstore. This can't be enabled with crd identity allocation mode. kvstoreMode: "internal" service: - # -- (bool) Set externallyCreated to true to create the clustermesh-apiserver service outside this helm chart. - # For example after external load balancer controllers are created. - externallyCreated: false # -- The type of service used for apiserver access. type: NodePort # -- Optional port to use as the node port for apiserver access. + # + # WARNING: make sure to configure a different NodePort in each cluster if + # kube-proxy replacement is enabled, as Cilium is currently affected by a known + # bug (#24692) when NodePorts are handled by the KPR implementation. If a service + # with the same NodePort exists both in the local and the remote cluster, all + # traffic originating from inside the cluster and targeting the corresponding + # NodePort will be redirected to a local backend, regardless of whether the + # destination node belongs to the local or the remote cluster. nodePort: 32379 # -- Annotations for the clustermesh-apiserver service. # Example annotations to configure an internal load balancer on different cloud providers: @@ -4009,15 +3624,13 @@ clustermesh: # The "remote" certificate must be generated with CN=remote- # if provided manually. Cluster mode is meaningful only when the same # CA is shared across all clusters part of the mesh. - authMode: migration - # -- (deprecated) Allow users to provide their own certificates + authMode: legacy + # -- Allow users to provide their own certificates # Users may need to provide their certificates using # a mechanism that requires they provide their own secrets. # This setting does not apply to any of the auto-generated # mechanisms below, it only restricts the creation of secrets # via the `tls-provided` templates. - # This option is deprecated as secrets are expected to be created - # externally when 'auto' is not enabled. enableSecrets: true # -- Configure automatic TLS certificates generation. # A Kubernetes CronJob is used the generate any @@ -4026,14 +3639,7 @@ clustermesh: auto: # -- When set to true, automatically generate a CA and certificates to # enable mTLS between clustermesh-apiserver and external workload instances. - # - # When set to false you need to pre-create the following secrets: - # - clustermesh-apiserver-server-cert - # - clustermesh-apiserver-admin-cert - # - clustermesh-apiserver-remote-cert - # - clustermesh-apiserver-local-cert - # The above secret should at least contains the keys `tls.crt` and `tls.key` - # and optionally `ca.crt` if a CA bundle is not configured. + # If set to false, the certs to be provided by setting appropriate values below. enabled: true # Sets the method to auto-generate certificates. Supported values: # - helm: This method uses Helm to generate all certificates. @@ -4065,13 +3671,10 @@ clustermesh: # name: ca-issuer # -- certmanager issuer used when clustermesh.apiserver.tls.auto.method=certmanager. certManagerIssuerRef: {} - # -- base64 encoded PEM values for the clustermesh-apiserver server certificate and private key. # Used if 'auto' is not enabled. server: - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. cert: "" - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. key: "" # -- Extra DNS names added to certificate when it's auto generated extraDnsNames: [] @@ -4080,16 +3683,17 @@ clustermesh: # -- base64 encoded PEM values for the clustermesh-apiserver admin certificate and private key. # Used if 'auto' is not enabled. admin: - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. cert: "" - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. + key: "" + # -- base64 encoded PEM values for the clustermesh-apiserver client certificate and private key. + # Used if 'auto' is not enabled. + client: + cert: "" key: "" # -- base64 encoded PEM values for the clustermesh-apiserver remote cluster certificate and private key. # Used if 'auto' is not enabled. remote: - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. cert: "" - # -- Deprecated, as secrets will always need to be created externally if `auto` is disabled. key: "" # clustermesh-apiserver Prometheus metrics configuration metrics: @@ -4244,7 +3848,7 @@ authentication: # -- Enable authentication processing and garbage collection. # Note that if disabled, policy enforcement will still block requests that require authentication. # But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed. - enabled: false + enabled: true # -- Buffer size of the channel Cilium uses to receive authentication events from the signal map. queueSize: 1024 # -- Buffer size of the channel Cilium uses to receive certificate expiration events from auth handlers. @@ -4437,41 +4041,4 @@ authentication: enableInternalTrafficPolicy: true # -- Enable LoadBalancer IP Address Management enableLBIPAM: true -# -- Standalone DNS Proxy Configuration -# Note: The standalone DNS proxy uses the agent's dnsProxy.* configuration -# for DNS settings (proxyPort, enableDnsCompression) to ensure consistency. -standaloneDnsProxy: - # -- Enable standalone DNS proxy (alpha feature) - enabled: false - # -- Roll out Standalone DNS proxy automatically when configmap is updated. - rollOutPods: false - # -- Standalone DNS proxy annotations - annotations: {} - # -- Standalone DNS proxy debug mode - debug: false - # -- Standalone DNS proxy server port - serverPort: 10095 - # -- Standalone DNS proxy Node Selector - nodeSelector: - kubernetes.io/os: linux - # -- Standalone DNS proxy tolerations - tolerations: [] - # -- Standalone DNS proxy auto mount service account token - automountServiceAccountToken: false - # -- Standalone DNS proxy update strategy - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 2 - maxUnavailable: 0 - # -- Standalone DNS proxy image - image: - # @schema - # type: [null, string] - # @schema - override: ~ - repository: "${STANDALONE_DNS_PROXY_REPO}" - tag: "${STANDALONE_DNS_PROXY_VERSION}" - digest: "${STANDALONE_DNS_PROXY_DIGEST}" - useDigest: ${USE_DIGESTS} - pullPolicy: "${PULL_POLICY}" + diff --git a/packages/system/cilium/images/cilium/Dockerfile b/packages/system/cilium/images/cilium/Dockerfile index 32fc6fb8..ebe65c83 100644 --- a/packages/system/cilium/images/cilium/Dockerfile +++ b/packages/system/cilium/images/cilium/Dockerfile @@ -1,2 +1,2 @@ -ARG VERSION=v1.19.3 +ARG VERSION=v1.18.6 FROM quay.io/cilium/cilium:${VERSION} diff --git a/packages/system/cilium/values-apparmor.yaml b/packages/system/cilium/values-apparmor.yaml deleted file mode 100644 index 0712836c..00000000 --- a/packages/system/cilium/values-apparmor.yaml +++ /dev/null @@ -1,20 +0,0 @@ -cilium: - # Opt out of the cri-containerd.apparmor.d profile for containers that invoke - # nsenter to join the host cgroup/mount namespace. The kernel reports the - # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and - # other distros that load this AppArmor profile by default, where the - # denial otherwise puts cilium-agent into Init:CrashLoopBackOff. - # The deprecated annotations are used because k8s >= 1.30 pod-level - # appArmorProfile: Unconfined is not honoured by containerd CRI today - # (kubernetes/kubernetes#125069). - # Only applied on non-Talos cilium variants where cgroup.autoMount.enabled is - # true — on Talos mount-cgroup is not rendered and the kube-apiserver would - # reject an annotation referencing a non-existent container. - # mount-bpf-fs is intentionally excluded: it renders with its own - # securityContext.privileged=true, and the kernel does not apply AppArmor - # profiles to privileged containers. - podAnnotations: - container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined - container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined - container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined - container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index 9aba7cb9..1d94b1cf 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -15,8 +15,8 @@ cilium: mode: "kubernetes" image: repository: ghcr.io/cozystack/cozystack/cilium - tag: 1.19.3 - digest: "sha256:700f06f4803a838a8e830be5ace4650e3ad82bdefabfb2f4d110368d307a5efb" + tag: 1.18.6 + digest: "sha256:4f4585f8adc3b8becd15d3999f3900a4d3d650f2ab7f85ca8c661f3807113d01" envoy: enabled: false rollOutCiliumPods: true diff --git a/packages/system/clickhouse-rd/cozyrds/clickhouse.yaml b/packages/system/clickhouse-rd/cozyrds/clickhouse.yaml index 3655a8db..eb6c67f6 100644 --- a/packages/system/clickhouse-rd/cozyrds/clickhouse.yaml +++ b/packages/system/clickhouse-rd/cozyrds/clickhouse.yaml @@ -8,7 +8,7 @@ spec: singular: clickhouse plural: clickhouses openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of ClickHouse replicas.","type":"integer","default":2},"shards":{"description":"Number of ClickHouse shards.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"logStorageSize":{"description":"Size of Persistent Volume for logs.","default":"2Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"logTTL":{"description":"TTL (expiration time) for `query_log` and `query_thread_log`.","type":"integer","default":15},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"readonly":{"description":"User is readonly (default: false).","type":"boolean"}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":""},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/clickhouse-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"clickhouseKeeper":{"description":"ClickHouse Keeper configuration.","type":"object","default":{},"properties":{"enabled":{"description":"Deploy ClickHouse Keeper for cluster coordination.","type":"boolean","default":true},"replicas":{"description":"Number of Keeper replicas.","type":"integer","default":3},"resourcesPreset":{"description":"Default sizing preset.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}} + {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":""},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/clickhouse-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"clickhouseKeeper":{"description":"ClickHouse Keeper configuration.","type":"object","default":{},"properties":{"enabled":{"description":"Deploy ClickHouse Keeper for cluster coordination.","type":"boolean","default":true},"replicas":{"description":"Number of Keeper replicas.","type":"integer","default":3},"resourcesPreset":{"description":"Default sizing preset.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"logStorageSize":{"description":"Size of Persistent Volume for logs.","default":"2Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"logTTL":{"description":"TTL (expiration time) for `query_log` and `query_thread_log`.","type":"integer","default":15},"replicas":{"description":"Number of ClickHouse replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"shards":{"description":"Number of ClickHouse shards.","type":"integer","default":1},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"readonly":{"description":"User is readonly (default: false).","type":"boolean"}}}}}} release: prefix: clickhouse- labels: diff --git a/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml b/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml index 58f166f6..13352680 100644 --- a/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml +++ b/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: cozy-proxy description: A simple kube-proxy addon for 1:1 NAT services in Kubernetes using an NFT backend type: application -version: 0.3.0 -appVersion: 0.3.0 +version: 0.2.0 +appVersion: 0.2.0 diff --git a/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml b/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml index e143e926..8cde5bed 100644 --- a/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml +++ b/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml @@ -1,6 +1,6 @@ image: repository: ghcr.io/cozystack/cozystack/cozy-proxy - tag: v0.3.0 + tag: v0.2.0 pullPolicy: IfNotPresent daemonset: diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml index dddabf54..af06e4b0 100644 --- a/packages/system/cozystack-api/values.yaml +++ b/packages/system/cozystack-api/values.yaml @@ -1,3 +1,3 @@ cozystackAPI: - image: ghcr.io/cozystack/cozystack/cozystack-api:v1.3.0@sha256:5fa8648821cf1e9e08cf7c2899c4b1c4226bb74c6773327141456c7d3f2b9b7e + image: ghcr.io/cozystack/cozystack/cozystack-api:v1.1.7@sha256:035d2dafb4a4cd5e806c5cdab19916fca7f9550ef898263cc8c891eaac745085 replicas: 2 diff --git a/packages/system/cozystack-basics/templates/monitoring-external-services.yaml b/packages/system/cozystack-basics/templates/monitoring-external-services.yaml index e36540c4..0f8b4d5c 100644 --- a/packages/system/cozystack-basics/templates/monitoring-external-services.yaml +++ b/packages/system/cozystack-basics/templates/monitoring-external-services.yaml @@ -2,11 +2,11 @@ apiVersion: v1 kind: Service metadata: - name: vlinsert-generic + name: vlogs-generic namespace: cozy-monitoring spec: type: ExternalName - externalName: vlinsert-generic.tenant-root.svc.cluster.local + externalName: vlogs-generic.tenant-root.svc.cluster.local --- apiVersion: v1 kind: Service diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml index 4d0d0fde..cf63340d 100644 --- a/packages/system/cozystack-controller/values.yaml +++ b/packages/system/cozystack-controller/values.yaml @@ -1,4 +1,4 @@ cozystackController: - image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.3.0@sha256:d03d19b78c4c98f970ac549a68b01ef6bd1ad755f5e0dcb9e08503511cdf2fdc + image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.1.7@sha256:84a4b7770622308242be8371d4c25af201f817b75c5fc0b1d54da27d2f68f102 debug: false disableTelemetry: false diff --git a/packages/system/cozystack-scheduler/Chart.yaml b/packages/system/cozystack-scheduler/Chart.yaml deleted file mode 100644 index f2dd13ee..00000000 --- a/packages/system/cozystack-scheduler/Chart.yaml +++ /dev/null @@ -1,3 +0,0 @@ -apiVersion: v2 -name: cozy-cozystack-scheduler -version: 0.3.0 diff --git a/packages/system/cozystack-scheduler/Makefile b/packages/system/cozystack-scheduler/Makefile deleted file mode 100644 index d075ec63..00000000 --- a/packages/system/cozystack-scheduler/Makefile +++ /dev/null @@ -1,14 +0,0 @@ -export NAME=cozystack-scheduler -export NAMESPACE=kube-system - -include ../../../hack/package.mk - -test: - helm unittest . - -update: - rm -rf charts - tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/cozystack-scheduler | awk -F'[/^]' 'END{print $$3}') && \ - mkdir -p charts/cozystack-scheduler && \ - curl -sSL https://github.com/cozystack/cozystack-scheduler/archive/refs/tags/$${tag}.tar.gz | \ - tar xzvf - --strip 2 -C charts/cozystack-scheduler cozystack-scheduler-$${tag#*v}/chart diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml deleted file mode 100644 index f2dd13ee..00000000 --- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/Chart.yaml +++ /dev/null @@ -1,3 +0,0 @@ -apiVersion: v2 -name: cozy-cozystack-scheduler -version: 0.3.0 diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml deleted file mode 100644 index d6b60d8b..00000000 --- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/crds/cozystack.io_schedulingclasses.yaml +++ /dev/null @@ -1,1123 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.19.0 - name: schedulingclasses.cozystack.io -spec: - group: cozystack.io - names: - kind: SchedulingClass - listKind: SchedulingClassList - plural: schedulingclasses - singular: schedulingclass - scope: Cluster - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - properties: - nodeAffinity: - description: Node affinity is a group of node affinity scheduling - rules. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with the corresponding - weight. - properties: - matchExpressions: - description: A list of node selector requirements by - node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies - to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by - node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies - to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding - nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The - terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements by - node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies - to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by - node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies - to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - nodeSelector: - additionalProperties: - type: string - type: object - podAffinity: - description: Pod affinity is a group of inter pod affinity scheduling - rules. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with - the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the - selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the - selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Pod anti affinity is a group of inter pod anti affinity - scheduling rules. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with - the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the - selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the - selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - topologySpreadConstraints: - items: - description: TopologySpreadConstraint specifies how to spread matching - pods among the given topology. - properties: - labelSelector: - description: |- - LabelSelector is used to find matching pods. - Pods that match this label selector are counted to determine the number of pods - in their corresponding topology domain. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select the pods over which - spreading will be calculated. The keys are used to lookup values from the - incoming pod labels, those key-value labels are ANDed with labelSelector - to select the group of existing pods over which spreading will be calculated - for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. - MatchLabelKeys cannot be set when LabelSelector isn't set. - Keys that don't exist in the incoming pod labels will - be ignored. A null or empty list means only match against labelSelector. - - This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxSkew: - description: |- - MaxSkew describes the degree to which pods may be unevenly distributed. - When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference - between the number of matching pods in the target topology and the global minimum. - The global minimum is the minimum number of matching pods in an eligible domain - or zero if the number of eligible domains is less than MinDomains. - For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same - labelSelector spread as 2/2/1: - In this case, the global minimum is 1. - | zone1 | zone2 | zone3 | - | P P | P P | P | - - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; - scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) - violate MaxSkew(1). - - if MaxSkew is 2, incoming pod can be scheduled onto any zone. - When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence - to topologies that satisfy it. - It's a required field. Default value is 1 and 0 is not allowed. - format: int32 - type: integer - minDomains: - description: |- - MinDomains indicates a minimum number of eligible domains. - When the number of eligible domains with matching topology keys is less than minDomains, - Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. - And when the number of eligible domains with matching topology keys equals or greater than minDomains, - this value has no effect on scheduling. - As a result, when the number of eligible domains is less than minDomains, - scheduler won't schedule more than maxSkew Pods to those domains. - If value is nil, the constraint behaves as if MinDomains is equal to 1. - Valid values are integers greater than 0. - When value is not nil, WhenUnsatisfiable must be DoNotSchedule. - - For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same - labelSelector spread as 2/2/2: - | zone1 | zone2 | zone3 | - | P P | P P | P P | - The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. - In this situation, new pod with the same labelSelector cannot be scheduled, - because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, - it will violate MaxSkew. - format: int32 - type: integer - nodeAffinityPolicy: - description: |- - NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector - when calculating pod topology spread skew. Options are: - - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. - - If this value is nil, the behavior is equivalent to the Honor policy. - type: string - nodeTaintsPolicy: - description: |- - NodeTaintsPolicy indicates how we will treat node taints when calculating - pod topology spread skew. Options are: - - Honor: nodes without taints, along with tainted nodes for which the incoming pod - has a toleration, are included. - - Ignore: node taints are ignored. All nodes are included. - - If this value is nil, the behavior is equivalent to the Ignore policy. - type: string - topologyKey: - description: |- - TopologyKey is the key of node labels. Nodes that have a label with this key - and identical values are considered to be in the same topology. - We consider each as a "bucket", and try to put balanced number - of pods into each bucket. - We define a domain as a particular instance of a topology. - Also, we define an eligible domain as a domain whose nodes meet the requirements of - nodeAffinityPolicy and nodeTaintsPolicy. - e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. - And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. - It's a required field. - type: string - whenUnsatisfiable: - description: |- - WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy - the spread constraint. - - DoNotSchedule (default) tells the scheduler not to schedule it. - - ScheduleAnyway tells the scheduler to schedule the pod in any location, - but giving higher precedence to topologies that would help reduce the - skew. - A constraint is considered "Unsatisfiable" for an incoming pod - if and only if every possible node assignment for that pod would violate - "MaxSkew" on some topology. - For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same - labelSelector spread as 3/1/1: - | zone1 | zone2 | zone3 | - | P P P | P | P | - If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled - to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies - MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler - won't make it *more* imbalanced. - It's a required field. - type: string - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - type: array - type: object - type: object - served: true - storage: true diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrole.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrole.yaml deleted file mode 100644 index 22f196a5..00000000 --- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrole.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cozystack-scheduler -rules: - - apiGroups: ["cozystack.io"] - resources: - - schedulingclasses - verbs: ["get", "list", "watch"] diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrolebinding.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrolebinding.yaml deleted file mode 100644 index 00fcd968..00000000 --- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/clusterrolebinding.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cozystack-scheduler:kube-scheduler -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:kube-scheduler -subjects: - - kind: ServiceAccount - name: cozystack-scheduler - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cozystack-scheduler:volume-scheduler -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:volume-scheduler -subjects: - - kind: ServiceAccount - name: cozystack-scheduler - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cozystack-scheduler -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cozystack-scheduler -subjects: - - kind: ServiceAccount - name: cozystack-scheduler - namespace: {{ .Release.Namespace }} diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/configmap.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/configmap.yaml deleted file mode 100644 index 24e0bc6f..00000000 --- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/configmap.yaml +++ /dev/null @@ -1,58 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: cozystack-scheduler-config - namespace: {{ .Release.Namespace }} -data: - scheduler-config.yaml: | - apiVersion: kubescheduler.config.k8s.io/v1 - kind: KubeSchedulerConfiguration - leaderElection: - leaderElect: true - resourceNamespace: {{ .Release.Namespace }} - resourceName: cozystack-scheduler - profiles: - - schedulerName: cozystack-scheduler - plugins: - preFilter: - disabled: - - name: InterPodAffinity - - name: NodeAffinity - - name: PodTopologySpread - enabled: - - name: CozystackInterPodAffinity - - name: CozystackNodeAffinity - - name: CozystackPodTopologySpread - - name: CozystackSchedulingClass - filter: - disabled: - - name: InterPodAffinity - - name: NodeAffinity - - name: PodTopologySpread - enabled: - - name: CozystackInterPodAffinity - - name: CozystackNodeAffinity - - name: CozystackPodTopologySpread - - name: CozystackSchedulingClass - preScore: - disabled: - - name: InterPodAffinity - - name: NodeAffinity - - name: PodTopologySpread - enabled: - - name: CozystackInterPodAffinity - - name: CozystackNodeAffinity - - name: CozystackPodTopologySpread - score: - disabled: - - name: InterPodAffinity - - name: NodeAffinity - - name: PodTopologySpread - enabled: - - name: CozystackInterPodAffinity - - name: CozystackNodeAffinity - - name: CozystackPodTopologySpread - {{- with .Values.extenders }} - extenders: - {{- toYaml . | nindent 6 }} - {{- end }} diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/deployment.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/deployment.yaml deleted file mode 100644 index 0365f0de..00000000 --- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/deployment.yaml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cozystack-scheduler - namespace: {{ .Release.Namespace }} -spec: - replicas: {{ .Values.replicas }} - selector: - matchLabels: - app: cozystack-scheduler - template: - metadata: - labels: - app: cozystack-scheduler - spec: - serviceAccountName: cozystack-scheduler - containers: - - name: cozystack-scheduler - image: {{ .Values.image }} - command: - - /cozystack-scheduler - - --config=/etc/kubernetes/scheduler-config.yaml - {{- with .Values.defaultLabelSelectorKeys }} - - --default-label-selector-keys={{ join "," . }} - {{- end }} - livenessProbe: - httpGet: - path: /healthz - port: 10259 - scheme: HTTPS - initialDelaySeconds: 15 - volumeMounts: - - name: config - mountPath: /etc/kubernetes/scheduler-config.yaml - subPath: scheduler-config.yaml - readOnly: true - volumes: - - name: config - configMap: - name: cozystack-scheduler-config diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/rolebinding.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/rolebinding.yaml deleted file mode 100644 index 796bf55c..00000000 --- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/rolebinding.yaml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cozystack-scheduler:extension-apiserver-authentication-reader - namespace: kube-system -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: extension-apiserver-authentication-reader -subjects: - - kind: ServiceAccount - name: cozystack-scheduler - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cozystack-scheduler:leader-election - namespace: {{ .Release.Namespace }} -rules: - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["create", "get", "list", "update", "watch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leasecandidates"] - verbs: ["create", "get", "list", "update", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cozystack-scheduler:leader-election - namespace: {{ .Release.Namespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cozystack-scheduler:leader-election -subjects: - - kind: ServiceAccount - name: cozystack-scheduler - namespace: {{ .Release.Namespace }} diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/serviceaccount.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/serviceaccount.yaml deleted file mode 100644 index 876e5f01..00000000 --- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/templates/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: cozystack-scheduler - namespace: {{ .Release.Namespace }} diff --git a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml b/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml deleted file mode 100644 index 55b6faff..00000000 --- a/packages/system/cozystack-scheduler/charts/cozystack-scheduler/values.yaml +++ /dev/null @@ -1,23 +0,0 @@ -image: ghcr.io/cozystack/cozystack/cozystack-scheduler:v0.3.0@sha256:89c285c5c5fe3ed8d7d597acf32fc9f045394e0f8efafd1878d6080cf112f6c2 -replicas: 1 -# defaultLabelSelectorKeys overrides the pod label keys used to auto-populate -# nil LabelSelectors in SchedulingClass affinity and topology spread terms. -# When empty or unset, the binary defaults are used: -# - apps.cozystack.io/application.group -# - apps.cozystack.io/application.kind -# - apps.cozystack.io/application.name -# defaultLabelSelectorKeys: [] - -# extenders is a list of scheduler extenders to call during the scheduling cycle. -# Each entry is passed directly into KubeSchedulerConfiguration.extenders[]. -# Example: -# extenders: -# - urlPrefix: http://linstor-scheduler-extender.cozy-linstor.svc:8099 -# filterVerb: filter -# prioritizeVerb: prioritize -# weight: 5 -# enableHTTPS: false -# httpTimeout: 10s -# nodeCacheCapable: false -# ignorable: true -extenders: [] diff --git a/packages/system/cozystack-scheduler/templates/tenant-clusterroles.yaml b/packages/system/cozystack-scheduler/templates/tenant-clusterroles.yaml deleted file mode 100644 index a7b8fd21..00000000 --- a/packages/system/cozystack-scheduler/templates/tenant-clusterroles.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -# == schedulingclass view cluster role == -# Aggregated into cozy-tenant-view (and consequently use, admin, super-admin) -# Provides read-only access to SchedulingClass resources -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cozy:schedulingclass:view - labels: - rbac.cozystack.io/aggregate-to-tenant-view: "true" -rules: -- apiGroups: ["cozystack.io"] - resources: - - schedulingclasses - verbs: - - get - - list - - watch diff --git a/packages/system/cozystack-scheduler/tests/configmap_test.yaml b/packages/system/cozystack-scheduler/tests/configmap_test.yaml deleted file mode 100644 index ce8f372d..00000000 --- a/packages/system/cozystack-scheduler/tests/configmap_test.yaml +++ /dev/null @@ -1,26 +0,0 @@ -suite: scheduler configmap tests - -templates: - - charts/cozy-cozystack-scheduler/templates/configmap.yaml - -tests: - - it: renders extenders when configured - values: - - ../values-linstor.yaml - asserts: - - isKind: - of: ConfigMap - - matchRegex: - path: data["scheduler-config.yaml"] - pattern: "urlPrefix: http://linstor-scheduler-extender" - - matchRegex: - path: data["scheduler-config.yaml"] - pattern: "ignorable: true" - - - it: omits extenders by default - asserts: - - isKind: - of: ConfigMap - - notMatchRegex: - path: data["scheduler-config.yaml"] - pattern: "extenders:" diff --git a/packages/system/cozystack-scheduler/values-linstor.yaml b/packages/system/cozystack-scheduler/values-linstor.yaml deleted file mode 100644 index ab16ca57..00000000 --- a/packages/system/cozystack-scheduler/values-linstor.yaml +++ /dev/null @@ -1,10 +0,0 @@ -cozy-cozystack-scheduler: - extenders: - - urlPrefix: http://linstor-scheduler-extender.cozy-linstor.svc:8099 - filterVerb: filter - prioritizeVerb: prioritize - weight: 5 - enableHTTPS: false - httpTimeout: 10s - nodeCacheCapable: false - ignorable: true diff --git a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff b/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff deleted file mode 100644 index e98861a3..00000000 --- a/packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff +++ /dev/null @@ -1,17 +0,0 @@ -diff --git a/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts b/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts ---- a/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts -+++ b/src/components/molecules/EnrichedTable/organisms/EnrichedTableProvider/utils.ts -@@ -185,6 +185,11 @@ - return `['${escaped}']` - }) - } -- const jpQueryResult = jp.query(el, `$${resolvedJsonPath}`) -- fieldValue = Array.isArray(jpQueryResult) && jpQueryResult.length === 1 ? jpQueryResult[0] : jpQueryResult -+ if (/_flatMap[^\]]+_Key/.test(resolvedJsonPath)) { -+ // Placeholder was not resolved (row not yet expanded or key missing) — skip query -+ fieldValue = null -+ } else { -+ const jpQueryResult = jp.query(el, `$${resolvedJsonPath}`) -+ fieldValue = Array.isArray(jpQueryResult) && jpQueryResult.length === 1 ? jpQueryResult[0] : jpQueryResult -+ } - } diff --git a/packages/system/dashboard/templates/configmap.yaml b/packages/system/dashboard/templates/configmap.yaml index a2b7684c..78179a5d 100644 --- a/packages/system/dashboard/templates/configmap.yaml +++ b/packages/system/dashboard/templates/configmap.yaml @@ -1,6 +1,6 @@ {{- $brandingConfig := .Values._cluster.branding | default dict }} -{{- $tenantText := "v1.3.0" }} +{{- $tenantText := "v1.1.7" }} {{- $footerText := "Cozystack" }} {{- $titleText := "Cozystack Dashboard" }} {{- $logoText := "" }} diff --git a/packages/system/dashboard/templates/gatekeeper.yaml b/packages/system/dashboard/templates/gatekeeper.yaml index f7b1c7f7..23427239 100644 --- a/packages/system/dashboard/templates/gatekeeper.yaml +++ b/packages/system/dashboard/templates/gatekeeper.yaml @@ -1,7 +1,6 @@ {{- $host := index .Values._cluster "root-host" }} {{- $oidcEnabled := index .Values._cluster "oidc-enabled" }} {{- $oidcInsecureSkipVerify := index .Values._cluster "oidc-insecure-skip-verify" }} -{{- $keycloakInternalUrl := index .Values._cluster "keycloak-internal-url" | default "" }} apiVersion: apps/v1 kind: Deployment @@ -56,16 +55,7 @@ spec: - --http-address=0.0.0.0:8000 - --redirect-url=https://dashboard.{{ $host }}/oauth2/callback - --oidc-issuer-url=https://keycloak.{{ $host }}/realms/cozy - {{- if $keycloakInternalUrl }} - - --skip-oidc-discovery - - --login-url=https://keycloak.{{ $host }}/realms/cozy/protocol/openid-connect/auth - - --redeem-url={{ $keycloakInternalUrl }}/protocol/openid-connect/token - - --oidc-jwks-url={{ $keycloakInternalUrl }}/protocol/openid-connect/certs - - --validate-url={{ $keycloakInternalUrl }}/protocol/openid-connect/userinfo - - --backend-logout-url={{ $keycloakInternalUrl }}/protocol/openid-connect/logout?id_token_hint={id_token} - {{- else }} - --backend-logout-url=https://keycloak.{{ $host }}/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token} - {{- end }} - --whitelist-domain=keycloak.{{ $host }} - --email-domain=* - --pass-access-token=true diff --git a/packages/system/dashboard/templates/keycloakclient.yaml b/packages/system/dashboard/templates/keycloakclient.yaml index fa33fea4..1e0b5feb 100644 --- a/packages/system/dashboard/templates/keycloakclient.yaml +++ b/packages/system/dashboard/templates/keycloakclient.yaml @@ -59,6 +59,7 @@ spec: kind: ClusterKeycloakRealm secret: $dashboard-client:client-secret-key advancedProtocolMappers: true + authorizationServicesEnabled: true name: dashboard clientId: dashboard directAccess: true diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml index a5188825..557de030 100644 --- a/packages/system/dashboard/values.yaml +++ b/packages/system/dashboard/values.yaml @@ -1,6 +1,6 @@ openapiUI: - image: ghcr.io/cozystack/cozystack/openapi-ui:v1.3.0@sha256:0fa79c373a62840a617ff1ca1b0e31931c13a6cf7b0bb0ff0dc191f047a465a3 + image: ghcr.io/cozystack/cozystack/openapi-ui:v1.1.7@sha256:e5971ae9138bb736bfbcccd39ca4c0d96d9df98190f7e33963b4de0223b31d72 openapiUIK8sBff: - image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.3.0@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92 + image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.1.7@sha256:75d51a65e190e83f538ae3cafdaa756930e53c7112a1daa4080d92dc67a9532a tokenProxy: - image: ghcr.io/cozystack/cozystack/token-proxy:v1.3.0@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc + image: ghcr.io/cozystack/cozystack/token-proxy:v1.1.7@sha256:2e280991e07853ea48f97b0a42946afffa10d03d6a83d41099ed83e6ffc94fdc diff --git a/packages/system/etcd-rd/cozyrds/etcd.yaml b/packages/system/etcd-rd/cozyrds/etcd.yaml index 7ff7c39c..49e25708 100644 --- a/packages/system/etcd-rd/cozyrds/etcd.yaml +++ b/packages/system/etcd-rd/cozyrds/etcd.yaml @@ -8,7 +8,7 @@ spec: plural: etcds singular: etcd openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"size":{"description":"Persistent Volume size.","default":"4Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"replicas":{"description":"Number of etcd replicas.","type":"integer","default":3},"resources":{"description":"Resource configuration for etcd.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","default":"1000m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","default":"512Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}} + {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of etcd replicas.","type":"integer","default":3},"resources":{"description":"Resource configuration for etcd.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","default":"1000m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","default":"512Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"size":{"description":"Persistent Volume size.","default":"4Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}} release: prefix: "" labels: diff --git a/packages/system/external-dns-rd/Chart.yaml b/packages/system/external-dns-rd/Chart.yaml deleted file mode 100644 index b9575cd8..00000000 --- a/packages/system/external-dns-rd/Chart.yaml +++ /dev/null @@ -1,3 +0,0 @@ -apiVersion: v2 -name: external-dns-rd -version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process diff --git a/packages/system/external-dns-rd/Makefile b/packages/system/external-dns-rd/Makefile deleted file mode 100644 index 4abb36a6..00000000 --- a/packages/system/external-dns-rd/Makefile +++ /dev/null @@ -1,4 +0,0 @@ -export NAME=external-dns-rd -export NAMESPACE=cozy-system - -include ../../../hack/package.mk diff --git a/packages/system/external-dns-rd/cozyrds/external-dns.yaml b/packages/system/external-dns-rd/cozyrds/external-dns.yaml deleted file mode 100644 index 849b16ad..00000000 --- a/packages/system/external-dns-rd/cozyrds/external-dns.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: cozystack.io/v1alpha1 -kind: ApplicationDefinition -metadata: - name: external-dns -spec: - application: - kind: ExternalDNS - plural: externaldns - singular: externaldns - openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"provider":{"description":"DNS provider name.","type":"string","enum":["cloudflare","aws","azure","google","digitalocean","linode","ovh","exoscale","godaddy","inmemory"]},"domainFilters":{"description":"List of domains this external-dns instance can manage.","type":"array","default":[],"items":{"type":"string"}},"policy":{"description":"How DNS records are synchronized.","type":"string","default":"upsert-only","enum":["create-only","sync","upsert-only"]},"extraArgs":{"description":"Extra arguments for external-dns.","type":"array","default":[],"items":{"type":"string"}},"gatewayAPI":{"description":"Enable Gateway API HTTPRoute as a source for DNS records.","type":"boolean","default":false},"annotationPrefix":{"description":"Custom annotation prefix for external-dns (useful for running multiple instances).","type":"string","default":""},"cloudflare":{"description":"Cloudflare provider credentials.","type":"object","default":{"apiEmail":"","apiKey":"","apiToken":"","proxied":false},"x-kubernetes-preserve-unknown-fields":true},"aws":{"description":"AWS Route53 provider credentials.","type":"object","default":{"accessKeyId":"","region":"","secretAccessKey":"","zoneType":""},"x-kubernetes-preserve-unknown-fields":true},"azure":{"description":"Azure DNS provider credentials.","type":"object","default":{"aadClientId":"","aadClientSecret":"","resourceGroup":"","subscriptionId":"","tenantId":""},"x-kubernetes-preserve-unknown-fields":true},"google":{"description":"Google Cloud DNS provider credentials.","type":"object","default":{"project":"","serviceAccountKey":""},"x-kubernetes-preserve-unknown-fields":true},"digitalocean":{"description":"DigitalOcean DNS provider credentials.","type":"object","default":{"token":""},"x-kubernetes-preserve-unknown-fields":true},"linode":{"description":"Linode DNS provider credentials.","type":"object","default":{"token":""},"x-kubernetes-preserve-unknown-fields":true},"ovh":{"description":"OVH DNS provider credentials.","type":"object","default":{"applicationKey":"","applicationSecret":"","consumerKey":"","endpoint":""},"x-kubernetes-preserve-unknown-fields":true},"exoscale":{"description":"Exoscale DNS provider credentials.","type":"object","default":{"apiKey":"","apiSecret":""},"x-kubernetes-preserve-unknown-fields":true},"godaddy":{"description":"GoDaddy DNS provider credentials.","type":"object","default":{"apiKey":"","apiSecret":""},"x-kubernetes-preserve-unknown-fields":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}} - release: - prefix: "" - chartRef: - kind: ExternalArtifact - name: cozystack-external-dns-application-default-external-dns - namespace: cozy-system - dashboard: - category: Networking - singular: External DNS - plural: External DNS - description: External DNS for automatic DNS record management - icon: PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxNDQgMTQ0IiB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCI+CiAgPGRlZnM+CiAgICA8bGluZWFyR3JhZGllbnQgaWQ9ImJnIiB4MT0iMCUiIHkxPSIwJSIgeDI9IjEwMCUiIHkyPSIxMDAlIj4KICAgICAgPHN0b3Agb2Zmc2V0PSIwJSIgc3R5bGU9InN0b3AtY29sb3I6IzNCODJGNiIvPgogICAgICA8c3RvcCBvZmZzZXQ9IjEwMCUiIHN0eWxlPSJzdG9wLWNvbG9yOiMxRDRFRDgiLz4KICAgIDwvbGluZWFyR3JhZGllbnQ+CiAgPC9kZWZzPgogIDxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjgiIGZpbGw9InVybCgjYmcpIi8+CiAgPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNzIsNzIpIiBmaWxsPSJub25lIiBzdHJva2U9IiNmZmYiIHN0cm9rZS13aWR0aD0iNCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHJva2UtbGluZWpvaW49InJvdW5kIj4KICAgIDwhLS0gR2xvYmUgLS0+CiAgICA8Y2lyY2xlIGN4PSIwIiBjeT0iLTQiIHI9IjMyIi8+CiAgICA8ZWxsaXBzZSBjeD0iMCIgY3k9Ii00IiByeD0iMTQiIHJ5PSIzMiIvPgogICAgPGxpbmUgeDE9Ii0zMiIgeTE9Ii00IiB4Mj0iMzIiIHkyPSItNCIvPgogICAgPHBhdGggZD0iTS0yOCwxMiBRMCwxOCAyOCwxMiIvPgogICAgPHBhdGggZD0iTS0yOCwtMjAgUTAsLTE0IDI4LC0yMCIvPgogICAgPCEtLSBBcnJvdyBwb2ludGluZyBvdXQgLS0+CiAgICA8bGluZSB4MT0iMTgiIHkxPSIxOCIgeDI9IjM2IiB5Mj0iMzYiLz4KICAgIDxwb2x5bGluZSBwb2ludHM9IjI4LDM2IDM2LDM2IDM2LDI4Ii8+CiAgPC9nPgo8L3N2Zz4K - keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "domainFilters"], ["spec", "policy"], ["spec", "extraArgs"], ["spec", "gatewayAPI"], ["spec", "annotationPrefix"], ["spec", "cloudflare"], ["spec", "cloudflare", "apiToken"], ["spec", "cloudflare", "apiKey"], ["spec", "cloudflare", "apiEmail"], ["spec", "cloudflare", "proxied"], ["spec", "aws"], ["spec", "aws", "accessKeyId"], ["spec", "aws", "secretAccessKey"], ["spec", "aws", "region"], ["spec", "aws", "zoneType"], ["spec", "azure"], ["spec", "azure", "tenantId"], ["spec", "azure", "subscriptionId"], ["spec", "azure", "resourceGroup"], ["spec", "azure", "aadClientId"], ["spec", "azure", "aadClientSecret"], ["spec", "google"], ["spec", "google", "project"], ["spec", "google", "serviceAccountKey"], ["spec", "digitalocean"], ["spec", "digitalocean", "token"], ["spec", "linode"], ["spec", "linode", "token"], ["spec", "ovh"], ["spec", "ovh", "endpoint"], ["spec", "ovh", "applicationKey"], ["spec", "ovh", "applicationSecret"], ["spec", "ovh", "consumerKey"], ["spec", "exoscale"], ["spec", "exoscale", "apiKey"], ["spec", "exoscale", "apiSecret"], ["spec", "godaddy"], ["spec", "godaddy", "apiKey"], ["spec", "godaddy", "apiSecret"], ["spec", "resources"], ["spec", "resourcesPreset"]] diff --git a/packages/system/external-dns-rd/templates/cozyrd.yaml b/packages/system/external-dns-rd/templates/cozyrd.yaml deleted file mode 100644 index e079ddcf..00000000 --- a/packages/system/external-dns-rd/templates/cozyrd.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{- range $path, $_ := .Files.Glob "cozyrds/*" }} ---- -{{ $.Files.Get $path }} -{{- end }} diff --git a/packages/system/external-dns-rd/values.yaml b/packages/system/external-dns-rd/values.yaml deleted file mode 100644 index 0967ef42..00000000 --- a/packages/system/external-dns-rd/values.yaml +++ /dev/null @@ -1 +0,0 @@ -{} diff --git a/packages/system/external-dns/charts/external-dns/.helmignore b/packages/system/external-dns/charts/external-dns/.helmignore index e951b6fb..0e8a0eb3 100644 --- a/packages/system/external-dns/charts/external-dns/.helmignore +++ b/packages/system/external-dns/charts/external-dns/.helmignore @@ -21,7 +21,3 @@ .idea/ *.tmproj .vscode/ -ci/ -schema/ -.schema.yaml -tests/ diff --git a/packages/system/external-dns/charts/external-dns/CHANGELOG.md b/packages/system/external-dns/charts/external-dns/CHANGELOG.md index 6b2401c2..02b467e1 100644 --- a/packages/system/external-dns/charts/external-dns/CHANGELOG.md +++ b/packages/system/external-dns/charts/external-dns/CHANGELOG.md @@ -18,117 +18,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [UNRELEASED] -## [v1.20.0] - -### Added - -- Add option to set `annotationPrefix` ([#5889](https://github.com/kubernetes-sigs/external-dns/pull/5889)) _@lexfrei_ +## [v1.15.0] - 2023-09-10 ### Changed -- Grant `networking.k8s.io/ingresses` and `gateway.solo.io/gateways` permissions when using `gloo-proxy` source. ([#5909](https://github.com/kubernetes-sigs/external-dns/pull/5909)) _@cucxabong_ -- Update _ExternalDNS_ OCI image version to [v0.20.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.20.0). ([#6005](https://github.com/kubernetes-sigs/external-dns/pull/6005)) _@vflaux_ - -### Fixed - -- Fixed the missing schema for `.provider.webhook.serviceMonitor` configs ([#5932](https://github.com/kubernetes-sigs/external-dns/pull/5932)) _@chrisbsmith_ -- Fixed incorrect indentation of selector labels under `spec.template.spec.topologySpreadConstraints` when `topologySpreadConstraints` is set. ([#6054](https://github.com/kubernetes-sigs/external-dns/pull/6054)) _@andylim0221_ - -## [v1.19.0] - 2025-09-08 - -### Added - -- Add option to configure `annotationFilter` via dedicated chart value. ([#5737](https://github.com/kubernetes-sigs/external-dns/pull/5737)) _@dshatokhin_ - -### Changed - -- Grant `discovery.k8s.io/endpointslices` permission only when using `service` source. ([#5746](https://github.com/kubernetes-sigs/external-dns/pull/5746)) _@vflaux_ -- Update _ExternalDNS_ OCI image version to [v0.19.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.19.0). ([#5819](https://github.com/kubernetes-sigs/external-dns/pull/5819)) _@stevehipwell_ - -## [v1.18.0] - 2025-07-14 - -### Changed - -- Update RBAC for `Service` source to support `EndpointSlices`. ([#5493](https://github.com/kubernetes-sigs/external-dns/pull/5493)) _@vflaux_ -- Update _ExternalDNS_ OCI image version to [v0.18.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.18.0). ([#5633](https://github.com/kubernetes-sigs/external-dns/pull/5633)) _@elafarge_ - -### Fixed - -- Fixed the lack of schema support for `create-only` dns policy in helm values ([#5627](https://github.com/kubernetes-sigs/external-dns/pull/5627)) _@coltonhughes_ -- Fixed the type of `.extraContainers` from `object` to `list` (array). ([#5564](https://github.com/kubernetes-sigs/external-dns/pull/5564)) _@svengreb_ - -## [v1.17.0] - 2025-06-04 - -### Changed - -- Allow extraArgs to also be a map enabling overrides of individual values. ([#5293](https://github.com/kubernetes-sigs/external-dns/pull/5293)) _@frittentheke_ -- Update CRD. ([#5287](https://github.com/kubernetes-sigs/external-dns/pull/5287)) _@mloiseleur_ -- Update CRD. ([#5446](https://github.com/kubernetes-sigs/external-dns/pull/5446)) _@mloiseleur_ -- Update _ExternalDNS_ OCI image version to [v0.17.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.17.0). ([#5479](https://github.com/kubernetes-sigs/external-dns/pull/5479)) _@stevehipwell_ - -### Fixed - -- Fix wrong type definitions for webhook probes. ([#5297](https://github.com/kubernetes-sigs/external-dns/pull/5297)) _@semnell_ -- Update schema with latest plugin release. ([#5510](https://github.com/kubernetes-sigs/external-dns/pull/5510)) _@mloiseleur - -## [v1.16.1] - 2025-04-10 - -### Changed - -- Set defaults for `automountServiceAccountToken` and `serviceAccount.automountServiceAccountToken` to `true` in Helm chart values. ([#5207](https://github.com/kubernetes-sigs/external-dns/pull/5207)) _@t3mi_ - -### Fixed - -- Correctly handle `txtPrefix` and `txtSuffix` arguments when both are provided. ([#5250](https://github.com/kubernetes-sigs/external-dns/pull/5250)) _@ivankatliarchuk_ -- Add missing types in the schema for empty values. ([#5228](https://github.com/kubernetes-sigs/external-dns/pull/5228)) _@ivankatliarchuk_ -- Add missing types in the schema for empty values. ([#5207](https://github.com/kubernetes-sigs/external-dns/pull/5207)) _@t3mi_ - -## [v1.16.0] - 2025-03-20 - -### Added - -- Add helm testing framework `helm plugin unittest`. ([#5137](https://github.com/kubernetes-sigs/external-dns/pull/5137)) _@ivankatliarchuk_ -- Add ability to generate schema with `helm plugin schema`. ([#5075](https://github.com/kubernetes-sigs/external-dns/pull/5075)) _@ivankatliarchuk_ -- Add `docs/contributing/dev-guide.md#helm-values` guide. ([#5075](https://github.com/kubernetes-sigs/external-dns/pull/5075)) _@ivankatliarchuk_ - -### Changed - -- Regenerate JSON schema with `helm-values-schema-json' plugin. ([#5075](https://github.com/kubernetes-sigs/external-dns/pull/5075)) _@ivankatliarchuk_ -- Update _ExternalDNS_ OCI image version to [v0.16.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.16.1). ([#5201](https://github.com/kubernetes-sigs/external-dns/pull/5201)) _@stevehipwell_ - -## [v1.15.2] - 2025-02-14 - -### Changed - -- Added `transportservers` resource to ClusterRole when specifying `f5-transportserver` or `f5-virtualserver` as a source. ([#5066](https://github.com/kubernetes-sigs/external-dns/pull/5066)) _@visokoo_ - -### Fixed - -- Fixed handling of non-string types in `serviceAccount.metadata.annotations` field. ([#5067](https://github.com/kubernetes-sigs/external-dns/pull/5067)) _@hjoshi123_ -- Fixed regression where `affinity.nodeAffinity` was being ignored. ([#5046](https://github.com/kubernetes-sigs/external-dns/pull/5046)) _@mkhpalm_ - -## [v1.15.1] - 2025-01-27 - -### Added - -- Added ability to configure `imagePullSecrets` via helm `global` value. ([#4667](https://github.com/kubernetes-sigs/external-dns/pull/4667)) _@jkroepke_ -- Added options to configure `labelFilter` and `managedRecordTypes` via dedicated helm values. ([#4849](https://github.com/kubernetes-sigs/external-dns/pull/4849)) _@abaguas_ - -### Changed - -- Allow templating `serviceaccount.annotations` keys and values, by rendering them using the `tpl` built-in function. ([#4958](https://github.com/kubernetes-sigs/external-dns/pull/4958)) _@fcrespofastly_ -- Updated _ExternalDNS_ OCI image version to [v0.15.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.1). ([#5028](https://github.com/kubernetes-sigs/external-dns/pull/5028)) _@stevehipwell_ - -### Fixed - -- Fixed automatic addition of pod selector labels to `affinity` and `topologySpreadConstraints` if not defined. ([#4666](https://github.com/kubernetes-sigs/external-dns/pull/4666)) _@pvickery-ParamountCommerce_ -- Fixed missing Ingress permissions when using Istio sources. ([#4845](https://github.com/kubernetes-sigs/external-dns/pull/4845)) _@joekhoobyar_ - -## [v1.15.0] - 2024-09-11 - -### Changed - -- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#4735](https://github.com/kubernetes-sigs/external-dns/pull/4735)) _@stevehipwell_ +- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#xxxx](https://github.com/kubernetes-sigs/external-dns/pull/xxxx)) _@stevehipwell_ ### Fixed @@ -137,7 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_ - Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes. ([#4691](https://github.com/kubernetes-sigs/external-dns/pull/4691)) _@kimsondrup_ & _@hatrx_ -## [v1.14.5] - 2024-06-10 +## [v1.14.5] - 2023-06-10 ### Added @@ -154,7 +48,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fixed the `ServiceMonitor` job name to correctly use the instance label. ([#4541](https://github.com/kubernetes-sigs/external-dns/pull/4541)) _@stevehipwell_ -## [v1.14.4] - 2024-04-05 +## [v1.14.4] - 2023-04-03 ### Added @@ -165,7 +59,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Updated _ExternalDNS_ OCI image version to [v0.14.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.14.1). ([#4357](https://github.com/kubernetes-sigs/external-dns/pull/4357)) _@stevehipwell_ -## [v1.14.3] - 2024-01-26 +## [v1.14.3] - 2023-01-26 ### Fixed @@ -179,7 +73,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Restore template support in `.Values.provider` and `.Values.provider.name` -## [v1.14.1] - 2024-01-12 +## [v1.14.1] - 2024-01-11 ### Fixed @@ -203,7 +97,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - The `secretConfiguration` value has been deprecated in favour of creating secrets external to the Helm chart and configuring their use via the `extraVolumes` & `extraVolumeMounts` values. ([#4161](https://github.com/kubernetes-sigs/external-dns/pull/4161)) [@stevehipwell](https://github.com/stevehipwell) -## [v1.13.1] - 2023-09-08 +## [v1.13.1] - 2023-09-07 ### Added @@ -306,14 +200,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 RELEASE LINKS --> [UNRELEASED]: https://github.com/kubernetes-sigs/external-dns/tree/master/charts/external-dns -[v1.20.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.20.0 -[v1.19.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.19.0 -[v1.18.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.18.0 -[v1.17.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.17.0 -[v1.16.1]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.16.1 -[v1.16.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.16.0 -[v1.15.2]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.15.2 -[v1.15.1]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.15.1 [v1.15.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.15.0 [v1.14.5]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.5 [v1.14.4]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.4 diff --git a/packages/system/external-dns/charts/external-dns/Chart.yaml b/packages/system/external-dns/charts/external-dns/Chart.yaml index a03ace4e..c7245bd1 100644 --- a/packages/system/external-dns/charts/external-dns/Chart.yaml +++ b/packages/system/external-dns/charts/external-dns/Chart.yaml @@ -1,30 +1,28 @@ annotations: - artifacthub.io/changes: |- - - kind: added - description: "Add option to set annotationPrefix (#5889) @lexfrei." + artifacthub.io/changes: | - kind: changed - description: "Grant networking.k8s.io/ingresses and gateway.solo.io/gateways permissions when using gloo-proxy source." - - kind: changed - description: "Update ExternalDNS OCI image version to v0.20.0." + description: "Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0)." - kind: fixed - description: "Fixed the missing schema for .provider.webhook." + description: "Fixed `provider.webhook.resources` behavior to correctly leverage resource limits." - kind: fixed - description: "Fixed incorrect indentation of selector labels under spec.template.spec.topologySpreadConstraints when topologySpreadConstraints is set." + description: "Fixed `provider.webhook.imagePullPolicy` behavior to correctly leverage pull policy." + - kind: fixed + description: "Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`." + - kind: fixed + description: "Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes." apiVersion: v2 -appVersion: 0.20.0 +appVersion: 0.15.0 description: ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers. home: https://github.com/kubernetes-sigs/external-dns/ icon: https://github.com/kubernetes-sigs/external-dns/raw/master/docs/img/external-dns.png keywords: - kubernetes -- k8s - externaldns - external-dns - dns - service - ingress -- gateway maintainers: - email: steve.hipwell@gmail.com name: stevehipwell @@ -32,4 +30,4 @@ name: external-dns sources: - https://github.com/kubernetes-sigs/external-dns/ type: application -version: 1.20.0 +version: 1.15.0 diff --git a/packages/system/external-dns/charts/external-dns/README.md b/packages/system/external-dns/charts/external-dns/README.md index 0bbae925..9b21ecde 100644 --- a/packages/system/external-dns/charts/external-dns/README.md +++ b/packages/system/external-dns/charts/external-dns/README.md @@ -1,6 +1,6 @@ # external-dns -![Version: 1.20.0](https://img.shields.io/badge/Version-1.20.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.20.0](https://img.shields.io/badge/AppVersion-0.20.0-informational?style=flat-square) +![Version: 1.15.0](https://img.shields.io/badge/Version-1.15.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.15.0](https://img.shields.io/badge/AppVersion-0.15.0-informational?style=flat-square) ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers. @@ -27,15 +27,12 @@ helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/ After you've installed the repo you can install the chart. ```shell -helm upgrade --install external-dns external-dns/external-dns --version 1.20.0 +helm upgrade --install external-dns external-dns/external-dns --version 1.15.0 ``` ## Providers -> Legacy support of setting `provider: ` is deprecated. - -Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider..` values, where supported, and the `extraArgs` value. - +Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider..` values, where supported, and the `extraArgs` value. For legacy support `provider` can be set to the name of the provider with all additional configuration being set via the `extraArgs` value. See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-providers) for more info on available providers and tutorials. ### Providers with Specific Configuration Support @@ -48,13 +45,13 @@ See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-provider For set up for a specific provider using the Helm chart, see the following links: -* [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc) -* [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm) -* [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm) -* [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm) -* [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm) -* [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm) -* [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm) +- [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc) +- [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm) +- [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm) +- [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm) +- [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm) +- [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm) +- [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm) ## Namespaced Scoped Installation @@ -94,43 +91,36 @@ If `namespaced` is set to `true`, please ensure that `sources` my only contains | Key | Type | Default | Description | |-----|------|---------|-------------| | affinity | object | `{}` | Affinity settings for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels. | -| annotationFilter | string | `nil` | Filter resources queried for endpoints by annotation selector. | -| annotationPrefix | string | `nil` | Annotation prefix for external-dns annotations (useful for split horizon DNS with multiple instances). | -| automountServiceAccountToken | bool | `true` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`. | +| automountServiceAccountToken | bool | `nil` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`. | | commonLabels | object | `{}` | Labels to add to all chart resources. | | deploymentAnnotations | object | `{}` | Annotations to add to the `Deployment`. | | deploymentStrategy | object | `{"type":"Recreate"}` | [Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy). | | dnsConfig | object | `nil` | [DNS config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) for the pod, if not set the default will be used. | | dnsPolicy | string | `nil` | [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) for the pod, if not set the default will be used. | -| domainFilters | list | `[]` | Limit possible target zones by domain suffixes. | -| enabled | bool | `nil` | No effect - reserved for use in sub-charting. | +| domainFilters | list | `[]` | | | env | list | `[]` | [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `external-dns` container. | -| excludeDomains | list | `[]` | Intentionally exclude domains from being managed. | -| extraArgs | object | `{}` | Extra arguments to provide to _ExternalDNS_. An array or map can be used, with maps allowing for value overrides; maps also support slice values to use the same arg multiple times. | -| extraContainers | list | `[]` | Extra containers to add to the `Deployment`. | +| excludeDomains | list | `[]` | | +| extraArgs | list | `[]` | Extra arguments to provide to _ExternalDNS_. | +| extraContainers | object | `{}` | Extra containers to add to the `Deployment`. | | extraVolumeMounts | list | `[]` | Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `external-dns` container. | | extraVolumes | list | `[]` | Extra [volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the `Pod`. | | fullnameOverride | string | `nil` | Override the full name of the chart. | -| gatewayNamespace | string | `nil` | _Gateway API_ gateway namespace to watch. | -| global.imagePullSecrets | list | `[]` | Global image pull secrets. | | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy for the `external-dns` container. | | image.repository | string | `"registry.k8s.io/external-dns/external-dns"` | Image repository for the `external-dns` container. | | image.tag | string | `nil` | Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set. | | imagePullSecrets | list | `[]` | Image pull secrets. | | initContainers | list | `[]` | [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the `Pod` definition. | | interval | string | `"1m"` | Interval for DNS updates. | -| labelFilter | string | `nil` | Filter resources queried for endpoints by label selector. | | livenessProbe | object | See _values.yaml_ | [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container. | | logFormat | string | `"text"` | Log format. | | logLevel | string | `"info"` | Log level. | -| managedRecordTypes | list | `[]` | Record types to manage (default: A, AAAA, CNAME) | | nameOverride | string | `nil` | Override the name of the chart. | | namespaced | bool | `false` | if `true`, _ExternalDNS_ will run in a namespaced scope (`Role`` and `Rolebinding`` will be namespaced too). | | nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | podAnnotations | object | `{}` | Annotations to add to the `Pod`. | | podLabels | object | `{}` | Labels to add to the `Pod`. | | podSecurityContext | object | See _values.yaml_ | [Pod security context](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podsecuritycontext-v1-core), this supports full customisation. | -| policy | string | `"upsert-only"` | How DNS records are synchronized between sources and providers; available values are `create-only`, `sync`, & `upsert-only`. | +| policy | string | `"upsert-only"` | How DNS records are synchronized between sources and providers; available values are `sync` & `upsert-only`. | | priorityClassName | string | `nil` | Priority class name for the `Pod`. | | provider.name | string | `"aws"` | _ExternalDNS_ provider name; for the available providers and how to configure them see [README](https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#providers). | | provider.webhook.args | list | `[]` | Extra arguments to provide for the `webhook` container. | @@ -157,11 +147,11 @@ If `namespaced` is set to `true`, please ensure that `sources` my only contains | secretConfiguration.subPath | string | `nil` | Sub-path for mounting the `Secret`, this can be templated. | | securityContext | object | See _values.yaml_ | [Security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `external-dns` container. | | service.annotations | object | `{}` | Service annotations. | -| service.ipFamilies | list | `[]` | Service IP families (e.g. IPv4 and/or IPv6). | +| service.ipFamilies | list | `[]` | Service IP families. | | service.ipFamilyPolicy | string | `nil` | Service IP family policy. | | service.port | int | `7979` | Service HTTP port. | -| serviceAccount.annotations | object | `{}` | Annotations to add to the service account. Templates are allowed in both the key and the value. Example: `example.com/annotation/{{ .Values.nameOverride }}: {{ .Values.nameOverride }}` | -| serviceAccount.automountServiceAccountToken | bool | `true` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`. | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account. | +| serviceAccount.automountServiceAccountToken | string | `nil` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`. | | serviceAccount.create | bool | `true` | If `true`, create a new `ServiceAccount`. | | serviceAccount.labels | object | `{}` | Labels to add to the service account. | | serviceAccount.name | string | `nil` | If this is set and `serviceAccount.create` is `true` this will be used for the created `ServiceAccount` name, if set and `serviceAccount.create` is `false` then this will define an existing `ServiceAccount` to use. | @@ -183,7 +173,7 @@ If `namespaced` is set to `true`, please ensure that `sources` my only contains | tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | topologySpreadConstraints | list | `[]` | Topology spread constraints for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided one will be created from the pod selector labels. | | triggerLoopOnEvent | bool | `false` | If `true`, triggers run loop on create/update/delete events in addition of regular interval. | -| txtOwnerId | string | `nil` | Specify an identifier for this instance of _ExternalDNS_ when using a registry other than `noop`. | +| txtOwnerId | string | `nil` | Specify an identifier for this instance of _ExternalDNS_ wWhen using a registry other than `noop`. | | txtPrefix | string | `nil` | Specify a prefix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtSuffix`. | | txtSuffix | string | `nil` | Specify a suffix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtPrefix`. | diff --git a/packages/system/external-dns/charts/external-dns/README.md.gotmpl b/packages/system/external-dns/charts/external-dns/README.md.gotmpl index fc4ada14..e313a2ba 100644 --- a/packages/system/external-dns/charts/external-dns/README.md.gotmpl +++ b/packages/system/external-dns/charts/external-dns/README.md.gotmpl @@ -27,10 +27,7 @@ helm upgrade --install {{ template "chart.name" . }} external-dns/{{ template "c ## Providers -> Legacy support of setting `provider: ` is deprecated. - -Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider..` values, where supported, and the `extraArgs` value. - +Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider..` values, where supported, and the `extraArgs` value. For legacy support `provider` can be set to the name of the provider with all additional configuration being set via the `extraArgs` value. See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-providers) for more info on available providers and tutorials. ### Providers with Specific Configuration Support @@ -43,13 +40,13 @@ See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-provider For set up for a specific provider using the Helm chart, see the following links: -* [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc) -* [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm) -* [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm) -* [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm) -* [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm) -* [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm) -* [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm) +- [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc) +- [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm) +- [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm) +- [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm) +- [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm) +- [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm) +- [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm) ## Namespaced Scoped Installation diff --git a/packages/system/external-dns/charts/external-dns/RELEASE.md b/packages/system/external-dns/charts/external-dns/RELEASE.md index 956cb0b5..02634a30 100644 --- a/packages/system/external-dns/charts/external-dns/RELEASE.md +++ b/packages/system/external-dns/charts/external-dns/RELEASE.md @@ -1,13 +1,10 @@ -### Added - -- Add option to set `annotationPrefix` ([#5889](https://github.com/kubernetes-sigs/external-dns/pull/5889)) _@lexfrei_ - ### Changed -- Grant `networking.k8s.io/ingresses` and `gateway.solo.io/gateways` permissions when using `gloo-proxy` source. ([#5909](https://github.com/kubernetes-sigs/external-dns/pull/5909)) _@cucxabong_ -- Update _ExternalDNS_ OCI image version to [v0.20.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.20.0). ([#6005](https://github.com/kubernetes-sigs/external-dns/pull/6005)) _@vflaux_ +- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#xxxx](https://github.com/kubernetes-sigs/external-dns/pull/xxxx)) _@stevehipwell_ ### Fixed -- Fixed the missing schema for `.provider.webhook.serviceMonitor` configs ([#5932](https://github.com/kubernetes-sigs/external-dns/pull/5932)) _@chrisbsmith_ -- Fixed incorrect indentation of selector labels under `spec.template.spec.topologySpreadConstraints` when `topologySpreadConstraints` is set. ([#6054](https://github.com/kubernetes-sigs/external-dns/pull/6054)) _@andylim0221_ +- Fixed `provider.webhook.resources` behavior to correctly leverage resource limits. ([#4560](https://github.com/kubernetes-sigs/external-dns/pull/4560)) _@crutonjohn_ +- Fixed `provider.webhook.imagePullPolicy` behavior to correctly leverage pull policy. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_ +- Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_ +- Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes. ([#4691](https://github.com/kubernetes-sigs/external-dns/pull/4691)) _@kimsondrup_ & _@hatrx_ diff --git a/packages/system/external-dns/charts/external-dns/ci/ci-values.yaml b/packages/system/external-dns/charts/external-dns/ci/ci-values.yaml new file mode 100644 index 00000000..4d278e94 --- /dev/null +++ b/packages/system/external-dns/charts/external-dns/ci/ci-values.yaml @@ -0,0 +1,2 @@ +provider: + name: inmemory diff --git a/packages/system/external-dns/charts/external-dns/crds/dnsendpoints.externaldns.k8s.io.yaml b/packages/system/external-dns/charts/external-dns/crds/dnsendpoint.yaml similarity index 82% rename from packages/system/external-dns/charts/external-dns/crds/dnsendpoints.externaldns.k8s.io.yaml rename to packages/system/external-dns/charts/external-dns/crds/dnsendpoint.yaml index c983c8d7..822cd850 100644 --- a/packages/system/external-dns/charts/external-dns/crds/dnsendpoints.externaldns.k8s.io.yaml +++ b/packages/system/external-dns/charts/external-dns/crds/dnsendpoint.yaml @@ -1,9 +1,9 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: + name: dnsendpoints.externaldns.k8s.io annotations: api-approved.kubernetes.io: https://github.com/kubernetes-sigs/external-dns/pull/2007 - name: dnsendpoints.externaldns.k8s.io spec: group: externaldns.k8s.io names: @@ -16,9 +16,6 @@ spec: - name: v1alpha1 schema: openAPIV3Schema: - description: |- - DNSEndpoint is a contract that a user-specified CRD must implement to be used as a source for external-dns. - The user-specified CRD should also have the status sub-resource. properties: apiVersion: description: |- @@ -42,7 +39,9 @@ spec: properties: endpoints: items: - description: Endpoint is a high-level way of a connection between a service and an IP + description: + Endpoint is a high-level way of a connection between + a service and an IP properties: dnsName: description: The hostname of the DNS record @@ -55,7 +54,9 @@ spec: providerSpecific: description: ProviderSpecific stores provider specific config items: - description: ProviderSpecificProperty holds the name and value of a configuration which is specific to individual DNS providers + description: + ProviderSpecificProperty holds the name and value + of a configuration which is specific to individual DNS providers properties: name: type: string @@ -68,10 +69,15 @@ spec: format: int64 type: integer recordType: - description: RecordType type of record, e.g. CNAME, A, AAAA, SRV, TXT etc + description: + RecordType type of record, e.g. CNAME, A, AAAA, + SRV, TXT etc type: string setIdentifier: - description: Identifier to distinguish multiple records with the same name and type (e.g. Route53 records with routing policies other than 'simple') + description: + Identifier to distinguish multiple records with + the same name and type (e.g. Route53 records with routing + policies other than 'simple') type: string targets: description: The targets the DNS record points to diff --git a/packages/system/external-dns/charts/external-dns/templates/NOTES.txt b/packages/system/external-dns/charts/external-dns/templates/NOTES.txt index dedcff42..5e37ecca 100644 --- a/packages/system/external-dns/charts/external-dns/templates/NOTES.txt +++ b/packages/system/external-dns/charts/external-dns/templates/NOTES.txt @@ -5,14 +5,3 @@ App version: {{ .Chart.AppVersion }} Image tag: {{ include "external-dns.image" . }} *********************************************************************** - -{{- if eq (typeOf .Values.provider) "string" }} -🚧 DEPRECATIONS 🚧 - -The following features, functions, or methods are deprecated and no longer recommended for use. - -{{/* The deprecation message for legacy 'provider: name'. */}} -{{- if eq (typeOf .Values.provider) "string" -}} -❗❗❗ DEPRECATED ❗❗❗ The legacy 'provider: ' configuration is in use. Support will be removed in future releases. -{{- end -}} -{{- end }} diff --git a/packages/system/external-dns/charts/external-dns/templates/_helpers.tpl b/packages/system/external-dns/charts/external-dns/templates/_helpers.tpl index aad09822..3ce55cd8 100644 --- a/packages/system/external-dns/charts/external-dns/templates/_helpers.tpl +++ b/packages/system/external-dns/charts/external-dns/templates/_helpers.tpl @@ -73,7 +73,6 @@ The image to use {{/* Provider name, Keeps backward compatibility on provider -TODO: line eq (typeOf .Values.provider) "string" to be removed in future releases */}} {{- define "external-dns.providerName" -}} {{- if eq (typeOf .Values.provider) "string" }} @@ -94,21 +93,3 @@ The image to use for optional webhook sidecar {{- printf "%s:%s" .repository .tag }} {{- end }} {{- end }} - -{{/* -The pod affinity default label Selector -*/}} -{{- define "external-dns.labelSelector" -}} -labelSelector: - matchLabels: - {{ include "external-dns.selectorLabels" . | nindent 4 }} -{{- end }} - -{{/* -Check if any Gateway API sources are enabled -*/}} -{{- define "external-dns.hasGatewaySources" -}} -{{- if or (has "gateway-httproute" .Values.sources) (has "gateway-grpcroute" .Values.sources) (has "gateway-tlsroute" .Values.sources) (has "gateway-tcproute" .Values.sources) (has "gateway-udproute" .Values.sources) -}} -true -{{- end -}} -{{- end }} diff --git a/packages/system/external-dns/charts/external-dns/templates/clusterrole.yaml b/packages/system/external-dns/charts/external-dns/templates/clusterrole.yaml index b3ef006c..44f72bd2 100644 --- a/packages/system/external-dns/charts/external-dns/templates/clusterrole.yaml +++ b/packages/system/external-dns/charts/external-dns/templates/clusterrole.yaml @@ -18,15 +18,10 @@ rules: {{- end }} {{- if or (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }} - apiGroups: [""] - resources: ["services"] + resources: ["services","endpoints"] verbs: ["get","watch","list"] {{- end }} -{{- if has "service" .Values.sources }} - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get","watch","list"] -{{- end }} -{{- if or (has "ingress" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) (has "gloo-proxy" .Values.sources) }} +{{- if or (has "ingress" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }} - apiGroups: ["extensions","networking.k8s.io"] resources: ["ingresses"] verbs: ["get","watch","list"] @@ -60,17 +55,13 @@ rules: resources: ["dnsendpoints/status"] verbs: ["*"] {{- end }} -{{- if include "external-dns.hasGatewaySources" . }} -{{- if or (not .Values.namespaced) (and .Values.namespaced (not .Values.gatewayNamespace)) }} +{{- if or (has "gateway-httproute" .Values.sources) (has "gateway-grpcroute" .Values.sources) (has "gateway-tlsroute" .Values.sources) (has "gateway-tcproute" .Values.sources) (has "gateway-udproute" .Values.sources) }} - apiGroups: ["gateway.networking.k8s.io"] resources: ["gateways"] verbs: ["get","watch","list"] -{{- end }} -{{- if not .Values.namespaced }} - apiGroups: [""] resources: ["namespaces"] - verbs: ["get","watch","list"] -{{- end }} + verbs: ["get","watch","list"] {{- end }} {{- if has "gateway-httproute" .Values.sources }} - apiGroups: ["gateway.networking.k8s.io"] @@ -99,7 +90,7 @@ rules: {{- end }} {{- if has "gloo-proxy" .Values.sources }} - apiGroups: ["gloo.solo.io","gateway.solo.io"] - resources: ["proxies","virtualservices","gateways"] + resources: ["proxies","virtualservices"] verbs: ["get","watch","list"] {{- end }} {{- if has "kong-tcpingress" .Values.sources }} @@ -125,39 +116,12 @@ rules: resources: ["routegroups/status"] verbs: ["patch","update"] {{- end }} -{{- if or (has "f5-virtualserver" .Values.sources) (has "f5-transportserver" .Values.sources) }} +{{- if has "f5-virtualserver" .Values.sources }} - apiGroups: ["cis.f5.com"] - resources: ["virtualservers", "transportservers"] + resources: ["virtualservers"] verbs: ["get","watch","list"] {{- end }} {{- with .Values.rbac.additionalPermissions }} {{- toYaml . | nindent 2 }} {{- end }} -{{- if and .Values.rbac.create .Values.namespaced (include "external-dns.hasGatewaySources" .) }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "external-dns.fullname" . }}-namespaces - labels: - {{- include "external-dns.labels" . | nindent 4 }} -rules: - - apiGroups: [""] - resources: ["namespaces"] - verbs: ["get","watch","list"] -{{- if .Values.gatewayNamespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "external-dns.fullname" . }}-gateway - namespace: {{ .Values.gatewayNamespace }} - labels: - {{- include "external-dns.labels" . | nindent 4 }} -rules: - - apiGroups: ["gateway.networking.k8s.io"] - resources: ["gateways"] - verbs: ["get","watch","list"] -{{- end }} -{{- end }} {{- end }} diff --git a/packages/system/external-dns/charts/external-dns/templates/clusterrolebinding.yaml b/packages/system/external-dns/charts/external-dns/templates/clusterrolebinding.yaml index 49400c0b..74a51476 100644 --- a/packages/system/external-dns/charts/external-dns/templates/clusterrolebinding.yaml +++ b/packages/system/external-dns/charts/external-dns/templates/clusterrolebinding.yaml @@ -13,39 +13,4 @@ subjects: - kind: ServiceAccount name: {{ template "external-dns.serviceAccountName" . }} namespace: {{ .Release.Namespace }} -{{- if and .Values.rbac.create .Values.namespaced (include "external-dns.hasGatewaySources" .) }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "external-dns.fullname" . }}-namespaces - labels: - {{- include "external-dns.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "external-dns.fullname" . }}-namespaces -subjects: - - kind: ServiceAccount - name: {{ template "external-dns.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- if .Values.gatewayNamespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "external-dns.fullname" . }}-gateway - namespace: {{ .Values.gatewayNamespace }} - labels: - {{- include "external-dns.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "external-dns.fullname" . }}-gateway -subjects: - - kind: ServiceAccount - name: {{ template "external-dns.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end }} -{{- end }} {{- end }} diff --git a/packages/system/external-dns/charts/external-dns/templates/deployment.yaml b/packages/system/external-dns/charts/external-dns/templates/deployment.yaml index b213f754..02e9b397 100644 --- a/packages/system/external-dns/charts/external-dns/templates/deployment.yaml +++ b/packages/system/external-dns/charts/external-dns/templates/deployment.yaml @@ -1,4 +1,3 @@ -{{- $defaultSelector := (include "external-dns.labelSelector" $ ) | fromYaml -}} {{- $providerName := tpl (include "external-dns.providerName" .) $ }} apiVersion: apps/v1 kind: Deployment @@ -41,7 +40,7 @@ spec: {{- if not (quote .Values.automountServiceAccountToken | empty) }} automountServiceAccountToken: {{ .Values.automountServiceAccountToken }} {{- end }} - {{- with (default .Values.global.imagePullSecrets .Values.imagePullSecrets) }} + {{- with .Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} @@ -100,59 +99,25 @@ spec: {{- if .Values.txtOwnerId }} - --txt-owner-id={{ .Values.txtOwnerId }} {{- end }} - {{- if and .Values.txtPrefix .Values.txtSuffix }} - {{- fail (printf "'txtPrefix' and 'txtSuffix' are mutually exclusive") }} - {{- end }} {{- if .Values.txtPrefix }} - --txt-prefix={{ .Values.txtPrefix }} - {{- else if .Values.txtSuffix }} + {{- end }} + {{- if and (eq .Values.txtPrefix "") (ne .Values.txtSuffix "") }} - --txt-suffix={{ .Values.txtSuffix }} {{- end }} {{- if .Values.namespaced }} - --namespace={{ .Release.Namespace }} {{- end }} - {{- if .Values.gatewayNamespace }} - - --gateway-namespace={{ .Values.gatewayNamespace }} - {{- end }} {{- range .Values.domainFilters }} - --domain-filter={{ . }} {{- end }} {{- range .Values.excludeDomains }} - --exclude-domains={{ . }} {{- end }} - {{- if .Values.labelFilter }} - - --label-filter={{ .Values.labelFilter }} - {{- end }} - {{- if .Values.annotationFilter }} - - --annotation-filter={{ .Values.annotationFilter }} - {{- end }} - {{- if .Values.annotationPrefix }} - - --annotation-prefix={{ .Values.annotationPrefix }} - {{- end }} - {{- range .Values.managedRecordTypes }} - - --managed-record-types={{ . }} - {{- end }} - --provider={{ $providerName }} - {{- if kindIs "map" .Values.extraArgs }} - {{- range $key, $value := .Values.extraArgs }} - {{- if not (kindIs "invalid" $value) }} - {{- if kindIs "slice" $value }} - {{- range $value }} - - --{{ $key }}={{ tpl (. | toString) $ }} - {{- end }} - {{- else }} - - --{{ $key }}={{ tpl ($value | toString) $ }} - {{- end }} - {{- else }} - - --{{ $key }} - {{- end }} - {{- end }} - {{- end }} - {{- if kindIs "slice" .Values.extraArgs }} - {{- range .Values.extraArgs }} + {{- range .Values.extraArgs }} - {{ tpl . $ }} - {{- end }} - {{- end }} + {{- end }} ports: - name: http protocol: TCP @@ -232,71 +197,11 @@ spec: {{- end }} {{- with .Values.affinity }} affinity: - {{- with .nodeAffinity }} - nodeAffinity: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .podAffinity }} - podAffinity: - {{- with .preferredDuringSchedulingIgnoredDuringExecution }} - preferredDuringSchedulingIgnoredDuringExecution: - {{- range . }} - - podAffinityTerm: - {{- if dig "podAffinityTerm" "labelSelector" nil . }} - {{- toYaml .podAffinityTerm | nindent 16 }} - {{- else }} - {{- (merge $defaultSelector .podAffinityTerm) | toYaml | nindent 16 }} - {{- end }} - weight: {{ .weight }} - {{- end }} - {{- end }} - {{- with .requiredDuringSchedulingIgnoredDuringExecution }} - requiredDuringSchedulingIgnoredDuringExecution: - {{- range . }} - {{- if dig "labelSelector" nil . }} - - {{ toYaml . | indent 16 | trim }} - {{- else }} - - {{ (merge $defaultSelector .) | toYaml | indent 16 | trim }} - {{- end }} - {{- end }} - {{- end }} - {{- end }} - {{- with .podAntiAffinity }} - podAntiAffinity: - {{- with .preferredDuringSchedulingIgnoredDuringExecution }} - preferredDuringSchedulingIgnoredDuringExecution: - {{- range . }} - - podAffinityTerm: - {{- if dig "podAffinityTerm" "labelSelector" nil . }} - {{- toYaml .podAffinityTerm | nindent 16 }} - {{- else }} - {{- (merge $defaultSelector .podAffinityTerm) | toYaml | nindent 16 }} - {{- end }} - weight: {{ .weight }} - {{- end }} - {{- end }} - {{- with .requiredDuringSchedulingIgnoredDuringExecution }} - requiredDuringSchedulingIgnoredDuringExecution: - {{- range . }} - {{- if dig "labelSelector" nil . }} - - {{ toYaml . | indent 16 | trim }} - {{- else }} - - {{ (merge $defaultSelector .) | toYaml | indent 16 | trim }} - {{- end }} - {{- end }} - {{- end }} - {{- end }} + {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.topologySpreadConstraints }} topologySpreadConstraints: - {{- range . }} - - {{ toYaml . | nindent 10 | trim }} - {{- if not (hasKey . "labelSelector") }} - labelSelector: - matchLabels: - {{- include "external-dns.selectorLabels" $ | nindent 14 }} - {{- end }} - {{- end }} + {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.tolerations }} tolerations: diff --git a/packages/system/external-dns/charts/external-dns/templates/serviceaccount.yaml b/packages/system/external-dns/charts/external-dns/templates/serviceaccount.yaml index 27196a2a..f627313a 100644 --- a/packages/system/external-dns/charts/external-dns/templates/serviceaccount.yaml +++ b/packages/system/external-dns/charts/external-dns/templates/serviceaccount.yaml @@ -11,9 +11,7 @@ metadata: {{- end }} {{- with .Values.serviceAccount.annotations }} annotations: - {{- range $k, $v := . }} - {{- printf "%s: %s" (toYaml (tpl $k $)) (toYaml (tpl $v $)) | nindent 4 }} - {{- end }} + {{- toYaml . | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} {{- end }} diff --git a/packages/system/external-dns/charts/external-dns/values.schema.json b/packages/system/external-dns/charts/external-dns/values.schema.json index b4c5e3a4..614deeac 100644 --- a/packages/system/external-dns/charts/external-dns/values.schema.json +++ b/packages/system/external-dns/charts/external-dns/values.schema.json @@ -1,697 +1,54 @@ { - "$schema": "http://json-schema.org/draft-07/schema#", + "$schema": "http://json-schema.org/draft-07/schema", "type": "object", "properties": { - "affinity": { - "description": "Affinity settings for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels.", - "type": "object" - }, - "annotationFilter": { - "description": "Filter resources queried for endpoints by annotation selector.", - "type": [ - "string", - "null" - ] - }, - "annotationPrefix": { - "description": "Annotation prefix for external-dns annotations (useful for split horizon DNS with multiple instances).", - "type": [ - "string", - "null" - ] - }, - "automountServiceAccountToken": { - "description": "Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`.", - "type": "boolean" - }, - "commonLabels": { - "description": "Labels to add to all chart resources.", - "type": "object" - }, - "deploymentAnnotations": { - "description": "Annotations to add to the `Deployment`.", - "type": "object" - }, - "deploymentStrategy": { - "description": "[Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).", - "type": "object", - "properties": { - "type": { - "default": "Recreate", - "type": "string", - "enum": [ - "Recreate", - "RollingUpdate" - ] + "provider": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "object", + "properties": { + "name": { + "type": "string" + } + } } - }, - "additionalProperties": true - }, - "dnsConfig": { - "description": "[DNS config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) for the pod, if not set the default will be used.", - "type": [ - "object", - "null" ] }, - "dnsPolicy": { - "description": "[DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) for the pod, if not set the default will be used.", - "type": [ - "string", - "null" - ] - }, - "domainFilters": { - "description": "Limit possible target zones by domain suffixes.", - "type": "array" - }, - "enabled": { - "description": "No effect - reserved for use in sub-charting", - "type": [ - "boolean", - "null" - ] - }, - "env": { - "description": "[Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `external-dns` container.", - "type": "array" - }, - "excludeDomains": { - "description": "Intentionally exclude domains from being managed.", - "type": "array" - }, "extraArgs": { - "description": "Extra arguments to provide to _ExternalDNS_. An array or map can be used, with maps allowing for value overrides; maps also support slice values to use the same arg multiple times.", - "type": [ - "array", - "null", - "object" - ], - "uniqueItems": true, - "items": { - "type": "string" - } - }, - "extraContainers": { - "description": "Extra containers to add to the `Deployment`.", - "type": "array" - }, - "extraVolumeMounts": { - "description": "Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `external-dns` container.", - "type": "array" - }, - "extraVolumes": { - "description": "Extra [volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the `Pod`.", - "type": "array" - }, - "fullnameOverride": { - "description": "Override the full name of the chart.", - "type": [ - "string", - "null" - ] - }, - "gatewayNamespace": { - "description": "_Gateway API_ gateway namespace to watch.", - "type": [ - "string", - "null" - ] - }, - "global": { - "type": "object", - "properties": { - "imagePullSecrets": { - "description": "Global image pull secrets.", - "type": "array", - "items": { - "type": "object" - } - } - } - }, - "image": { - "type": "object", - "properties": { - "pullPolicy": { - "description": "Image pull policy for the `external-dns` container.", - "type": "string", - "enum": [ - "IfNotPresent", - "Always" - ] - }, - "repository": { - "description": "Image repository for the `external-dns` container.", - "type": "string" - }, - "tag": { - "description": "Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set.", - "type": [ - "string", - "null" - ] - } - }, - "additionalProperties": false - }, - "imagePullSecrets": { - "description": "Image pull secrets.", "type": "array", - "items": { - "type": "object" - } - }, - "initContainers": { - "description": "[Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the `Pod` definition.", - "type": "array" - }, - "interval": { - "description": "Interval for DNS updates.", - "type": "string" - }, - "labelFilter": { - "description": "Filter resources queried for endpoints by label selector.", - "type": [ - "string", - "null" - ] - }, - "livenessProbe": { - "description": "[Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.", - "type": "object", - "properties": { - "failureThreshold": { - "type": "integer" - }, - "httpGet": { - "type": "object", - "properties": { - "path": { - "type": "string" - }, - "port": { - "type": "string" - } - } - }, - "initialDelaySeconds": { - "type": "integer" - }, - "periodSeconds": { - "type": "integer" - }, - "successThreshold": { - "type": "integer" - }, - "timeoutSeconds": { - "type": "integer" - } - } - }, - "logFormat": { - "description": "Log format.", - "default": "text", - "type": "string", - "enum": [ - "text", - "json" - ] - }, - "logLevel": { - "description": "Log level.", - "default": "info", - "type": "string", - "enum": [ - "panic", - "debug", - "info", - "warning", - "error", - "fatal" - ] - }, - "managedRecordTypes": { - "description": "Record types to manage (default: A, AAAA, CNAME)", - "type": [ - "array", - "null" - ], - "uniqueItems": true, "items": { "type": "string" } }, - "nameOverride": { - "description": "Override the name of the chart.", - "type": [ - "string", - "null" - ] - }, - "namespaced": { - "description": "if `true`, _ExternalDNS_ will run in a namespaced scope (`Role`` and `Rolebinding`` will be namespaced too).", - "type": "boolean" - }, - "nodeSelector": { - "description": "Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).", - "type": "object" - }, - "podAnnotations": { - "description": "Annotations to add to the `Pod`.", - "type": "object" - }, - "podLabels": { - "description": "Labels to add to the `Pod`.", - "type": "object" - }, - "podSecurityContext": { - "description": "[Pod security context](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podsecuritycontext-v1-core), this supports full customisation.", - "type": "object", - "properties": { - "fsGroup": { - "type": "integer" - }, - "runAsNonRoot": { - "type": "boolean" - }, - "seccompProfile": { - "type": "object", - "properties": { - "type": { - "type": "string" - } - } - } - } - }, - "policy": { - "description": "How DNS records are synchronized between sources and providers; available values are `create-only`, `sync`, \u0026 `upsert-only`.", - "default": "upsert-only", - "type": "string", - "enum": [ - "create-only", - "sync", - "upsert-only" - ] - }, - "priorityClassName": { - "description": "Priority class name for the `Pod`.", - "type": [ - "string", - "null" - ] - }, - "provider": { - "type": [ - "object", - "string" - ], - "properties": { - "name": { - "description": "_ExternalDNS_ provider name; for the available providers and how to configure them see [README](https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#providers).", - "type": "string" - }, - "webhook": { - "type": "object", - "properties": { - "args": { - "description": "Extra arguments to provide for the `webhook` container.", - "type": "array" - }, - "env": { - "description": "[Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `webhook` container.", - "type": "array" - }, - "extraVolumeMounts": { - "description": "Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `webhook` container.", - "type": "array" - }, - "image": { - "type": "object", - "properties": { - "pullPolicy": { - "description": "Image pull policy for the `webhook` container.", - "type": "string" - }, - "repository": { - "description": "Image repository for the `webhook` container.", - "type": [ - "string", - "null" - ] - }, - "tag": { - "description": "Image tag for the `webhook` container.", - "type": [ - "string", - "null" - ] - } - } - }, - "limits": { - "type": "object", - "properties": { - "cpu": { - "type": "string" - }, - "memory": { - "type": "string" - } - } - }, - "livenessProbe": { - "description": "[Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.", - "type": "object", - "properties": { - "failureThreshold": { - "type": [ - "integer", - "null" - ] - }, - "httpGet": { - "type": "object", - "properties": { - "path": { - "type": [ - "string", - "null" - ] - }, - "port": { - "default": "string", - "type": [ - "integer", - "string" - ] - } - } - }, - "initialDelaySeconds": { - "type": [ - "integer", - "null" - ] - }, - "periodSeconds": { - "type": [ - "integer", - "null" - ] - }, - "successThreshold": { - "type": [ - "integer", - "null" - ] - }, - "timeoutSeconds": { - "type": [ - "integer", - "null" - ] - } - } - }, - "readinessProbe": { - "description": "[Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `webhook` container.", - "type": "object", - "properties": { - "failureThreshold": { - "type": [ - "integer", - "null" - ] - }, - "httpGet": { - "type": "object", - "properties": { - "path": { - "type": [ - "string", - "null" - ] - }, - "port": { - "default": "string", - "type": [ - "integer", - "string" - ] - } - } - }, - "initialDelaySeconds": { - "type": [ - "integer", - "null" - ] - }, - "periodSeconds": { - "type": [ - "integer", - "null" - ] - }, - "successThreshold": { - "type": [ - "integer", - "null" - ] - }, - "timeoutSeconds": { - "type": [ - "integer", - "null" - ] - } - } - }, - "requests": { - "type": "object", - "properties": { - "cpu": { - "type": "string" - }, - "memory": { - "type": "string" - } - } - }, - "resources": { - "description": "[Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `webhook` container.", - "type": "object" - }, - "securityContext": { - "description": "[Pod security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `webhook` container.", - "type": "object" - }, - "service": { - "type": "object", - "properties": { - "port": { - "description": "Webhook exposed HTTP port for the service.", - "type": "integer" - } - } - }, - "serviceMonitor": { - "description": "Optional [Service Monitor](https://prometheus-operator.dev/docs/operator/design/#servicemonitor) configuration for the `webhook` container.", - "type": "object", - "properties": { - "bearerTokenFile": { - "type": [ - "string", - "null" - ] - }, - "interval": { - "type": [ - "string", - "null" - ] - }, - "metricRelabelings": { - "type": "array" - }, - "relabelings": { - "type": "array" - }, - "scheme": { - "type": [ - "string", - "null" - ] - }, - "scrapeTimeout": { - "type": [ - "string", - "null" - ] - }, - "tlsConfig": { - "type": "object" - } - } - } - } - } - } - }, - "rbac": { - "type": "object", - "properties": { - "additionalPermissions": { - "description": "Additional rules to add to the `ClusterRole`.", - "type": "array" - }, - "create": { - "description": "If `true`, create a `ClusterRole` \u0026 `ClusterRoleBinding` with access to the Kubernetes API.", - "type": "boolean" - } - }, - "additionalProperties": true - }, - "readinessProbe": { - "description": "[Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.", - "type": "object", - "properties": { - "failureThreshold": { - "type": "integer" - }, - "httpGet": { - "type": "object", - "properties": { - "path": { - "type": "string" - }, - "port": { - "type": "string" - } - } - }, - "initialDelaySeconds": { - "type": "integer" - }, - "periodSeconds": { - "type": "integer" - }, - "successThreshold": { - "type": "integer" - }, - "timeoutSeconds": { - "type": "integer" - } - } - }, - "registry": { - "description": "Specify the registry for storing ownership and labels. Valid values are `txt`, `aws-sd`, `dynamodb` \u0026 `noop`.", - "default": "txt", - "type": "string", - "enum": [ - "txt", - "aws-sd", - "dynamodb", - "noop" - ] - }, - "resources": { - "description": "[Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `external-dns` container.", - "type": "object", - "properties": { - "limits": { - "type": "object", - "properties": { - "cpu": { - "type": "string" - }, - "memory": { - "type": "string" - } - } - }, - "requests": { - "type": "object", - "properties": { - "cpu": { - "type": "string" - }, - "memory": { - "type": "string" - } - } - } - } - }, - "revisionHistoryLimit": { - "description": "Specify the number of old `ReplicaSets` to retain to allow rollback of the `Deployment``.", - "type": [ - "integer", - "null" - ], - "minimum": 0 - }, "secretConfiguration": { + "$comment": "This value is DEPRECATED as secrets should be configured external to the chart and exposed to the container via extraVolumes & extraVolumeMounts.", "type": "object", "properties": { - "data": { - "description": "`Secret` data.", - "type": "object" - }, "enabled": { - "description": "If `true`, create a `Secret` to store sensitive provider configuration (**DEPRECATED**).", "type": "boolean" }, "mountPath": { - "description": "Mount path for the `Secret`, this can be templated.", "type": [ "string", "null" ] }, "subPath": { - "description": "Sub-path for mounting the `Secret`, this can be templated.", "type": [ "string", "null" ] - } - } - }, - "securityContext": { - "description": "[Security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `external-dns` container.", - "type": "object", - "properties": { - "allowPrivilegeEscalation": { - "type": "boolean" }, - "capabilities": { + "data": { "type": "object", - "properties": { - "drop": { - "type": "array", - "items": { - "type": "string" - } + "patternProperties": { + ".+": { + "type": "string" } } - }, - "privileged": { - "type": "boolean" - }, - "readOnlyRootFilesystem": { - "type": "boolean" - }, - "runAsGroup": { - "type": "integer" - }, - "runAsNonRoot": { - "type": "boolean" - }, - "runAsUser": { - "type": "integer" } } }, @@ -699,194 +56,36 @@ "type": "object", "properties": { "annotations": { - "description": "Service annotations.", "type": "object" }, "ipFamilies": { - "description": "Service IP families (e.g. IPv4 and/or IPv6).", - "type": [ - "array", - "null" - ], - "maxItems": 2, - "minItems": 0, - "uniqueItems": true, + "type": "array", "items": { "type": "string", "enum": [ - "IPv4", - "IPv6" + "IPv6", + "IPv4" ] } }, "ipFamilyPolicy": { - "description": "Service IP family policy.", "type": [ "string", "null" ], - "enum": [ - "SingleStack", - "PreferDualStack", - "RequireDualStack", - null - ] + "items": { + "type": "string", + "enum": [ + "SingleStack", + "PreferDualStack", + "RequireDualStack" + ] + } }, "port": { - "description": "Service HTTP port.", - "default": 7979, - "type": "integer", - "minimum": 0 + "type": "integer" } } - }, - "serviceAccount": { - "type": "object", - "properties": { - "annotations": { - "description": "Annotations to add to the service account. Templates are allowed in both the key and the value. Example: `example.com/annotation/{{ .Values.nameOverride }}: {{ .Values.nameOverride }}`", - "type": "object" - }, - "automountServiceAccountToken": { - "description": "Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`.", - "type": "boolean" - }, - "create": { - "description": "If `true`, create a new `ServiceAccount`.", - "type": "boolean" - }, - "labels": { - "description": "Labels to add to the service account.", - "type": "object" - }, - "name": { - "description": "If this is set and `serviceAccount.create` is `true` this will be used for the created `ServiceAccount` name, if set and `serviceAccount.create` is `false` then this will define an existing `ServiceAccount` to use.", - "type": [ - "string", - "null" - ] - } - } - }, - "serviceMonitor": { - "type": "object", - "properties": { - "additionalLabels": { - "description": "Additional labels for the `ServiceMonitor`.", - "type": "object" - }, - "annotations": { - "description": "Annotations to add to the `ServiceMonitor`.", - "type": "object" - }, - "bearerTokenFile": { - "description": "Provide a bearer token file for the `ServiceMonitor`.", - "type": [ - "string", - "null" - ] - }, - "enabled": { - "description": "If `true`, create a `ServiceMonitor` resource to support the _Prometheus Operator_.", - "type": "boolean" - }, - "interval": { - "description": "If set override the _Prometheus_ default interval.", - "type": [ - "string", - "null" - ] - }, - "metricRelabelings": { - "description": "[Metric relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) to apply to samples before ingestion.", - "type": "array" - }, - "namespace": { - "description": "If set create the `ServiceMonitor` in an alternate namespace.", - "type": [ - "string", - "null" - ] - }, - "relabelings": { - "description": "[Relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) to apply to samples before ingestion.", - "type": "array" - }, - "scheme": { - "description": "If set overrides the _Prometheus_ default scheme.", - "type": [ - "string", - "null" - ] - }, - "scrapeTimeout": { - "description": "If set override the _Prometheus_ default scrape timeout.", - "type": [ - "string", - "null" - ] - }, - "targetLabels": { - "description": "Provide target labels for the `ServiceMonitor`.", - "type": "array" - }, - "tlsConfig": { - "description": "Configure the `ServiceMonitor` [TLS config](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig).", - "type": "object" - } - } - }, - "shareProcessNamespace": { - "description": "If `true`, the `Pod` will have [process namespace sharing](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) enabled.", - "type": "boolean" - }, - "sources": { - "description": "_Kubernetes_ resources to monitor for DNS entries.", - "type": "array", - "items": { - "type": "string" - } - }, - "terminationGracePeriodSeconds": { - "description": "Termination grace period for the `Pod` in seconds.", - "type": [ - "integer", - "null" - ] - }, - "tolerations": { - "description": "Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).", - "type": "array" - }, - "topologySpreadConstraints": { - "description": "Topology spread constraints for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided one will be created from the pod selector labels.", - "type": "array" - }, - "triggerLoopOnEvent": { - "description": "If `true`, triggers run loop on create/update/delete events in addition of regular interval.", - "type": "boolean" - }, - "txtOwnerId": { - "description": "Specify an identifier for this instance of _ExternalDNS_ when using a registry other than `noop`.", - "type": [ - "string", - "null" - ] - }, - "txtPrefix": { - "description": "Specify a prefix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtSuffix`.", - "type": [ - "string", - "null" - ] - }, - "txtSuffix": { - "description": "Specify a suffix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtPrefix`.", - "type": [ - "string", - "null" - ] } - }, - "additionalProperties": true + } } diff --git a/packages/system/external-dns/charts/external-dns/values.yaml b/packages/system/external-dns/charts/external-dns/values.yaml index 46fbe8f7..9d7dea1b 100644 --- a/packages/system/external-dns/charts/external-dns/values.yaml +++ b/packages/system/external-dns/charts/external-dns/values.yaml @@ -2,26 +2,22 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -global: - # -- Global image pull secrets. - imagePullSecrets: [] # @schema item: object - -image: # @schema additionalProperties: false +image: # -- Image repository for the `external-dns` container. repository: registry.k8s.io/external-dns/external-dns - # -- Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set. - tag: # @schema type:[string, null] + # -- (string) Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set. + tag: # -- Image pull policy for the `external-dns` container. - pullPolicy: IfNotPresent # @schema enum:[IfNotPresent, Always] + pullPolicy: IfNotPresent # -- Image pull secrets. -imagePullSecrets: [] # @schema item: object +imagePullSecrets: [] # -- (string) Override the name of the chart. -nameOverride: # @schema type:[string, null]; default: null +nameOverride: # -- (string) Override the full name of the chart. -fullnameOverride: # @schema type:[string, null]; default: null +fullnameOverride: # -- Labels to add to all chart resources. commonLabels: {} @@ -31,26 +27,24 @@ serviceAccount: create: true # -- Labels to add to the service account. labels: {} - # -- Annotations to add to the service account. Templates are allowed in both the key and the value. Example: `example.com/annotation/{{ .Values.nameOverride }}: {{ .Values.nameOverride }}` + # -- Annotations to add to the service account. annotations: {} # -- (string) If this is set and `serviceAccount.create` is `true` this will be used for the created `ServiceAccount` name, if set and `serviceAccount.create` is `false` then this will define an existing `ServiceAccount` to use. - name: # @schema type:[string, null]; default: null + name: # -- Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`. - automountServiceAccountToken: true + automountServiceAccountToken: service: # -- Service annotations. annotations: {} # -- Service HTTP port. - port: 7979 # @schema minimum:0; default:7979 - # -- Service IP families (e.g. IPv4 and/or IPv6). - ipFamilies: [] # @schema type: [array, null]; item: string; itemEnum: ["IPv4", "IPv6"]; minItems:0; maxItems:2; uniqueItems: true - # - IPv4 - # - IPv6 - # -- Service IP family policy. - ipFamilyPolicy: # @schema type: [string, null]; enum:[SingleStack, PreferDualStack, RequireDualStack, null] + port: 7979 + # -- Service IP families. + ipFamilies: [] + # -- (string) Service IP family policy. + ipFamilyPolicy: -rbac: # @schema additionalProperties: true +rbac: # -- If `true`, create a `ClusterRole` & `ClusterRoleBinding` with access to the Kubernetes API. create: true # -- Additional rules to add to the `ClusterRole`. @@ -60,14 +54,14 @@ rbac: # @schema additionalProperties: true deploymentAnnotations: {} # -- Extra containers to add to the `Deployment`. -extraContainers: [] +extraContainers: {} # -- [Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy). -deploymentStrategy: # @schema additionalProperties: true - type: Recreate # @schema enum:[Recreate, RollingUpdate]; type:string; default: Recreate +deploymentStrategy: + type: Recreate # -- (int) Specify the number of old `ReplicaSets` to retain to allow rollback of the `Deployment``. -revisionHistoryLimit: # @schema type:[integer, null];minimum:0 +revisionHistoryLimit: # -- Labels to add to the `Pod`. podLabels: {} @@ -76,7 +70,7 @@ podLabels: {} podAnnotations: {} # -- (bool) Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`. -automountServiceAccountToken: true +automountServiceAccountToken: # -- If `true`, the `Pod` will have [process namespace sharing](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) enabled. shareProcessNamespace: false @@ -90,16 +84,16 @@ podSecurityContext: type: RuntimeDefault # -- (string) Priority class name for the `Pod`. -priorityClassName: # @schema type:[string, null]; default: null +priorityClassName: # -- (int) Termination grace period for the `Pod` in seconds. -terminationGracePeriodSeconds: # @schema type:[integer, null] +terminationGracePeriodSeconds: # -- (string) [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) for the pod, if not set the default will be used. -dnsPolicy: # @schema type:[string, null]; default: null +dnsPolicy: # -- (object) [DNS config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) for the pod, if not set the default will be used. -dnsConfig: # @schema type:[object, null]; default: null +dnsConfig: # -- [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the `Pod` definition. initContainers: [] @@ -172,17 +166,17 @@ serviceMonitor: # -- Annotations to add to the `ServiceMonitor`. annotations: {} # -- (string) If set create the `ServiceMonitor` in an alternate namespace. - namespace: # @schema type:[string, null]; default: null + namespace: # -- (string) If set override the _Prometheus_ default interval. - interval: # @schema type:[string, null]; default: null + interval: # -- (string) If set override the _Prometheus_ default scrape timeout. - scrapeTimeout: # @schema type:[string, null]; default: null + scrapeTimeout: # -- (string) If set overrides the _Prometheus_ default scheme. - scheme: # @schema type:[string, null]; default: null + scheme: # -- Configure the `ServiceMonitor` [TLS config](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig). tlsConfig: {} # -- (string) Provide a bearer token file for the `ServiceMonitor`. - bearerTokenFile: # @schema type:[string, null]; default: null + bearerTokenFile: # -- [Relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) to apply to samples before ingestion. relabelings: [] # -- [Metric relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) to apply to samples before ingestion. @@ -191,10 +185,10 @@ serviceMonitor: targetLabels: [] # -- Log level. -logLevel: info # @schema enum:[panic, debug, info, warning, error, fatal]; type:string; default: "info" +logLevel: info # -- Log format. -logFormat: text # @schema enum:["text", "json"]; type:string; default: "text" +logFormat: text # -- Interval for DNS updates. interval: 1m @@ -205,56 +199,41 @@ triggerLoopOnEvent: false # -- if `true`, _ExternalDNS_ will run in a namespaced scope (`Role`` and `Rolebinding`` will be namespaced too). namespaced: false -# -- _Gateway API_ gateway namespace to watch. -gatewayNamespace: # @schema type:[string, null]; default: null - # -- _Kubernetes_ resources to monitor for DNS entries. sources: - service - ingress -# -- How DNS records are synchronized between sources and providers; available values are `create-only`, `sync`, & `upsert-only`. -policy: upsert-only # @schema enum:[create-only, sync, upsert-only]; type:string; default: "upsert-only" +# -- How DNS records are synchronized between sources and providers; available values are `sync` & `upsert-only`. +policy: upsert-only # -- Specify the registry for storing ownership and labels. # Valid values are `txt`, `aws-sd`, `dynamodb` & `noop`. -registry: txt # @schema enum:[txt, aws-sd, dynamodb, noop]; default: "txt" -# -- (string) Specify an identifier for this instance of _ExternalDNS_ when using a registry other than `noop`. -txtOwnerId: # @schema type:[string, null]; default: null +registry: txt +# -- (string) Specify an identifier for this instance of _ExternalDNS_ wWhen using a registry other than `noop`. +txtOwnerId: # -- (string) Specify a prefix for the domain names of TXT records created for the `txt` registry. # Mutually exclusive with `txtSuffix`. -txtPrefix: # @schema type:[string, null]; default: null +txtPrefix: # -- (string) Specify a suffix for the domain names of TXT records created for the `txt` registry. # Mutually exclusive with `txtPrefix`. -txtSuffix: # @schema type:[string, null]; default: null +txtSuffix: -# -- Limit possible target zones by domain suffixes. +## - Limit possible target zones by domain suffixes. domainFilters: [] -# -- Intentionally exclude domains from being managed. +## -- Intentionally exclude domains from being managed. excludeDomains: [] -# -- Filter resources queried for endpoints by label selector. -labelFilter: # @schema type: [string,null]; default: null - -# -- Filter resources queried for endpoints by annotation selector. -annotationFilter: # @schema type: [string,null]; default: null - -# -- Annotation prefix for external-dns annotations (useful for split horizon DNS with multiple instances). -annotationPrefix: # @schema type: [string,null]; default: null - -# -- Record types to manage (default: A, AAAA, CNAME) -managedRecordTypes: [] # @schema type: [array, null]; item: string; uniqueItems: true - -provider: # @schema type: [object, string] +provider: # -- _ExternalDNS_ provider name; for the available providers and how to configure them see [README](https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#providers). name: aws webhook: image: # -- (string) Image repository for the `webhook` container. - repository: # @schema type:[string, null]; default: null + repository: # -- (string) Image tag for the `webhook` container. - tag: # @schema type:[string, null]; default: null + tag: # -- Image pull policy for the `webhook` container. pullPolicy: IfNotPresent # -- [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `webhook` container. @@ -272,51 +251,47 @@ provider: # @schema type: [object, string] # @default -- See _values.yaml_ livenessProbe: httpGet: - path: /healthz # @schema type:[string, null]; default: null - port: http-webhook # @schema type:[integer,string]; default: string - initialDelaySeconds: 10 # @schema type:[integer, null]; default: null - periodSeconds: 10 # @schema type:[integer, null]; default: null - timeoutSeconds: 5 # @schema type:[integer, null]; default: null - failureThreshold: 2 # @schema type:[integer, null]; default: null - successThreshold: 1 # @schema type:[integer, null]; default: null + path: /healthz + port: http-webhook + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 2 + successThreshold: 1 # -- [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `webhook` container. # @default -- See _values.yaml_ readinessProbe: httpGet: - path: /healthz # @schema type:[string, null]; default: null - port: http-webhook # @schema type:[integer,string]; default: string - initialDelaySeconds: 5 # @schema type:[integer, null]; default: null - periodSeconds: 10 # @schema type:[integer, null]; default: null - timeoutSeconds: 5 # @schema type:[integer, null]; default: null - failureThreshold: 6 # @schema type:[integer, null]; default: null - successThreshold: 1 # @schema type:[integer, null]; default: null + path: /healthz + port: http-webhook + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 service: # -- Webhook exposed HTTP port for the service. port: 8080 # -- Optional [Service Monitor](https://prometheus-operator.dev/docs/operator/design/#servicemonitor) configuration for the `webhook` container. # @default -- See _values.yaml_ serviceMonitor: - interval: # @schema type:[string, null]; default: null - scheme: # @schema type:[string, null]; default: null + interval: + scheme: tlsConfig: {} - bearerTokenFile: # @schema type:[string, null]; default: null - scrapeTimeout: # @schema type:[string, null]; default: null + bearerTokenFile: + scrapeTimeout: metricRelabelings: [] relabelings: [] # -- Extra arguments to provide to _ExternalDNS_. -# An array or map can be used, with maps allowing for value overrides; maps also support slice values to use the same arg multiple times. -extraArgs: {} # @schema type: [array, null, object]; item: string; uniqueItems: true +extraArgs: [] secretConfiguration: # -- If `true`, create a `Secret` to store sensitive provider configuration (**DEPRECATED**). enabled: false # -- Mount path for the `Secret`, this can be templated. - mountPath: # @schema type:[string, null]; default: null + mountPath: # -- Sub-path for mounting the `Secret`, this can be templated. - subPath: # @schema type:[string, null]; default: null + subPath: # -- `Secret` data. data: {} - -# -- (bool) No effect - reserved for use in sub-charting. -enabled: # @schema type: [boolean, null]; description: No effect - reserved for use in sub-charting diff --git a/packages/system/gpu-operator/examples/README.md b/packages/system/gpu-operator/examples/README.md deleted file mode 100644 index b6f170c8..00000000 --- a/packages/system/gpu-operator/examples/README.md +++ /dev/null @@ -1,121 +0,0 @@ -# GPU operator — native pod workload on Talos (reference) - -The files in this directory are **not** templates. They are reference -artifacts that document one working configuration for running GPU -workloads directly in pods on a Talos-based Cozystack cluster, together -with the DCGM metrics needed by the `gpu/gpu-performance` Grafana -dashboard. - -The out-of-the-box `values-talos.yaml` for this package targets the -sandbox (VFIO passthrough to KubeVirt VMs) scenario. The files here -illustrate an alternative — running CUDA workloads in regular pods with -the NVIDIA device plugin — and the workarounds it currently requires on -Talos. - -## Files - -- [`values-native-talos.yaml`](./values-native-talos.yaml) — Cozystack - `Package` values that disable sandbox workloads, enable the device - plugin, point `hostPaths.driverInstallDir` at the staging location - used by the compat DaemonSet, and wire DCGM to the custom metrics - ConfigMap. -- [`dcgm-custom-metrics.yaml`](./dcgm-custom-metrics.yaml) — `ConfigMap` - with a DCGM metrics CSV that adds profiling, ECC, throttling and - energy counters on top of the upstream defaults. The CSV is a - superset needed for full coverage of the `gpu/gpu-performance` - dashboard. Which parts are actually required depends on which - dashboards you ship — see the table below. -- [`nvidia-driver-compat.yaml`](./nvidia-driver-compat.yaml) — DaemonSet - that stages `libnvidia-ml.so.1` and `nvidia-smi` from the Talos glibc - tree into a path where the NVIDIA GPU Operator validator expects - them. See the "Why the compat DaemonSet exists" section below. - -## Why these are reference, not templates - -Shipping these as first-class templates would silently impose -assumptions that do not hold for every user: - -- Whether the NVIDIA Talos system extension is installed on the nodes. -- Whether GPUs are exposed directly to pods or passed through to VMs. -- The exact path the installed driver ends up at (depends on the - extension version and Talos release). - -The sandbox-oriented `values-talos.yaml` remains the default. Operators -who want native pod GPU workloads can start from this directory and -adapt as needed. - -## Why the compat DaemonSet exists - -The NVIDIA GPU Operator validator checks for `libnvidia-ml.so.1` and -`bin/nvidia-smi` in the path given by `hostPaths.driverInstallDir`. -Talos installs them under `/usr/local/glibc/usr/lib/` and -`/usr/local/bin/`, which the validator does not look at. Until upstream -addresses [NVIDIA/gpu-operator#1687][1], the DaemonSet copies those -files into a directory the validator does inspect and creates the -`.driver-ctr-ready` flag file so the validator proceeds. - -[1]: https://github.com/NVIDIA/gpu-operator/issues/1687 - -The compat DaemonSet runs privileged and bind-mounts host paths, so -the target namespace must allow privileged pods. On clusters that -enforce the Kubernetes Pod Security Standards at `baseline` or -`restricted`, label the namespace with -`pod-security.kubernetes.io/enforce: privileged` (and the matching -`audit`/`warn` labels if the admission webhook is configured to -surface violations) before applying the manifest. - -## Dashboards and what DCGM metrics they need - -Five GPU dashboards live under `gpu/*` in -`packages/system/monitoring/dashboards-infra.list`. All of them share -`packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml` as -their source of aggregated series. The recording rules are safe to -ship on any cluster — they evaluate to empty series when DCGM is not -scraped, or when optional counters are missing. - -What each dashboard needs on top of the upstream DCGM Exporter -[`default-counters.csv`][default-csv]: - -| Dashboard | Scope | Needs beyond defaults | -| ----------------- | ---------------------------------- | ----------------------------------------------------------------------- | -| `gpu-performance` | Per-node, per-GPU deep dive | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION` | -| `gpu-efficiency` | Per-workload util vs tensor active | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION` (via `gpu:*_throttle_fraction:rate5m` recording rules) | -| `gpu-fleet` | Cluster-wide admin inventory | `DCGM_FI_DEV_POWER_MGMT_LIMIT` (for the TDP vs draw panel) | -| `gpu-quotas` | Kube-quota vs live usage | `kube_pod_container_resource_requests`, `kube_pod_status_phase`, `kube_node_status_allocatable` (via `namespace:gpu_count:allocated` / `cluster:gpu_count:*` recording rules) | -| `gpu-tenants` | Per-namespace tenant view | nothing (works on default counters) | - -`DCGM_FI_PROF_PIPE_TENSOR_ACTIVE` and `DCGM_FI_PROF_GR_ENGINE_ACTIVE` -are already in the upstream default set for the pinned DCGM Exporter -version, so the tensor-saturation and engine-active panels work without -any CSV override. The three counters listed in the table — throttling -violations and the power management limit — are the only extras the -tracked dashboards need. The recording rules in -`gpu-recording.rules.yaml` consume utilization, FB used, power, -temperature and the tensor-active profiling counter from the default -set, plus `DCGM_FI_DEV_POWER_VIOLATION` and -`DCGM_FI_DEV_THERMAL_VIOLATION` — used by the -`gpu.recording.efficiency.1m` group to derive the -`gpu:power_throttle_fraction:rate5m` and -`gpu:thermal_throttle_fraction:rate5m` series consumed by the -throttling panels on the efficiency and fleet dashboards. - -The `gpu.recording.throttle.validation.5m` group additionally ships the -`GPUThrottleFractionOverOne` alert (severity `warning`) as a regression -detector: it fires when either throttle-fraction series exceeds 1.0, -which would indicate that DCGM changed the scale/divisor of the -underlying violation counters and the recording rules need to be -re-derived. - -## Verification status - -The minimum-CSV claims above are verified by -`hack/check-gpu-recording-rules.bats`, which cross-checks every -`DCGM_FI_*` reference in the tracked GPU dashboards and recording rules -against the union of the upstream default set (snapshotted at -`hack/dcgm-default-counters.csv` for the pinned DCGM Exporter version) -and the custom CSV in `dcgm-custom-metrics.yaml`. When the DCGM -Exporter image in `packages/system/gpu-operator/charts/gpu-operator/values.yaml` -is bumped, refresh the snapshot from the matching tag of the -[`NVIDIA/dcgm-exporter`][default-csv] repository and rerun the test. - -[default-csv]: https://github.com/NVIDIA/dcgm-exporter/blob/main/etc/default-counters.csv diff --git a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml deleted file mode 100644 index ef2b0b88..00000000 --- a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml +++ /dev/null @@ -1,88 +0,0 @@ -# Custom DCGM Exporter metrics CSV. Referenced from -# examples/values-native-talos.yaml via dcgmExporter.config.name. -# -# Extends the upstream default set with profiling counters, ECC, page -# retirement, row remap, energy and throttling violations — everything -# the gpu/gpu-performance dashboard and the GPU recording rules in -# monitoring-agents expect. -apiVersion: v1 -kind: ConfigMap -metadata: - name: dcgm-custom-metrics - namespace: cozy-gpu-operator -data: - dcgm-metrics.csv: | - # Format - # If line starts with a '#' it is considered a comment - # DCGM FIELD, Prometheus metric type, help message - - # Identity - DCGM_FI_DRIVER_VERSION, label, Driver version. - - # Clocks - DCGM_FI_DEV_SM_CLOCK, gauge, SM clock frequency (in MHz). - DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz). - - # Temperature - DCGM_FI_DEV_MEMORY_TEMP, gauge, Memory temperature (in C). - DCGM_FI_DEV_GPU_TEMP, gauge, GPU temperature (in C). - - # Power - DCGM_FI_DEV_POWER_USAGE, gauge, Power draw (in W). - DCGM_FI_DEV_POWER_MGMT_LIMIT, gauge, Current power management limit (in W). - DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION, counter, Total energy consumption since boot (in mJ). - - # PCIE - DCGM_FI_DEV_PCIE_REPLAY_COUNTER, counter, Total number of PCIe retries. - - # Utilization (the sample period varies depending on the product) - DCGM_FI_DEV_GPU_UTIL, gauge, GPU utilization (in %). - DCGM_FI_DEV_MEM_COPY_UTIL, gauge, Memory utilization (in %). - DCGM_FI_DEV_ENC_UTIL, gauge, Encoder utilization (in %). - DCGM_FI_DEV_DEC_UTIL, gauge, Decoder utilization (in %). - - # Errors and violations - DCGM_FI_DEV_XID_ERRORS, gauge, Value of the last XID error encountered. - - # Memory usage - DCGM_FI_DEV_FB_FREE, gauge, Framebuffer memory free (in MiB). - DCGM_FI_DEV_FB_USED, gauge, Framebuffer memory used (in MiB). - DCGM_FI_DEV_FB_RESERVED, gauge, Framebuffer memory reserved (in MiB). - - # ECC (supported on datacenter-class GPUs such as A10) - DCGM_FI_DEV_ECC_SBE_VOL_TOTAL, counter, Total number of single-bit volatile ECC errors. - DCGM_FI_DEV_ECC_DBE_VOL_TOTAL, counter, Total number of double-bit volatile ECC errors. - DCGM_FI_DEV_ECC_SBE_AGG_TOTAL, counter, Total number of single-bit persistent ECC errors. - DCGM_FI_DEV_ECC_DBE_AGG_TOTAL, counter, Total number of double-bit persistent ECC errors. - - # Retired pages - DCGM_FI_DEV_RETIRED_SBE, counter, Total number of retired pages due to single-bit errors. - DCGM_FI_DEV_RETIRED_DBE, counter, Total number of retired pages due to double-bit errors. - DCGM_FI_DEV_RETIRED_PENDING, counter, Total number of pages pending retirement. - - # Row remapping (not applicable to GDDR6 but left for datacenter GPUs) - DCGM_FI_DEV_UNCORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for uncorrectable errors. - DCGM_FI_DEV_CORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for correctable errors. - DCGM_FI_DEV_ROW_REMAP_FAILURE, gauge, Whether remapping of rows has failed. - - # Throttle / violation counters (crucial for SLA and tenant monitoring) - DCGM_FI_DEV_POWER_VIOLATION, counter, Throttling duration due to power constraints (us per docs; ns on DCGM 3.x). - DCGM_FI_DEV_THERMAL_VIOLATION, counter, Throttling duration due to thermal constraints (us per docs; ns on DCGM 3.x). - DCGM_FI_DEV_SYNC_BOOST_VIOLATION, counter, Throttling duration due to sync-boost constraints (us per docs; ns on DCGM 3.x). - DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (us per docs; ns on DCGM 3.x). - DCGM_FI_DEV_LOW_UTIL_VIOLATION, counter, Throttling duration due to low utilization (us per docs; ns on DCGM 3.x). - DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (us per docs; ns on DCGM 3.x). - - # NVLink — DCGM silently drops this metric on GPUs without NVLink, so - # enabling it unconditionally is safe and keeps this file reusable - # across GPU families. - DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL, counter, Total number of NVLink bandwidth counters for all lanes. - - # DCP (profiling) metrics — supported from Ampere onwards. - DCGM_FI_PROF_GR_ENGINE_ACTIVE, gauge, Ratio of time the graphics engine is active. - DCGM_FI_PROF_SM_ACTIVE, gauge, The ratio of cycles an SM has at least 1 warp assigned. - DCGM_FI_PROF_SM_OCCUPANCY, gauge, The ratio of number of warps resident on an SM. - DCGM_FI_PROF_PIPE_TENSOR_ACTIVE, gauge, Ratio of cycles the tensor (HMMA) pipe is active. - DCGM_FI_PROF_DRAM_ACTIVE, gauge, Ratio of cycles the device memory interface is active sending or receiving data. - DCGM_FI_PROF_PCIE_TX_BYTES, counter, The number of bytes of active PCIe tx (transmit) data including both header and payload. - DCGM_FI_PROF_PCIE_RX_BYTES, counter, The number of bytes of active PCIe rx (read) data including both header and payload. diff --git a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml deleted file mode 100644 index fc9d5981..00000000 --- a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml +++ /dev/null @@ -1,109 +0,0 @@ -# Workaround for https://github.com/NVIDIA/gpu-operator/issues/1687 -# -# On Talos, the NVIDIA system extension installs driver files under -# /usr/local/glibc/usr/lib/ and /usr/local/bin/. The GPU Operator -# validator only looks for libnvidia-ml.so.1 and bin/nvidia-smi under -# the path configured as hostPaths.driverInstallDir. This DaemonSet -# stages the required files into /var/nvidia-driver on each node and -# creates the .driver-ctr-ready flag so the validator proceeds. -# -# Paired with examples/values-native-talos.yaml, which sets -# hostPaths.driverInstallDir to /var/nvidia-driver. -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: nvidia-driver-compat - namespace: cozy-gpu-operator - labels: - app: nvidia-driver-compat -spec: - selector: - matchLabels: - app: nvidia-driver-compat - template: - metadata: - labels: - app: nvidia-driver-compat - # DaemonSet rather than a one-shot Job: staging is idempotent per-node, - # must re-run after every Talos reboot (hostPath contents are wiped on - # reboot when the system extension re-installs), and the pause container - # keeps the pod visible for operator observability (kubectl get pods). - spec: - priorityClassName: system-node-critical - # Restrict to GPU nodes only. Without this the DaemonSet schedules onto - # every node (including control-plane and CPU-only workers) and burns - # resources on hosts where the compat tree is meaningless. - # The label is published by Node Feature Discovery / GPU Operator's NFD - # subchart; if NFD is disabled, replace this with whatever label your - # cluster uses to mark GPU hosts. - nodeSelector: - nvidia.com/gpu.present: "true" - # Tolerate-all is intentionally broad: the nodeSelector above already - # confines scheduling to GPU nodes, so the "Exists" toleration only - # matters when those nodes carry extra taints (dedicated=gpu:NoSchedule, - # nvidia.com/gpu:NoSchedule from the GPU Operator's default policy, - # etc.). This mirrors the stance of the upstream nvidia-driver-daemonset - # and nvidia-device-plugin DaemonSets — blanket tolerations plus a - # narrow nodeSelector. - tolerations: - - operator: Exists - initContainers: - - name: create-driver-tree - image: busybox:1.37 - command: - - sh - - -c - - | - set -e - GLIBC_LIB="/host/usr/local/glibc/usr/lib" - SRC_BIN="/host/usr/local/bin" - DST="/host/var/nvidia-driver" - - mkdir -p "$DST/bin" - - [ -f "$GLIBC_LIB/libnvidia-ml.so.1" ] || { - echo "missing $GLIBC_LIB/libnvidia-ml.so.1" >&2 - exit 1 - } - [ -f "$SRC_BIN/nvidia-smi" ] || { - echo "missing $SRC_BIN/nvidia-smi" >&2 - exit 1 - } - - cp -f "$GLIBC_LIB/libnvidia-ml.so.1" "$DST/libnvidia-ml.so.1" - echo "Copied libnvidia-ml.so.1" - - cp -f "$SRC_BIN/nvidia-smi" "$DST/bin/nvidia-smi" - chmod +x "$DST/bin/nvidia-smi" - echo "Copied nvidia-smi" - - mkdir -p /host/run/nvidia/validations - touch /host/run/nvidia/validations/.driver-ctr-ready - echo "Created driver-ctr-ready flag" - echo "Done" - securityContext: - privileged: true - resources: - requests: - cpu: 10m - memory: 16Mi - limits: - cpu: 100m - memory: 64Mi - volumeMounts: - - name: host-root - mountPath: /host - containers: - - name: pause - image: registry.k8s.io/pause:3.10 - resources: - requests: - cpu: 10m - memory: 8Mi - limits: - cpu: 50m - memory: 16Mi - volumes: - - name: host-root - hostPath: - path: / diff --git a/packages/system/gpu-operator/examples/values-native-talos.yaml b/packages/system/gpu-operator/examples/values-native-talos.yaml deleted file mode 100644 index ef7b2891..00000000 --- a/packages/system/gpu-operator/examples/values-native-talos.yaml +++ /dev/null @@ -1,52 +0,0 @@ -# Cozystack Package values for running GPU workloads natively in pods -# on Talos. This is the counterpart to values-talos.yaml, which targets -# the sandbox (VFIO passthrough) scenario. -# -# Prerequisites: -# - NVIDIA Talos system extension installed on GPU nodes. -# - examples/nvidia-driver-compat.yaml deployed to stage driver files -# where the gpu-operator validator looks for them. -# - examples/dcgm-custom-metrics.yaml applied so DCGM Exporter exports -# the full set of metrics used by the dashboard and recording rules. -apiVersion: cozystack.io/v1alpha1 -kind: Package -metadata: - name: cozystack.gpu-operator -spec: - variant: default - components: - gpu-operator: - values: - gpu-operator: - # The compat DaemonSet stages libnvidia-ml.so.1 and nvidia-smi - # under /var/nvidia-driver. Point the validator at that path. - hostPaths: - driverInstallDir: "/var/nvidia-driver" - # Disable the sandbox path — workloads run in pods, not VMs. - sandboxWorkloads: - enabled: false - vfioManager: - enabled: false - # The Talos extension provides the driver and runtime hooks, - # so the operator's own toolkit and driver components must be - # switched off to avoid conflicting installations. - toolkit: - enabled: false - devicePlugin: - enabled: true - # Export full set of DCGM metrics using the ConfigMap in - # examples/dcgm-custom-metrics.yaml. - dcgmExporter: - serviceMonitor: - enabled: true - # Matches the 1m evaluation cadence of GPU recording rules with - # 4x oversampling headroom. DCGM_FI_PROF_* counters have - # documented overhead concerns below 1s; 15s is safe. - interval: "15s" - honorLabels: true - relabelings: - - sourceLabels: [__meta_kubernetes_pod_node_name] - targetLabel: node - action: replace - config: - name: dcgm-custom-metrics diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag index cde83a70..bfbf5ecf 100644 --- a/packages/system/grafana-operator/images/grafana-dashboards.tag +++ b/packages/system/grafana-operator/images/grafana-dashboards.tag @@ -1 +1 @@ -ghcr.io/cozystack/cozystack/grafana-dashboards:v1.3.0@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204 +ghcr.io/cozystack/cozystack/grafana-dashboards:v1.1.7@sha256:2c9aa0b48e2bf6167db198f4d15882bfe51700108edf2e9f6d0942940a2c1204 diff --git a/packages/system/hami/Chart.yaml b/packages/system/hami/Chart.yaml deleted file mode 100644 index 3fcf4c5d..00000000 --- a/packages/system/hami/Chart.yaml +++ /dev/null @@ -1,3 +0,0 @@ -apiVersion: v2 -name: cozy-hami -version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process diff --git a/packages/system/hami/Makefile b/packages/system/hami/Makefile deleted file mode 100644 index 83663a66..00000000 --- a/packages/system/hami/Makefile +++ /dev/null @@ -1,43 +0,0 @@ -export NAME=hami -export NAMESPACE=cozy-$(NAME) - -include ../../../hack/common-envs.mk -include ../../../hack/package.mk - -# When bumping the HAMi version, run `make update` and then review -# the resulting diff in `charts/hami/`. The recipe below reproduces the -# top-level vendoring overrides automatically: -# -# 1. Removes the broken hami-dra subchart. Upstream's NVIDIA DRA driver -# path requires kubelet DRA support that cozystack does not enable -# and has no upstream fix tracked. See commit 3c5521e. -# 2. Empties Chart.yaml dependencies and drops Chart.lock so Helm does -# not try to re-pull hami-dra at build time. See commit 2734dc0. -# 3. Strips dra/hami-dra/podSecurityPolicy blocks from the upstream -# values.yaml since the corresponding code paths are gone. PSP is -# removed from Kubernetes 1.25+ and is unused by cozystack. -# -# Template-level patches are NOT reproduced automatically: -# -# * Scheduler templates have `{{- if .Values.dra.enabled }}` blocks -# that need to be removed because the dra value is gone (commit -# 2734dc0 stripped them). -# * device-plugin/monitorservice.yaml uses `indent` with leading -# whitespace; it must be rewritten to `nindent` for the labels block -# to render correctly when devicePlugin.service.labels is set -# (commit 3685254). -# -# After `make update`, run `git diff -- charts/hami/templates/` and -# replay these template patches against the new upstream version, then -# verify with `helm unittest`. If upstream restructured the affected -# files, the patches may need to be redesigned rather than reapplied. - -update: - rm -rf charts - helm repo add hami-charts https://project-hami.github.io/HAMi/ - helm repo update hami-charts - helm pull hami-charts/hami --untar --untardir charts - rm -rf charts/hami/charts/hami-dra - yq --inplace '.dependencies = []' charts/hami/Chart.yaml - rm -f charts/hami/Chart.lock - yq --inplace 'del(.dra) | del(.["hami-dra"]) | del(.podSecurityPolicy)' charts/hami/values.yaml diff --git a/packages/system/hami/README.md b/packages/system/hami/README.md deleted file mode 100644 index 68669ac7..00000000 --- a/packages/system/hami/README.md +++ /dev/null @@ -1,82 +0,0 @@ -# HAMi — GPU Virtualization Middleware - -[HAMi](https://github.com/Project-HAMi/HAMi) (Heterogeneous AI Computing Virtualization Middleware) is a CNCF Sandbox project that enables fractional GPU sharing in Kubernetes. It allows workloads to request specific amounts of GPU memory and compute cores instead of claiming entire GPUs. - -## Architecture - -HAMi consists of four components: - -- **MutatingWebhook** — intercepts pod creation, injects `schedulerName: hami-scheduler` -- **Scheduler Extender** — extends kube-scheduler with GPU-aware Filter and Bind logic -- **Device Plugin** (DaemonSet) — registers vGPU resources via the Kubernetes Device Plugin API -- **HAMi-core** (`libvgpu.so`) — `LD_PRELOAD` library injected into workload containers, intercepts CUDA API calls to enforce memory and compute isolation - -## Prerequisites - -- GPU Operator must be enabled (`addons.gpuOperator.enabled: true`) -- NVIDIA driver >= 440 on host nodes -- nvidia-container-toolkit configured as the default container runtime -- GPU nodes labeled with `gpu=on` - -## Known Limitations - -### glibc < 2.34 requirement for workload containers - -HAMi-core uses `LD_PRELOAD` to intercept `dlsym()` for CUDA symbol resolution. The fallback code path relies on `_dl_sym`, a private glibc internal symbol that was removed in glibc 2.34 when libdl and libpthread were merged into libc.so. - -**This limitation affects workload containers only**, not the host OS or HAMi's own components. - -| Distribution | glibc | Result | -| --------------- | ----- | -------------------------------------------- | -| Ubuntu 18.04 | 2.27 | Full isolation (memory + compute) | -| Ubuntu 20.04 | 2.31 | Full isolation (memory + compute) | -| Ubuntu 22.04 | 2.35 | Memory isolation works, compute breaks | -| Ubuntu 24.04 | 2.39 | Both memory and compute isolation break | -| Alpine (musl) | N/A | Completely incompatible (`dlvsym` absent) | - -Most modern ML/AI base images (CUDA 12.x, PyTorch 2.x, TensorFlow 2.x) use Ubuntu 22.04+ with glibc >= 2.35, which means compute isolation will not work with these images until the upstream fix is merged. - -**Upstream tracking issues:** - -- [HAMi-core#174](https://github.com/Project-HAMi/HAMi-core/issues/174) — `_dl_sym` removal in glibc 2.34 breaks HAMi-core's CUDA symbol resolution at the symbol level -- [HAMi#1190](https://github.com/Project-HAMi/HAMi/issues/1190) — maintainer thread confirming the empirical per-glibc-version isolation behavior shown in the table above - -### musl libc (Alpine) incompatibility - -HAMi-core is completely incompatible with musl libc. The `dlvsym()` function used by HAMi-core is a glibc extension not available in musl. Only glibc-based container images (Debian, Ubuntu, RHEL, etc.) can use HAMi GPU isolation. - -## Usage - -Enable HAMi in your tenant Kubernetes cluster values: - -```yaml -addons: - gpuOperator: - enabled: true - hami: - enabled: true -``` - -When HAMi is enabled, GPU Operator's built-in device plugin is automatically disabled to avoid conflicts. This default is preserved by setting `addons.gpuOperator.valuesOverride.gpu-operator.devicePlugin.enabled: false`; advanced topologies that partition GPU pools (e.g. some nodes use HAMi while others run the standard NVIDIA device plugin via node selectors) can re-enable it explicitly through `valuesOverride`. - -### Requesting fractional GPU resources - -```yaml -resources: - limits: - nvidia.com/gpu: 1 - nvidia.com/gpumem: 3000 # 3000 MB of GPU memory - nvidia.com/gpucores: 30 # 30% of GPU compute cores -``` - -## Parameters - -Default values shown below are inherited from the upstream HAMi chart and may change with upstream updates. - -| Name | Description | Default | -| --- | --- | --- | -| `hami.devicePlugin.runtimeClassName` | RuntimeClass for device plugin pods | `nvidia` | -| `hami.devicePlugin.deviceSplitCount` | Max virtual GPUs per physical GPU | `10` | -| `hami.devicePlugin.deviceMemoryScaling` | Memory overcommit factor (> 1.0 enables overcommit) | `1` | -| `hami.scheduler.defaultSchedulerPolicy.nodeSchedulerPolicy` | Node packing strategy (`binpack` or `spread`) | `binpack` | -| `hami.scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy` | GPU packing strategy (`binpack` or `spread`) | `spread` | diff --git a/packages/system/hami/charts/hami/Chart.yaml b/packages/system/hami/charts/hami/Chart.yaml deleted file mode 100644 index 55f32ab6..00000000 --- a/packages/system/hami/charts/hami/Chart.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v2 -appVersion: 2.8.1 -dependencies: [] -description: Heterogeneous AI Computing Virtualization Middleware -keywords: -- vgpu -- gpu -kubeVersion: '>= 1.18.0-0' -maintainers: -- email: archlitchi@gmail.com - name: limengxuan -- email: xiaozhang0210@hotmail.com - name: zhangxiao -name: hami -sources: -- https://github.com/Project-HAMi/HAMi -type: application -version: 2.8.1 diff --git a/packages/system/hami/charts/hami/README.md b/packages/system/hami/charts/hami/README.md deleted file mode 100644 index e8217290..00000000 --- a/packages/system/hami/charts/hami/README.md +++ /dev/null @@ -1,237 +0,0 @@ -# HAMi Helm Chart Values Documentation - -This document provides detailed descriptions of all configurable values parameters for the HAMi Helm Chart. - -## Global Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `global.imageRegistry` | Global Docker image registry | `""` | -| `global.imagePullSecrets` | Global Docker image pull secrets | `[]` | -| `global.imageTag` | Image tag | `"v2.8.1"` | -| `global.gpuHookPath` | GPU Hook path | `/usr/local` | -| `global.labels` | Global labels | `{}` | -| `global.annotations` | Global annotations | `{}` | -| `global.managedNodeSelectorEnable` | Whether to enable managed node selector | `false` | -| `global.managedNodeSelector.usage` | Managed node selector usage | `"gpu"` | -| `nameOverride` | Name override | `""` | -| `fullnameOverride` | Full name override | `""` | -| `namespaceOverride` | Namespace override | `""` | - -## Resource Name Configuration - -### NVIDIA GPU Resources -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `resourceName` | GPU resource name | `"nvidia.com/gpu"` | -| `resourceMem` | GPU memory resource name | `"nvidia.com/gpumem"` | -| `resourceMemPercentage` | GPU memory percentage resource name | `"nvidia.com/gpumem-percentage"` | -| `resourceCores` | GPU core resource name | `"nvidia.com/gpucores"` | -| `resourcePriority` | GPU priority resource name | `"nvidia.com/priority"` | - -### Cambricon MLU Resources -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `mluResourceName` | MLU resource name | `"cambricon.com/vmlu"` | -| `mluResourceMem` | MLU memory resource name | `"cambricon.com/mlu.smlu.vmemory"` | -| `mluResourceCores` | MLU core resource name | `"cambricon.com/mlu.smlu.vcore"` | - -### Hygon DCU Resources -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `dcuResourceName` | DCU resource name | `"hygon.com/dcunum"` | -| `dcuResourceMem` | DCU memory resource name | `"hygon.com/dcumem"` | -| `dcuResourceCores` | DCU core resource name | `"hygon.com/dcucores"` | - -### Metax GPU Resources -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `metaxResourceName` | GPU resource name | `"metax-tech.com/sgpu"` | -| `metaxResourceCore` | GPU core resource name | `"metax-tech.com/vcore"` | -| `metaxResourceMem` | GPU memory resource name | `"metax-tech.com/vmemory"` | -| `metaxsGPUTopologyAware` | GPU topology awareness | `"false"` | - -### Enflame GCU Resources -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `enflameResourceNameVGCU` | vGCU resource name | `"enflame.com/vgcu"` | -| `enflameResourceNameVGCUPercentage` | vGCU percentage resource name | `"enflame.com/vgcu-percentage"` | - -### Kunlunxin XPU Resources -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `kunlunResourceName` | XPU resource name | `"kunlunxin.com/xpu"` | - -## Scheduler Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `schedulerName` | Scheduler name | `"hami-scheduler"` | -| `scheduler.nodeName` | Define node name, scheduler will schedule to this node | `""` | -| `scheduler.overwriteEnv` | Whether to overwrite environment variables | `"false"` | -| `scheduler.defaultSchedulerPolicy.nodeSchedulerPolicy` | Node scheduler policy | `binpack` | -| `scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy` | GPU scheduler policy | `spread` | -| `scheduler.metricsBindAddress` | Metrics bind address | `":9395"` | -| `scheduler.forceOverwriteDefaultScheduler` | Whether to force overwrite default scheduler | `true` | -| `scheduler.livenessProbe` | Whether to enable liveness probe | `false` | -| `scheduler.leaderElect` | Whether to enable leader election | `true` | -| `scheduler.replicas` | Number of replicas | `1` | - -### Kube Scheduler Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `scheduler.kubeScheduler.enabled` | Whether to run kube-scheduler container in scheduler pod | `true` | -| `scheduler.kubeScheduler.image.registry` | Kube scheduler image registry | `"registry.cn-hangzhou.aliyuncs.com"` | -| `scheduler.kubeScheduler.image.repository` | Kube scheduler image repository | `"google_containers/kube-scheduler"` | -| `scheduler.kubeScheduler.image.tag` | Kube scheduler image tag | `""` | -| `scheduler.kubeScheduler.image.pullPolicy` | Kube scheduler image pull policy | `IfNotPresent` | -| `scheduler.kubeScheduler.image.pullSecrets` | Kube scheduler image pull secrets | `[]` | -| `scheduler.kubeScheduler.extraNewArgs` | Extra new arguments | `["--config=/config/config.yaml", "-v=4"]` | -| `scheduler.kubeScheduler.extraArgs` | Extra arguments | `["--policy-config-file=/config/config.json", "-v=4"]` | - -### Extender Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `scheduler.extender.image.registry` | Scheduler extender image registry | `"docker.io"` | -| `scheduler.extender.image.repository` | Scheduler extender image repository | `"projecthami/hami"` | -| `scheduler.extender.image.tag` | Scheduler extender image tag | `""` | -| `scheduler.extender.image.pullPolicy` | Scheduler extender image pull policy | `IfNotPresent` | -| `scheduler.extender.image.pullSecrets` | Scheduler extender image pull secrets | `[]` | -| `scheduler.extender.extraArgs` | Scheduler extender extra arguments | `["--debug", "-v=4"]` | - -### Admission Webhook Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `scheduler.admissionWebhook.enabled` | Whether to enable admission webhook | `true` | -| `scheduler.admissionWebhook.customURL.enabled` | Whether to enable custom URL | `false` | -| `scheduler.admissionWebhook.customURL.host` | Custom URL host | `127.0.0.1` | -| `scheduler.admissionWebhook.customURL.port` | Custom URL port | `31998` | -| `scheduler.admissionWebhook.customURL.path` | Custom URL path | `/webhook` | -| `scheduler.admissionWebhook.reinvocationPolicy` | Reinvocation policy | `Never` | -| `scheduler.admissionWebhook.failurePolicy` | Failure policy | `Ignore` | - -### TLS Certificate Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `scheduler.certManager.enabled` | Whether to use cert-manager to generate self-signed certificates | `false` | -| `scheduler.patch.enabled` | Whether to use kube-webhook-certgen to generate self-signed certificates | `true` | -| `scheduler.patch.image.registry` | Certgen image registry | `"docker.io"` | -| `scheduler.patch.image.repository` | Certgen image repository | `"jettech/kube-webhook-certgen"` | -| `scheduler.patch.image.tag` | Certgen image tag | `"v1.5.2"` | -| `scheduler.patch.image.pullPolicy` | Certgen image pull policy | `IfNotPresent` | -| `scheduler.patch.imageNew.registry` | New certgen image registry | `"docker.io"` | -| `scheduler.patch.imageNew.repository` | New certgen image repository | `"liangjw/kube-webhook-certgen"` | -| `scheduler.patch.imageNew.tag` | New certgen image tag | `"v1.1.1"` | - -### Scheduler Service Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `scheduler.service.type` | Service type | `NodePort` | -| `scheduler.service.httpPort` | HTTP port | `443` | -| `scheduler.service.schedulerPort` | Scheduler NodePort | `31998` | -| `scheduler.service.monitorPort` | Monitor port | `31993` | -| `scheduler.service.monitorTargetPort` | Monitor target port | `9395` | - -## Device Plugin Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devicePlugin.image.registry` | Device plugin image registry | `"docker.io"` | -| `devicePlugin.image.repository` | Device plugin image repository | `"projecthami/hami"` | -| `devicePlugin.image.tag` | Device plugin image tag | `""` | -| `devicePlugin.image.pullPolicy` | Device plugin image pull policy | `IfNotPresent` | -| `devicePlugin.image.pullSecrets` | Device plugin image pull secrets | `[]` | - -### Monitor Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devicePlugin.monitor.image.registry` | Monitor image registry | `"docker.io"` | -| `devicePlugin.monitor.image.repository` | Monitor image repository | `"projecthami/hami"` | -| `devicePlugin.monitor.image.tag` | Monitor image tag | `""` | -| `devicePlugin.monitor.image.pullPolicy` | Monitor image pull policy | `IfNotPresent` | -| `devicePlugin.monitor.image.pullSecrets` | Monitor image pull secrets | `[]` | -| `devicePlugin.monitor.ctrPath` | Container path | `/usr/local/vgpu/containers` | -| `devicePlugin.monitor.extraArgs` | Monitor extra arguments | `["-v=4"]` | -| `devicePlugin.monitor.extraEnvs` | Monitor extra environments | `{}` | - -### Device Plugin Other Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devicePlugin.deviceSplitCount` | Integer type, default value: 10. Maximum number of tasks assigned to a single GPU device | `10` | -| `devicePlugin.deviceMemoryScaling` | Device memory scaling ratio | `1` | -| `devicePlugin.deviceCoreScaling` | Device core scaling ratio | `1` | -| `devicePlugin.runtimeClassName` | Runtime class name | `""` | -| `devicePlugin.createRuntimeClass` | Whether to create runtime class | `false` | -| `devicePlugin.migStrategy` | String type, "none" means ignore MIG functionality, "mixed" means allocate MIG devices through independent resources | `"none"` | -| `devicePlugin.disablecorelimit` | String type, "true" means disable core limit, "false" means enable core limit | `"false"` | -| `devicePlugin.passDeviceSpecsEnabled` | Whether to enable passing device specs | `false` | -| `devicePlugin.extraArgs` | Device plugin extra arguments | `["-v=4"]` | -| `devicePlugin.nodeConfiguration.config` | Node configuration for device plugin by json | An example of default configuration. | -| `devicePlugin.nodeConfiguration.externalConfigName` | Node configuration for device plugin by external congimap | `""` | -| `devicePlugin.extraEnvs` | Device plugin extra environments | `{}` | - -### Device Plugin Service Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devicePlugin.service.type` | Service type | `NodePort` | -| `devicePlugin.service.httpPort` | HTTP port | `31992` | - -### Device Plugin Deployment Configuration - -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devicePlugin.pluginPath` | Plugin path | `/var/lib/kubelet/device-plugins` | -| `devicePlugin.libPath` | Library path | `/usr/local/vgpu` | -| `devicePlugin.nvidiaNodeSelector` | NVIDIA node selector | `{"gpu": "on"}` | -| `devicePlugin.updateStrategy.type` | Update strategy type | `RollingUpdate` | -| `devicePlugin.updateStrategy.rollingUpdate.maxUnavailable` | Maximum unavailable count | `1` | - -## Device Configuration - -### AWS Neuron -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devices.awsneuron.customresources` | Custom resources | `["aws.amazon.com/neuron", "aws.amazon.com/neuroncore"]` | - -### Kunlunxin -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devices.kunlun.enabled` | Whether to enable | `true` | -| `devices.kunlun.customresources` | Custom resources | `["kunlunxin.com/xpu"]` | - -### Mthreads -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devices.mthreads.enabled` | Whether to enable | `true` | -| `devices.mthreads.customresources` | Custom resources | `["mthreads.com/vgpu"]` | - -### NVIDIA -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devices.nvidia.gpuCorePolicy` | GPU core policy | `default` | -| `devices.nvidia.libCudaLogLevel` | CUDA library log level | `1` | - -### Huawei Ascend -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devices.ascend.enabled` | Whether to enable | `false` | -| `devices.ascend.image` | Image | `""` | -| `devices.ascend.imagePullPolicy` | Image pull policy | `IfNotPresent` | -| `devices.ascend.extraArgs` | Extra arguments | `[]` | -| `devices.ascend.nodeSelector` | Node selector | `{"ascend": "on"}` | -| `devices.ascend.tolerations` | Tolerations | `[]` | -| `devices.ascend.customresources` | Custom resources | `["huawei.com/Ascend910A", "huawei.com/Ascend910A-memory", ...]` | - -### Iluvatar -| Parameter | Description | Default Value | -|-----------|-------------|---------------| -| `devices.iluvatar.enabled` | Whether to enable | `false` | -| `devices.iluvatar.customresources` | Custom resources | `["iluvatar.ai/BI-V150-vgpu", "iluvatar.ai/BI-V150.vMem","iluvatar.ai/BI-V150.vCore", ...]` | diff --git a/packages/system/hami/charts/hami/templates/NOTES.txt b/packages/system/hami/charts/hami/templates/NOTES.txt deleted file mode 100644 index 15bb1218..00000000 --- a/packages/system/hami/charts/hami/templates/NOTES.txt +++ /dev/null @@ -1,3 +0,0 @@ -** Please be patient while the chart is being deployed ** -Resource name: {{ .Values.resourceName }} - diff --git a/packages/system/hami/charts/hami/templates/_commons.tpl b/packages/system/hami/charts/hami/templates/_commons.tpl deleted file mode 100644 index b68018e4..00000000 --- a/packages/system/hami/charts/hami/templates/_commons.tpl +++ /dev/null @@ -1,49 +0,0 @@ -{{/* -Return the proper image name -{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }} -*/}} -{{- define "common.images.image" -}} -{{- $registryName := .imageRoot.registry -}} -{{- $repositoryName := .imageRoot.repository -}} -{{- $tag := .imageRoot.tag | toString -}} -{{- if .global }} - {{- if .global.imageRegistry }} - {{- $registryName = .global.imageRegistry -}} - {{- end -}} -{{- end -}} -{{- if .tag }} - {{- $tag = .tag | toString -}} -{{- end -}} -{{- if $registryName }} -{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} -{{- else -}} -{{- printf "%s:%s" $repositoryName $tag -}} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) -{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} -*/}} -{{- define "common.images.pullSecrets" -}} - {{- $pullSecrets := list }} - - {{- if .global }} - {{- range .global.imagePullSecrets -}} - {{- $pullSecrets = append $pullSecrets . -}} - {{- end -}} - {{- end -}} - - {{- range .images -}} - {{- range .pullSecrets -}} - {{- $pullSecrets = append $pullSecrets . -}} - {{- end -}} - {{- end -}} - - {{- if (not (empty $pullSecrets)) }} -imagePullSecrets: - {{- range $pullSecrets }} - - name: {{ . }} - {{- end }} - {{- end }} -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/_helpers.tpl b/packages/system/hami/charts/hami/templates/_helpers.tpl deleted file mode 100644 index ffcc61da..00000000 --- a/packages/system/hami/charts/hami/templates/_helpers.tpl +++ /dev/null @@ -1,163 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "hami-vgpu.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "hami-vgpu.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Allow the release namespace to be overridden for multi-namespace deployments in combined charts -*/}} -{{- define "hami-vgpu.namespace" -}} - {{- if .Values.namespaceOverride -}} - {{- .Values.namespaceOverride -}} - {{- else -}} - {{- .Release.Namespace -}} - {{- end -}} -{{- end -}} - -{{/* -The app name for Scheduler -*/}} -{{- define "hami-vgpu.scheduler" -}} -{{- printf "%s-scheduler" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -The app name for DevicePlugin -*/}} -{{- define "hami-vgpu.device-plugin" -}} -{{- printf "%s-device-plugin" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - The app name for MockDevicePlugin - */}} -{{- define "hami-vgpu.mock-device-plugin" -}} -{{- printf "%s-mock-device-plugin" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -The tls secret name for Scheduler -*/}} -{{- define "hami-vgpu.scheduler.tls" -}} -{{- printf "%s-scheduler-tls" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -The webhook name -*/}} -{{- define "hami-vgpu.scheduler.webhook" -}} -{{- printf "%s-webhook" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "hami-vgpu.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "hami-vgpu.labels" -}} -helm.sh/chart: {{ include "hami-vgpu.chart" . }} -{{ include "hami-vgpu.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "hami-vgpu.selectorLabels" -}} -app.kubernetes.io/name: {{ include "hami-vgpu.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - - -{{/* - Resolve the tag for kubeScheduler. -*/}} -{{- define "resolvedKubeSchedulerTag" -}} -{{- if .Values.scheduler.kubeScheduler.image.tag }} -{{- .Values.scheduler.kubeScheduler.image.tag | trim -}} -{{- else }} -{{- include "strippedKubeVersion" . | trim -}} -{{- end }} -{{- end }} - -{{/* - Return the stripped Kubernetes version string by removing extra parts after semantic version number. - v1.31.1+k3s1 -> v1.31.1 - v1.30.8-eks-2d5f260 -> v1.30.8 - v1.31.1 -> v1.31.1 -*/}} -{{- define "strippedKubeVersion" -}} -{{ regexReplaceAll "^(v[0-9]+\\.[0-9]+\\.[0-9]+)(.*)$" .Capabilities.KubeVersion.Version "$1" }} -{{- end -}} - -{{- define "hami.scheduler.kubeScheduler.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.kubeScheduler.image "global" .Values.global "tag" (include "resolvedKubeSchedulerTag" .)) }} -{{- end -}} - -{{- define "hami.scheduler.extender.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.extender.image "global" .Values.global "tag" .Values.global.imageTag) }} -{{- end -}} - -{{- define "hami.devicePlugin.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.devicePlugin.image "global" .Values.global "tag" .Values.global.imageTag) }} -{{- end -}} - -{{- define "hami.mockDevicePlugin.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.mockDevicePlugin.image "global" .Values.global "tag" .Values.mockDevicePlugin.tag) }} -{{- end -}} - -{{- define "hami.devicePlugin.monitor.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.devicePlugin.monitor.image "global" .Values.global "tag" .Values.global.imageTag) }} -{{- end -}} - -{{- define "hami.scheduler.patch.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.patch.image "global" .Values.global) }} -{{- end -}} - -{{- define "hami.scheduler.patch.new.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.patch.imageNew "global" .Values.global) }} -{{- end -}} - -{{- define "hami.scheduler.extender.imagePullSecrets" -}} -{{ include "common.images.pullSecrets" (dict "images" (list .Values.scheduler.extender.image) "global" .Values.global) }} -{{- end -}} - -{{- define "hami.devicePlugin.imagePullSecrets" -}} -{{ include "common.images.pullSecrets" (dict "images" (list .Values.devicePlugin.image) "global" .Values.global) }} -{{- end -}} - -{{- define "hami.scheduler.patch.imagePullSecrets" -}} -{{ include "common.images.pullSecrets" (dict "images" (list .Values.scheduler.patch.image) "global" .Values.global) }} -{{- end -}} - -{{- define "hami.scheduler.patch.new.imagePullSecrets" -}} -{{ include "common.images.pullSecrets" (dict "images" (list .Values.scheduler.patch.imageNew) "global" .Values.global) }} -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml b/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml deleted file mode 100644 index 74631e24..00000000 --- a/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if and .Values.devicePlugin.enabled (not .Values.devicePlugin.nodeConfiguration.externalConfigName) -}} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "hami-vgpu.device-plugin" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-device-plugin - {{- include "hami-vgpu.labels" . | nindent 4 }} -data: - config.json: | -{{- .Values.devicePlugin.nodeConfiguration.config | nindent 4 }} -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml deleted file mode 100644 index a0dc4ff3..00000000 --- a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml +++ /dev/null @@ -1,55 +0,0 @@ -{{- if .Values.mockDevicePlugin.enabled }} -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: {{ include "hami-vgpu.mock-device-plugin" . }} - namespace: {{ include "hami-vgpu.namespace" . }} -spec: - selector: - matchLabels: - app.kubernetes.io/component: hami-mock-device-plugin - {{- include "hami-vgpu.selectorLabels" . | nindent 6 }} - template: - metadata: - annotations: - scheduler.alpha.kubernetes.io/critical-pod: "" - labels: - app.kubernetes.io/component: hami-mock-device-plugin - {{- include "hami-vgpu.selectorLabels" . | nindent 8 }} - spec: - serviceAccountName: {{ include "hami-vgpu.mock-device-plugin" . }} - tolerations: - - key: CriticalAddonsOnly - operator: Exists - containers: - - image: {{ include "hami.mockDevicePlugin.image" . }} - imagePullPolicy: {{ .Values.mockDevicePlugin.image.pullPolicy }} - name: hami-mock-dp-cntr - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - command: - - ./k8s-device-plugin - - -v=5 - - --device-config-file=/device-config.yaml - volumeMounts: - - name: dp - mountPath: /var/lib/kubelet/device-plugins - - name: sys - mountPath: /sys - - name: device-config - mountPath: /device-config.yaml - subPath: device-config.yaml - volumes: - - name: dp - hostPath: - path: /var/lib/kubelet/device-plugins - - name: sys - hostPath: - path: /sys - - name: device-config - configMap: - name: {{ include "hami-vgpu.scheduler" . }}-device -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml deleted file mode 100644 index 1f4c24f3..00000000 --- a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml +++ /dev/null @@ -1,262 +0,0 @@ -{{- if .Values.devicePlugin.enabled }} -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: {{ include "hami-vgpu.device-plugin" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-device-plugin - {{- include "hami-vgpu.labels" . | nindent 4 }} - {{- with .Values.global.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- if .Values.global.annotations }} - annotations: {{ toYaml .Values.global.annotations | nindent 4}} - {{- end }} -spec: - updateStrategy: - {{- with .Values.devicePlugin.updateStrategy }} - {{- toYaml . | nindent 4 }} - {{- end }} - selector: - matchLabels: - app.kubernetes.io/component: hami-device-plugin - {{- include "hami-vgpu.selectorLabels" . | nindent 6 }} - template: - metadata: - labels: - app.kubernetes.io/component: hami-device-plugin - hami.io/webhook: ignore - {{- include "hami-vgpu.selectorLabels" . | nindent 8 }} - annotations: - {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }} - checksum/hami-scheduler-newversion-config: {{ include (print $.Template.BasePath "/scheduler/configmapnew.yaml") . | sha256sum }} - {{- else }} - checksum/hami-scheduler-config: {{ include (print $.Template.BasePath "/scheduler/configmap.yaml") . | sha256sum }} - {{- end }} - checksum/hami-scheduler-device-config: {{ include (print $.Template.BasePath "/scheduler/device-configmap.yaml") . | sha256sum }} - {{- if .Values.devicePlugin.podAnnotations }} - {{- toYaml .Values.devicePlugin.podAnnotations | nindent 8 }} - {{- end }} - spec: - {{- if .Values.devicePlugin.runtimeClassName }} - runtimeClassName: {{ .Values.devicePlugin.runtimeClassName }} - {{- end }} - serviceAccountName: {{ include "hami-vgpu.device-plugin" . }} - priorityClassName: system-node-critical - hostPID: true - hostNetwork: true - {{- include "hami.devicePlugin.imagePullSecrets" . | nindent 6 }} - {{- if .Values.devicePlugin.gpuOperatorToolkitReady.enabled }} - initContainers: - - name: toolkit-validation - image: {{ include "hami.devicePlugin.image" . }} - imagePullPolicy: {{ .Values.devicePlugin.image.pullPolicy }} - securityContext: - privileged: true - runAsUser: 0 - command: ["sh", "-c"] - args: - - | - echo "Waiting for NVIDIA Toolkit to be ready..." - until [ -f {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath }}/toolkit-ready ]; do - echo "Waiting for {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath }}/toolkit-ready..." - sleep 5 - done - echo "NVIDIA Toolkit is ready!" - volumeMounts: - - name: nvidia-validations - mountPath: {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath | quote }} - mountPropagation: HostToContainer - readOnly: true - {{- end }} - containers: - - name: device-plugin - image: {{ include "hami.devicePlugin.image" . }} - imagePullPolicy: {{ .Values.devicePlugin.image.pullPolicy }} - lifecycle: - postStart: - exec: - command: ["/bin/sh","-c", {{ printf "/k8s-vgpu/bin/vgpu-init.sh %s/vgpu/" .Values.global.gpuHookPath | quote }}] - command: - - nvidia-device-plugin - - --config-file=/device-config.yaml - - --mig-strategy={{ .Values.devicePlugin.migStrategy }} - - --disable-core-limit={{ .Values.devicePlugin.disablecorelimit }} - {{- range .Values.devicePlugin.extraArgs }} - - {{ . }} - {{- end }} - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: NVIDIA_MIG_MONITOR_DEVICES - value: all - - name: DEVICE_LIST_STRATEGY - value: {{ .Values.devicePlugin.deviceListStrategy }} - - name: HOOK_PATH - value: {{ .Values.global.gpuHookPath }} - {{- if typeIs "bool" .Values.devicePlugin.passDeviceSpecsEnabled }} - - name: PASS_DEVICE_SPECS - value: {{ .Values.devicePlugin.passDeviceSpecsEnabled | quote }} - {{- end }} - {{- if typeIs "string" .Values.devicePlugin.nvidiaDriverRoot }} - - name: NVIDIA_DRIVER_ROOT - value: {{ .Values.devicePlugin.nvidiaDriverRoot }} - {{- end }} - {{- if typeIs "string" .Values.devicePlugin.nvidiaHookPath }} - - name: NVIDIA_CDI_HOOK_PATH - value: {{ .Values.devicePlugin.nvidiaHookPath }} - {{- end }} - {{- if typeIs "bool" .Values.devicePlugin.gdrcopyEnabled }} - - name: GDRCOPY_ENABLED - value: {{ .Values.devicePlugin.gdrcopyEnabled | quote }} - {{- end }} - {{- if typeIs "bool" .Values.devicePlugin.gdsEnabled }} - - name: GDS_ENABLED - value: {{ .Values.devicePlugin.gdsEnabled | quote }} - {{- end }} - {{- if typeIs "bool" .Values.devicePlugin.mofedEnabled }} - - name: MOFED_ENABLED - value: {{ .Values.devicePlugin.mofedEnabled | quote }} - {{- end }} - {{- if eq (.Values.scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy | default "spread") "topology-aware" }} - - name: ENABLE_TOPOLOGY_SCORE - value: "true" - {{- end }} - {{- with .Values.devicePlugin.extraEnvs }} - {{- . | toYaml | nindent 12 }} - {{- end }} - securityContext: - privileged: true - allowPrivilegeEscalation: true - capabilities: - drop: ["ALL"] - add: ["SYS_ADMIN"] - resources: - {{- toYaml .Values.devicePlugin.resources | nindent 12 }} - volumeMounts: - - name: device-plugin - mountPath: /var/lib/kubelet/device-plugins - - name: lib - mountPath: {{ printf "%s%s" .Values.global.gpuHookPath "/vgpu" }} - - name: usrbin - mountPath: /usrbin - - name: deviceconfig - mountPath: /config - - name: hosttmp - mountPath: /tmp - - name: device-config - mountPath: /device-config.yaml - subPath: device-config.yaml - - name: cdi-root - mountPath: /var/run/cdi - {{- if typeIs "string" .Values.devicePlugin.nvidiaDriverRoot }} - # We always mount the driver root at /driver-root in the container. - # This is required for CDI detection to work correctly. - - name: driver-root - mountPath: /driver-root - readOnly: true - {{- end }} - - name: vgpu-monitor - image: {{ include "hami.devicePlugin.monitor.image" . }} - imagePullPolicy: {{ .Values.devicePlugin.monitor.image.pullPolicy }} - command: - - "vGPUmonitor" - {{- range .Values.devicePlugin.monitor.extraArgs }} - - {{ . }} - {{- end }} - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: ["ALL"] - add: ["SYS_ADMIN"] - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: NVIDIA_VISIBLE_DEVICES - value: "all" - - name: NVIDIA_MIG_MONITOR_DEVICES - value: "all" - - name: HOOK_PATH - value: "{{ .Values.global.gpuHookPath }}/vgpu" - - name: HAMI_RESYNC_INTERVAL - value: {{ .Values.devicePlugin.monitor.resyncInterval | default "5m" | quote }} - {{- with .Values.devicePlugin.monitor.extraEnvs }} - {{- . | toYaml | nindent 12 }} - {{- end }} - resources: - {{- toYaml .Values.devicePlugin.monitor.resources | nindent 12 }} - volumeMounts: - - name: ctrs - mountPath: {{ .Values.devicePlugin.monitor.ctrPath }} - - name: dockers - mountPath: /run/docker - - name: containerds - mountPath: /run/containerd - - name: sysinfo - mountPath: /sysinfo - - name: hostvar - mountPath: /hostvar - - name: hosttmp - mountPath: /tmp - volumes: - - name: ctrs - hostPath: - path: {{ .Values.devicePlugin.monitor.ctrPath }} - - name: hosttmp - hostPath: - path: /tmp - - name: dockers - hostPath: - path: /run/docker - - name: containerds - hostPath: - path: /run/containerd - - name: device-plugin - hostPath: - path: {{ .Values.devicePlugin.pluginPath }} - - name: lib - hostPath: - path: {{ .Values.devicePlugin.libPath }} - {{- if .Values.devicePlugin.gpuOperatorToolkitReady.enabled }} - - name: nvidia-validations - hostPath: - path: {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath }} - type: DirectoryOrCreate - {{- end }} - {{- if typeIs "string" .Values.devicePlugin.nvidiaDriverRoot }} - - name: driver-root - hostPath: - path: {{ .Values.devicePlugin.nvidiaDriverRoot }} - type: Directory - {{- end }} - - name: cdi-root - hostPath: - path: /var/run/cdi - type: DirectoryOrCreate - - name: usrbin - hostPath: - path: /usr/bin - - name: sysinfo - hostPath: - path: /sys - - name: hostvar - hostPath: - path: /var - - name: deviceconfig - configMap: - name: {{ .Values.devicePlugin.nodeConfiguration.externalConfigName | default (include "hami-vgpu.device-plugin" .) }} - - name: device-config - configMap: - name: {{ include "hami-vgpu.scheduler" . }}-device - {{- if .Values.devicePlugin.nvidiaNodeSelector }} - nodeSelector: {{ toYaml .Values.devicePlugin.nvidiaNodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.devicePlugin.tolerations }} - tolerations: {{ toYaml .Values.devicePlugin.tolerations | nindent 8 }} - {{- end }} -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml deleted file mode 100644 index 6ac757f2..00000000 --- a/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.devicePlugin.enabled -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "hami-vgpu.device-plugin" . }}-monitor -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - get - - create - - watch - - list - - update - - patch - - apiGroups: - - "" - resources: - - nodes - verbs: - - get - - update - - list - - patch -{{- end -}} - diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml deleted file mode 100644 index 2f0a14ba..00000000 --- a/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if .Values.devicePlugin.enabled -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "hami-vgpu.device-plugin" . }} - labels: - app.kubernetes.io/component: "hami-device-plugin" - {{- include "hami-vgpu.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "hami-vgpu.device-plugin" . }}-monitor -subjects: - - kind: ServiceAccount - name: {{ include "hami-vgpu.device-plugin" . }} - namespace: {{ include "hami-vgpu.namespace" . }} -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml deleted file mode 100644 index 88f1b214..00000000 --- a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if .Values.devicePlugin.enabled -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ include "hami-vgpu.device-plugin" . }}-monitor - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-device-plugin - {{- include "hami-vgpu.labels" . | nindent 4 }} - {{- with .Values.devicePlugin.service.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- if .Values.devicePlugin.service.annotations }} # Use devicePlugin instead of scheduler - annotations: {{ toYaml .Values.devicePlugin.service.annotations | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.devicePlugin.service.type | default "NodePort" }} # Default type is NodePort - ports: - - name: monitorport - port: {{ .Values.devicePlugin.service.httpPort | default 31992 }} # Default HTTP port is 31992 - targetPort: 9394 - {{- if eq (.Values.devicePlugin.service.type | default "NodePort") "NodePort" }} # If type is NodePort, set nodePort - nodePort: {{ .Values.devicePlugin.service.httpPort | default 31992 }} - {{- end }} - protocol: TCP - selector: - app.kubernetes.io/component: hami-device-plugin - {{- include "hami-vgpu.selectorLabels" . | nindent 4 }} -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml deleted file mode 100644 index 6e3c2a44..00000000 --- a/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if .Values.devicePlugin.enabled -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "hami-vgpu.device-plugin" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: "hami-device-plugin" - {{- include "hami-vgpu.labels" . | nindent 4 }} -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml b/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml deleted file mode 100644 index ebcc2c9c..00000000 --- a/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml +++ /dev/null @@ -1,9 +0,0 @@ -{{- if and .Values.devicePlugin.enabled .Values.devicePlugin.createRuntimeClass .Values.devicePlugin.runtimeClassName -}} -apiVersion: node.k8s.io/v1 -kind: RuntimeClass -metadata: - name: {{ .Values.devicePlugin.runtimeClassName }} - annotations: - helm.sh/hook: pre-install,pre-upgrade -handler: nvidia -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml b/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml deleted file mode 100644 index e6d28721..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml +++ /dev/null @@ -1,31 +0,0 @@ -{{- if .Values.scheduler.admissionWebhook.enabled -}} -{{- if .Values.scheduler.certManager.enabled }} -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: {{ include "hami-vgpu.scheduler" . }}-serving-cert - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.labels" . | nindent 4 }} -spec: - dnsNames: - - {{ include "hami-vgpu.scheduler" . }}.{{ include "hami-vgpu.namespace" . }}.svc - - {{ include "hami-vgpu.scheduler" . }}.{{ include "hami-vgpu.namespace" . }}.svc.cluster.local - issuerRef: - kind: Issuer - name: {{ include "hami-vgpu.scheduler" . }}-selfsigned-issuer - secretName: {{ include "hami-vgpu.scheduler.tls" . }} ---- -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: {{ include "hami-vgpu.scheduler" . }}-selfsigned-issuer - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.labels" . | nindent 4 }} -spec: - selfSigned: {} -{{- end }} -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml b/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml deleted file mode 100644 index 81c4fddf..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "hami-vgpu.scheduler" . }} - labels: - app.kubernetes.io/component: "hami-scheduler" - {{- include "hami-vgpu.labels" . | nindent 4 }} -rules: - - apiGroups: [""] - resources: ["pods", "configmaps"] - verbs: ["get", "list", "watch", "patch"] - - apiGroups: [""] - resources: ["pods/binding"] - verbs: ["create"] - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "list", "patch", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "get", "list"] - - apiGroups: [""] - resources: ["resourcequotas"] - verbs: ["get", "list", "watch"] ---- -{{- if .Values.mockDevicePlugin.enabled }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "hami-vgpu.mock-device-plugin" . }} -rules: - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "update", "list", "patch"] -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml deleted file mode 100644 index a81d425c..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml +++ /dev/null @@ -1,47 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "hami-vgpu.scheduler" . }}-kube - labels: - app.kubernetes.io/component: "hami-scheduler" - {{- include "hami-vgpu.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:kube-scheduler -subjects: - - kind: ServiceAccount - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "hami-vgpu.scheduler" . }}-volume - labels: - app.kubernetes.io/component: "hami-scheduler" - {{- include "hami-vgpu.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:volume-scheduler -subjects: - - kind: ServiceAccount - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "hami-vgpu.scheduler" . }} - labels: - app.kubernetes.io/component: "hami-scheduler" - {{- include "hami-vgpu.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "hami-vgpu.scheduler" . }} -subjects: - - kind: ServiceAccount - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml b/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml deleted file mode 100644 index 109ecbce..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml +++ /dev/null @@ -1,142 +0,0 @@ -{{- if .Values.scheduler.kubeScheduler.enabled -}} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.labels" . | nindent 4 }} -data: - config.json: | - { - "kind": "Policy", - "apiVersion": "v1", - "extenders": [ - { - {{- if .Values.scheduler.admissionWebhook.enabled }} - "urlPrefix": "https://127.0.0.1:443", - "enableHttps": true, - "tlsConfig": { - "insecure": true - }, - {{- else }} - "urlPrefix": "http://127.0.0.1:80", - "enableHttps": false, - {{- end }} - "filterVerb": "filter", - "bindVerb": "bind", - "weight": 1, - "nodeCacheCapable": true, - "httpTimeout": 30000000000, - "managedResources": [ - {{- range .Values.devices.amd.customresources }} - { - "name": "{{ . }}", - "ignoredByScheduler": true - }, - {{- end }} - {{- if .Values.devices.ascend.enabled }} - {{- range .Values.devices.ascend.customresources }} - { - "name": "{{ . }}", - "ignoredByScheduler": true - }, - {{- end }} - {{- end }} - {{- if .Values.devices.mthreads.enabled }} - {{- range .Values.devices.mthreads.customresources }} - { - "name": "{{ . }}", - "ignoredByScheduler": true - }, - {{- end }} - {{- end }} - {{- if .Values.devices.enflame.enabled }} - {{- range .Values.devices.enflame.customresources }} - { - "name": "{{ . }}", - "ignoredByScheduler": true - }, - {{- end }} - {{- end }} - {{- if .Values.devices.kunlun.enabled }} - {{- range .Values.devices.kunlun.customresources }} - { - "name": "{{ . }}", - "ignoredByScheduler": true - }, - {{- end }} - {{- end }} - {{- range .Values.devices.awsneuron.customresources }} - { - "name": "{{ . }}", - "ignoredByScheduler": true - }, - {{- end }} - {{- if .Values.devices.iluvatar.enabled }} - {{- range .Values.devices.iluvatar.customresources }} - { - "name": "{{ . }}", - "ignoredByScheduler": true - }, - {{- end }} - {{- end }} - { - "name": "{{ .Values.resourceName }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.resourceMem }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.resourceCores }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.resourceMemPercentage }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.resourcePriority }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.mluResourceName }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.dcuResourceName }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.dcuResourceMem }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.dcuResourceCores }}", - "ignoredByScheduler": true - }, - { - "name": "metax-tech.com/gpu", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.metaxResourceName }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.metaxResourceCore }}", - "ignoredByScheduler": true - }, - { - "name": "{{ .Values.metaxResourceMem }}", - "ignoredByScheduler": true - } - ], - "ignoreable": false - } - ] - } -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml b/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml deleted file mode 100644 index 6f6db097..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml +++ /dev/null @@ -1,102 +0,0 @@ -{{- if .Values.scheduler.kubeScheduler.enabled -}} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "hami-vgpu.scheduler" . }}-newversion - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.labels" . | nindent 4 }} -data: - config.yaml: | - {{- if gt (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 25}} - apiVersion: kubescheduler.config.k8s.io/v1 - {{- else }} - apiVersion: kubescheduler.config.k8s.io/v1beta2 - {{- end }} - kind: KubeSchedulerConfiguration - leaderElection: - leaderElect: false - profiles: - - schedulerName: {{ .Values.schedulerName }} - extenders: - {{- if .Values.scheduler.admissionWebhook.enabled }} - - urlPrefix: "https://127.0.0.1:443" - enableHTTPS: true - tlsConfig: - insecure: true - {{- else }} - - urlPrefix: "http://127.0.0.1:80" - enableHTTPS: false - {{- end }} - filterVerb: filter - bindVerb: bind - nodeCacheCapable: true - weight: 1 - httpTimeout: 30s - managedResources: - - name: {{ .Values.resourceName }} - ignoredByScheduler: true - - name: {{ .Values.resourceMem }} - ignoredByScheduler: true - - name: {{ .Values.resourceCores }} - ignoredByScheduler: true - - name: {{ .Values.resourceMemPercentage }} - ignoredByScheduler: true - - name: {{ .Values.resourcePriority }} - ignoredByScheduler: true - - name: {{ .Values.mluResourceName }} - ignoredByScheduler: true - - name: {{ .Values.dcuResourceName }} - ignoredByScheduler: true - - name: {{ .Values.dcuResourceMem }} - ignoredByScheduler: true - - name: {{ .Values.dcuResourceCores }} - ignoredByScheduler: true - - name: "metax-tech.com/gpu" - ignoredByScheduler: true - - name: {{ .Values.metaxResourceName }} - ignoredByScheduler: true - - name: {{ .Values.metaxResourceCore }} - ignoredByScheduler: true - - name: {{ .Values.metaxResourceMem }} - ignoredByScheduler: true - {{- if .Values.devices.ascend.enabled }} - {{- range .Values.devices.ascend.customresources }} - - name: {{ . }} - ignoredByScheduler: true - {{- end }} - {{- end }} - {{- if .Values.devices.mthreads.enabled }} - {{- range .Values.devices.mthreads.customresources }} - - name: {{ . }} - ignoredByScheduler: true - {{- end }} - {{- end }} - {{- if .Values.devices.enflame.enabled }} - {{- range .Values.devices.enflame.customresources }} - - name: {{ . }} - ignoredByScheduler: true - {{- end }} - {{- end }} - {{- if .Values.devices.kunlun.enabled }} - {{- range .Values.devices.kunlun.customresources }} - - name: {{ . }} - ignoredByScheduler: true - {{- end }} - {{- end }} - {{- range .Values.devices.awsneuron.customresources }} - - name: {{ . }} - ignoredByScheduler: true - {{- end }} - {{- if .Values.devices.iluvatar.enabled }} - {{- range .Values.devices.iluvatar.customresources }} - - name: {{ . }} - ignoredByScheduler: true - {{- end }} - {{- end }} - {{- range .Values.devices.amd.customresources }} - - name: {{ . }} - ignoredByScheduler: true - {{- end }} -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml b/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml deleted file mode 100644 index 1d89e189..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml +++ /dev/null @@ -1,225 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.labels" . | nindent 4 }} - {{- with .Values.global.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- if .Values.global.annotations }} - annotations: {{ toYaml .Values.global.annotations | nindent 4}} - {{- end }} -spec: - {{- if .Values.scheduler.leaderElect }} - replicas: {{ .Values.scheduler.replicas }} - {{- else }} - replicas: 1 - {{- end }} - selector: - matchLabels: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.selectorLabels" . | nindent 6 }} - template: - metadata: - labels: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.selectorLabels" . | nindent 8 }} - hami.io/webhook: ignore - annotations: - {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }} - checksum/hami-scheduler-newversion-config: {{ include (print $.Template.BasePath "/scheduler/configmapnew.yaml") . | sha256sum }} - {{- else }} - checksum/hami-scheduler-config: {{ include (print $.Template.BasePath "/scheduler/configmap.yaml") . | sha256sum }} - {{- end }} - checksum/hami-scheduler-device-config: {{ include (print $.Template.BasePath "/scheduler/device-configmap.yaml") . | sha256sum }} - {{- if .Values.scheduler.podAnnotations }} - {{- toYaml .Values.scheduler.podAnnotations | nindent 8 }} - {{- end }} - spec: - serviceAccountName: {{ include "hami-vgpu.scheduler" . }} - priorityClassName: system-node-critical - {{- include "hami.scheduler.extender.imagePullSecrets" . | nindent 6 }} - containers: - {{- if .Values.scheduler.kubeScheduler.enabled }} - - name: kube-scheduler - image: {{ include "hami.scheduler.kubeScheduler.image" . }} - imagePullPolicy: {{ .Values.scheduler.kubeScheduler.image.pullPolicy }} - command: - - kube-scheduler - {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }} - {{- range .Values.scheduler.kubeScheduler.extraNewArgs }} - - {{ . }} - {{- end }} - {{- else }} - - --scheduler-name={{ .Values.schedulerName }} - {{- range .Values.scheduler.kubeScheduler.extraArgs }} - - {{ . }} - {{- end }} - {{- end }} - - --leader-elect={{ .Values.scheduler.leaderElect }} - - --leader-elect-resource-name={{ .Values.schedulerName }} - - --leader-elect-resource-namespace={{ include "hami-vgpu.namespace" . }} - resources: - {{- toYaml .Values.scheduler.kubeScheduler.resources | nindent 12 }} - volumeMounts: - - name: scheduler-config - mountPath: /config - {{- end }} - {{- if .Values.scheduler.livenessProbe }} - livenessProbe: - failureThreshold: 8 - httpGet: - path: /healthz - port: 10259 - scheme: HTTPS - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 15 - {{- end }} - - name: vgpu-scheduler-extender - image: {{ include "hami.scheduler.extender.image" . }} - imagePullPolicy: {{ .Values.scheduler.extender.image.pullPolicy }} - env: - {{- if .Values.scheduler.nodeLockExpire }} - - name: HAMI_NODELOCK_EXPIRE - value: "{{ .Values.scheduler.nodeLockExpire }}" - {{- end }} - {{- if .Values.global.managedNodeSelectorEnable }} - {{- range $key, $value := .Values.global.managedNodeSelector }} - - name: NODE_SELECTOR_{{ $key | upper | replace "-" "_" }} - value: "{{ $value }}" - {{- end }} - {{- end }} - command: - - scheduler - {{- if .Values.scheduler.admissionWebhook.enabled }} - - --http_bind=0.0.0.0:443 - - --cert_file=/tls/tls.crt - - --key_file=/tls/tls.key - {{- else }} - - --http_bind=0.0.0.0:80 - {{- end }} - - --scheduler-name={{ .Values.schedulerName }} - - --metrics-bind-address={{ .Values.scheduler.metricsBindAddress }} - - --node-scheduler-policy={{ .Values.scheduler.defaultSchedulerPolicy.nodeSchedulerPolicy }} - - --gpu-scheduler-policy={{ .Values.scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy }} - - --force-overwrite-default-scheduler={{ .Values.scheduler.forceOverwriteDefaultScheduler}} - - --device-config-file=/device-config.yaml - - --leader-elect={{ .Values.scheduler.leaderElect }} - - --leader-elect-resource-name={{ .Values.schedulerName }} - - --leader-elect-resource-namespace={{ include "hami-vgpu.namespace" . }} - {{- if .Values.devices.ascend.enabled }} - - --enable-ascend=true - {{- end }} - {{- if .Values.devices.iluvatar.enabled }} - - --enable-iluvatar=true - {{- end }} - {{- if .Values.scheduler.nodeLabelSelector }} - - --node-label-selector={{- $first := true -}} - {{- range $key, $value := .Values.scheduler.nodeLabelSelector -}} - {{- if not $first }},{{ end -}} - {{- $key }}={{ $value -}} - {{- $first = false -}} - {{- end -}} - {{- end }} - {{- range .Values.scheduler.extender.extraArgs }} - - {{ . }} - {{- end }} - ports: - {{- if .Values.scheduler.admissionWebhook.enabled }} - - name: https - containerPort: 443 - protocol: TCP - {{- else }} - - name: http - containerPort: 80 - protocol: TCP - {{- end }} - - name: metrics - containerPort: {{ last (splitList ":" .Values.scheduler.metricsBindAddress) | int }} - protocol: TCP - resources: - {{- toYaml .Values.scheduler.extender.resources | nindent 12 }} - volumeMounts: - - name: device-config - mountPath: /device-config.yaml - subPath: device-config.yaml - {{- if .Values.scheduler.admissionWebhook.enabled }} - - name: tls-config - mountPath: /tls - {{- end }} - {{- if .Values.scheduler.livenessProbe }} - livenessProbe: - httpGet: - path: /healthz - {{- if .Values.scheduler.admissionWebhook.enabled }} - port: https - scheme: HTTPS - {{- else }} - port: http - scheme: HTTP - {{- end }} - initialDelaySeconds: 10 - periodSeconds: 10 - failureThreshold: 3 - timeoutSeconds: 5 - {{- end }} - {{- if .Values.scheduler.leaderElect }} - readinessProbe: - httpGet: - path: /readyz - {{- if .Values.scheduler.admissionWebhook.enabled }} - port: https - scheme: HTTPS - {{- else }} - port: http - scheme: HTTP - {{- end }} - initialDelaySeconds: 10 - periodSeconds: 10 - failureThreshold: 3 - timeoutSeconds: 5 - {{- end }} - {{- if .Values.scheduler.leaderElect }} - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app.kubernetes.io/component - operator: In - values: - - hami-scheduler - topologyKey: "kubernetes.io/hostname" - {{- end }} - volumes: - {{- if .Values.scheduler.admissionWebhook.enabled }} - - name: tls-config - secret: - secretName: {{ template "hami-vgpu.scheduler.tls" . }} - {{- end }} - {{- if .Values.scheduler.kubeScheduler.enabled }} - - name: scheduler-config - configMap: - {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }} - name: {{ template "hami-vgpu.scheduler" . }}-newversion - {{- else }} - name: {{ template "hami-vgpu.scheduler" . }} - {{- end }} - {{- end }} - - name: device-config - configMap: - name: {{ include "hami-vgpu.scheduler" . }}-device - {{- if .Values.scheduler.nodeSelector }} - nodeSelector: {{ toYaml .Values.scheduler.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.scheduler.tolerations }} - tolerations: {{ toYaml .Values.scheduler.tolerations | nindent 8 }} - {{- end }} - {{- if .Values.scheduler.nodeName }} - nodeName: {{ .Values.scheduler.nodeName }} - {{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml b/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml deleted file mode 100644 index 873b813b..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml +++ /dev/null @@ -1,408 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "hami-vgpu.scheduler" . }}-device - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.labels" . | nindent 4 }} -data: - device-config.yaml: |- - {{- if .Files.Glob "files/device-config.yaml" }} - {{- .Files.Get "files/device-config.yaml" | nindent 4}} - {{- else }} - nvidia: - resourceCountName: {{ .Values.resourceName }} - resourceMemoryName: {{ .Values.resourceMem }} - resourceMemoryPercentageName: {{ .Values.resourceMemPercentage }} - resourceCoreName: {{ .Values.resourceCores }} - resourcePriorityName: {{ .Values.resourcePriority }} - overwriteEnv: false - defaultMemory: 0 - defaultCores: 0 - defaultGPUNum: 1 - memoryFactor: 1 - deviceSplitCount: {{ .Values.devicePlugin.deviceSplitCount }} - deviceMemoryScaling: {{ .Values.devicePlugin.deviceMemoryScaling }} - deviceCoreScaling: {{ .Values.devicePlugin.deviceCoreScaling }} - gpuCorePolicy: {{ .Values.devices.nvidia.gpuCorePolicy }} - libCudaLogLevel: {{ .Values.devices.nvidia.libCudaLogLevel }} - runtimeClassName: "{{ .Values.devicePlugin.runtimeClassName }}" - knownMigGeometries: - - models: [ "A30" ] - allowedGeometries: - - - - name: 1g.6gb - core: 25 - memory: 6144 - count: 4 - - - - name: 2g.12gb - core: 50 - memory: 12288 - count: 2 - - - - name: 4g.24gb - core: 100 - memory: 24576 - count: 1 - - models: [ "A100-SXM4-40GB", "A100-40GB-PCIe", "A100-PCIE-40GB"] - allowedGeometries: - - - - name: 1g.5gb - core: 14 - memory: 5120 - count: 7 - - - - name: 1g.5gb - core: 14 - memory: 5120 - count: 1 - - name: 2g.10gb - core: 28 - memory: 10240 - count: 3 - - - - name: 3g.20gb - core: 42 - memory: 20480 - count: 2 - - - - name: 7g.40gb - core: 100 - memory: 40960 - count: 1 - - models: [ "A100-SXM4-80GB", "A100-80GB-PCIe", "A100-PCIE-80GB"] - allowedGeometries: - - - - name: 1g.10gb - core: 14 - memory: 10240 - count: 7 - - - - name: 1g.10gb - core: 14 - memory: 10240 - count: 1 - - name: 2g.20gb - core: 28 - memory: 20480 - count: 3 - - - - name: 3g.40gb - core: 42 - memory: 40960 - count: 2 - - - - name: 7g.79gb - core: 100 - memory: 80896 - count: 1 - - models: [ "H100-PCIE-80GB", "H100-SXM5-80GB"] - allowedGeometries: - - - - name: 1g.10gb - core: 14 - memory: 10240 - count: 7 - - - - name: 1g.10gb - core: 14 - memory: 10240 - count: 1 - - name: 2g.20gb - core: 28 - memory: 20480 - count: 3 - - - - name: 3g.40gb - core: 42 - memory: 40960 - count: 2 - - - - name: 7g.80gb - core: 100 - memory: 81920 - count: 1 - - models: [ "H100-PCIE-94GB", "H100-SXM5-94GB"] - allowedGeometries: - - - - name: 1g.12gb - core: 14 - memory: 12288 - count: 7 - - - - name: 1g.12gb - core: 14 - memory: 12288 - count: 1 - - name: 2g.24gb - core: 28 - memory: 24576 - count: 3 - - - - name: 3g.47gb - core: 42 - memory: 48128 - count: 2 - - - - name: 7g.94gb - core: 100 - memory: 96256 - count: 1 - - models: [ "H20", "H100 on GH200"] - allowedGeometries: - - - - name: 1g.12gb - core: 14 - memory: 12288 - count: 7 - - - - name: 1g.12gb - core: 14 - memory: 12288 - count: 1 - - name: 2g.24gb - core: 28 - memory: 24576 - count: 3 - - - - name: 3g.48gb - core: 42 - memory: 49152 - count: 2 - - - - name: 7g.96gb - core: 100 - memory: 98304 - count: 1 - - models: [ "H200 NVL", "H200-SXM5"] - allowedGeometries: - - - - name: 1g.18gb - core: 14 - memory: 18432 - count: 7 - - - - name: 1g.18gb - core: 14 - memory: 18432 - count: 1 - - name: 2g.35gb - core: 28 - memory: 35840 - count: 3 - - - - name: 3g.71gb - core: 42 - memory: 72704 - count: 2 - - - - name: 7g.141gb - core: 100 - memory: 144384 - count: 1 - - models: [ "B200" ] - allowedGeometries: - - - - name: 1g.23gb - core: 14 - memory: 23552 - count: 7 - - - - name: 1g.23gb - core: 14 - memory: 23552 - count: 1 - - name: 2g.45gb - core: 28 - memory: 46080 - count: 3 - - - - name: 3g.90gb - core: 42 - memory: 92160 - count: 2 - - - - name: 7g.180gb - core: 100 - memory: 184320 - count: 1 - cambricon: - resourceCountName: {{ .Values.mluResourceName }} - resourceMemoryName: {{ .Values.mluResourceMem }} - resourceCoreName: {{ .Values.mluResourceCores }} - hygon: - resourceCountName: {{ .Values.dcuResourceName }} - resourceMemoryName: {{ .Values.dcuResourceMem }} - resourceCoreName: {{ .Values.dcuResourceCores }} - memoryFactor: 1 - metax: - resourceCountName: "metax-tech.com/gpu" - resourceVCountName: {{ .Values.metaxResourceName }} - resourceVMemoryName: {{ .Values.metaxResourceMem }} - resourceVCoreName: {{ .Values.metaxResourceCore }} - sgpuTopologyAware: {{ .Values.metaxsGPUTopologyAware }} - enflame: - resourceNameGCU: "enflame.com/gcu" - resourceNameVGCU: {{ .Values.enflameResourceNameVGCU }} - resourceNameVGCUPercentage: {{ .Values.enflameResourceNameVGCUPercentage }} - mthreads: - resourceCountName: "mthreads.com/vgpu" - resourceMemoryName: "mthreads.com/sgpu-memory" - resourceCoreName: "mthreads.com/sgpu-core" - iluvatars: - - chipName: MR-V100 - commonWord: MR-V100 - resourceCountName: iluvatar.ai/MR-V100-vgpu - resourceMemoryName: iluvatar.ai/MR-V100.vMem - resourceCoreName: iluvatar.ai/MR-V100.vCore - - chipName: MR-V50 - commonWord: MR-V50 - resourceCountName: iluvatar.ai/MR-V50-vgpu - resourceMemoryName: iluvatar.ai/MR-V50.vMem - resourceCoreName: iluvatar.ai/MR-V50.vCore - - chipName: BI-V150 - commonWord: BI-V150 - resourceCountName: iluvatar.ai/BI-V150-vgpu - resourceMemoryName: iluvatar.ai/BI-V150.vMem - resourceCoreName: iluvatar.ai/BI-V150.vCore - - chipName: BI-V100 - commonWord: BI-V100 - resourceCountName: iluvatar.ai/BI-V100-vgpu - resourceMemoryName: iluvatar.ai/BI-V100.vMem - resourceCoreName: iluvatar.ai/BI-V100.vCore - kunlun: - resourceCountName: {{ .Values.kunlunResourceName }} - resourceVCountName: {{ .Values.kunlunResourceVCountName }} - resourceVMemoryName: {{ .Values.kunlunResourceVMemoryName }} - awsneuron: - resourceCountName: "aws.amazon.com/neuron" - resourceCoreName: "aws.amazon.com/neuroncore" - amd: - resourceCountName: "amd.com/gpu" - vnpus: - - chipName: 910A - commonWord: Ascend910A - resourceName: huawei.com/Ascend910A - resourceMemoryName: huawei.com/Ascend910A-memory - memoryAllocatable: 32768 - memoryCapacity: 32768 - memoryFactor: 1 - aiCore: 30 - templates: - - name: vir02 - memory: 2184 - aiCore: 2 - - name: vir04 - memory: 4369 - aiCore: 4 - - name: vir08 - memory: 8738 - aiCore: 8 - - name: vir16 - memory: 17476 - aiCore: 16 - - chipName: 910B2 - commonWord: Ascend910B2 - resourceName: huawei.com/Ascend910B2 - resourceMemoryName: huawei.com/Ascend910B2-memory - memoryAllocatable: 65536 - memoryCapacity: 65536 - memoryFactor: 1 - aiCore: 24 - aiCPU: 6 - templates: - - name: vir03_1c_8g - memory: 8192 - aiCore: 3 - aiCPU: 1 - - name: vir06_1c_16g - memory: 16384 - aiCore: 6 - aiCPU: 1 - - name: vir12_3c_32g - memory: 32768 - aiCore: 12 - aiCPU: 3 - - chipName: 910B3 - commonWord: Ascend910B3 - resourceName: huawei.com/Ascend910B3 - resourceMemoryName: huawei.com/Ascend910B3-memory - memoryAllocatable: 65536 - memoryCapacity: 65536 - memoryFactor: 1 - aiCore: 20 - aiCPU: 7 - templates: - - name: vir05_1c_16g - memory: 16384 - aiCore: 5 - aiCPU: 1 - - name: vir10_3c_32g - memory: 32768 - aiCore: 10 - aiCPU: 3 - - chipName: 910B4-1 - commonWord: Ascend910B4-1 - resourceName: huawei.com/Ascend910B4-1 - resourceMemoryName: huawei.com/Ascend910B4-1-memory - memoryAllocatable: 65536 - memoryCapacity: 65536 - memoryFactor: 1 - aiCore: 20 - aiCPU: 7 - templates: - # NOTE: Names of vnpu template for 910B4-1 are fixed by Ascend runtime and must not be changed. - # The memory is used for scheduling so the correct values must be set. - # Template vir05_1c_8g actually provides 16GB memory, - - name: vir05_1c_8g - memory: 16384 - aiCore: 5 - aiCPU: 1 - # Template vir10_3c_16g actually provides 32GB memory - - name: vir10_3c_16g - memory: 32768 - aiCore: 10 - aiCPU: 3 - - chipName: 910B4 - commonWord: Ascend910B4 - resourceName: huawei.com/Ascend910B4 - resourceMemoryName: huawei.com/Ascend910B4-memory - memoryAllocatable: 32768 - memoryCapacity: 32768 - memoryFactor: 1 - aiCore: 20 - aiCPU: 7 - templates: - - name: vir05_1c_8g - memory: 8192 - aiCore: 5 - aiCPU: 1 - - name: vir10_3c_16g - memory: 16384 - aiCore: 10 - aiCPU: 3 - - chipName: 310P3 - commonWord: Ascend310P - resourceName: huawei.com/Ascend310P - resourceMemoryName: huawei.com/Ascend310P-memory - memoryAllocatable: 21527 - memoryCapacity: 24576 - memoryFactor: 1 - aiCore: 8 - aiCPU: 7 - templates: - - name: vir01 - memory: 3072 - aiCore: 1 - aiCPU: 1 - - name: vir02 - memory: 6144 - aiCore: 2 - aiCPU: 2 - - name: vir04 - memory: 12288 - aiCore: 4 - aiCPU: 4 - {{ end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml deleted file mode 100644 index 77e891cc..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "hami-vgpu.fullname" . }}-admission - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "hami-vgpu.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook -rules: - - apiGroups: - - admissionregistration.k8s.io - resources: - #- validatingwebhookconfigurations - - mutatingwebhookconfigurations - verbs: - - get - - update -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml deleted file mode 100644 index 2b82f926..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "hami-vgpu.fullname" . }}-admission - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "hami-vgpu.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "hami-vgpu.fullname" . }}-admission -subjects: - - kind: ServiceAccount - name: {{ include "hami-vgpu.fullname" . }}-admission - namespace: {{ include "hami-vgpu.namespace" . }} -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml deleted file mode 100644 index 0e36d95f..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml +++ /dev/null @@ -1,68 +0,0 @@ -{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "hami-vgpu.fullname" . }}-admission-create - namespace: {{ include "hami-vgpu.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "hami-vgpu.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook -spec: - {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }} - # Alpha feature since k8s 1.12 - ttlSecondsAfterFinished: 0 - {{- end }} - template: - metadata: - name: {{ include "hami-vgpu.fullname" . }}-admission-create - {{- if .Values.scheduler.patch.podAnnotations }} - annotations: {{ toYaml .Values.scheduler.patch.podAnnotations | nindent 8 }} - {{- end }} - labels: - {{- include "hami-vgpu.labels" . | nindent 8 }} - app.kubernetes.io/component: admission-webhook - hami.io/webhook: ignore - spec: - {{- if .Values.scheduler.patch.priorityClassName }} - priorityClassName: {{ .Values.scheduler.patch.priorityClassName }} - {{- end }} - {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }} - {{- include "hami.scheduler.patch.new.imagePullSecrets" . | nindent 6 }} - {{- else }} - {{- include "hami.scheduler.patch.imagePullSecrets" . | nindent 6 }} - {{- end }} - containers: - - name: create - {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }} - image: {{ include "hami.scheduler.patch.new.image" . }} - imagePullPolicy: {{ .Values.scheduler.patch.imageNew.pullPolicy }} - {{- else }} - image: {{ include "hami.scheduler.patch.image" . }} - imagePullPolicy: {{ .Values.scheduler.patch.image.pullPolicy }} - {{- end }} - args: - - create - - --cert-name=tls.crt - - --key-name=tls.key - {{- if .Values.scheduler.admissionWebhook.customURL.enabled }} - - --host={{ printf "%s.%s.svc,127.0.0.1,%s" (include "hami-vgpu.scheduler" .) (include "hami-vgpu.namespace" .) .Values.scheduler.admissionWebhook.customURL.host}} - {{- else }} - - --host={{ printf "%s.%s.svc,127.0.0.1" (include "hami-vgpu.scheduler" .) (include "hami-vgpu.namespace" .) }} - {{- end }} - - --namespace={{ include "hami-vgpu.namespace" . }} - - --secret-name={{ include "hami-vgpu.scheduler.tls" . }} - restartPolicy: OnFailure - serviceAccountName: {{ include "hami-vgpu.fullname" . }}-admission - {{- if .Values.scheduler.patch.nodeSelector }} - nodeSelector: {{ toYaml .Values.scheduler.patch.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.scheduler.patch.tolerations }} - tolerations: {{ toYaml .Values.scheduler.patch.tolerations | nindent 8 }} - {{- end }} - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.scheduler.patch.runAsUser }} -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml deleted file mode 100644 index ce52042c..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml +++ /dev/null @@ -1,63 +0,0 @@ -{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "hami-vgpu.fullname" . }}-admission-patch - namespace: {{ include "hami-vgpu.namespace" . }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "hami-vgpu.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook -spec: - {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }} - # Alpha feature since k8s 1.12 - ttlSecondsAfterFinished: 0 - {{- end }} - template: - metadata: - name: {{ include "hami-vgpu.fullname" . }}-admission-patch - {{- if .Values.scheduler.patch.podAnnotations }} - annotations: {{ toYaml .Values.scheduler.patch.podAnnotations | nindent 8 }} - {{- end }} - labels: - {{- include "hami-vgpu.labels" . | nindent 8 }} - app.kubernetes.io/component: admission-webhook - hami.io/webhook: ignore - spec: - {{- if .Values.scheduler.patch.priorityClassName }} - priorityClassName: {{ .Values.scheduler.patch.priorityClassName }} - {{- end }} - {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }} - {{- include "hami.scheduler.patch.new.imagePullSecrets" . | nindent 6 }} - {{- else }} - {{- include "hami.scheduler.patch.imagePullSecrets" . | nindent 6 }} - {{- end }} - containers: - - name: patch - {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }} - image: {{ include "hami.scheduler.patch.new.image" . }} - imagePullPolicy: {{ .Values.scheduler.patch.imageNew.pullPolicy }} - {{- else }} - image: {{ include "hami.scheduler.patch.image" . }} - imagePullPolicy: {{ .Values.scheduler.patch.image.pullPolicy }} - {{- end }} - args: - - patch - - --webhook-name={{ include "hami-vgpu.scheduler.webhook" . }} - - --namespace={{ include "hami-vgpu.namespace" . }} - - --patch-validating=false - - --secret-name={{ include "hami-vgpu.scheduler.tls" . }} - restartPolicy: OnFailure - serviceAccountName: {{ include "hami-vgpu.fullname" . }}-admission - {{- if .Values.scheduler.patch.nodeSelector }} - nodeSelector: {{ toYaml .Values.scheduler.patch.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.scheduler.patch.tolerations }} - tolerations: {{ toYaml .Values.scheduler.patch.tolerations | nindent 8 }} - {{- end }} - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.scheduler.patch.runAsUser }} -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml deleted file mode 100644 index 56682f8e..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "hami-vgpu.fullname" . }}-admission - namespace: {{ include "hami-vgpu.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "hami-vgpu.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml deleted file mode 100644 index 7239b128..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "hami-vgpu.fullname" . }}-admission - namespace: {{ include "hami-vgpu.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "hami-vgpu.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ include "hami-vgpu.fullname" . }}-admission -subjects: - - kind: ServiceAccount - name: {{ include "hami-vgpu.fullname" . }}-admission - namespace: {{ include "hami-vgpu.namespace" . }} -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml deleted file mode 100644 index 857c6a8d..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "hami-vgpu.fullname" . }}-admission - namespace: {{ include "hami-vgpu.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "hami-vgpu.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook -{{- end }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/role.yaml b/packages/system/hami/charts/hami/templates/scheduler/role.yaml deleted file mode 100644 index 5f7d7e44..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/role.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: "hami-scheduler" - {{- include "hami-vgpu.labels" . | nindent 4 }} -rules: - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["create", "list", "watch", "get", "update", "patch"] diff --git a/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml deleted file mode 100644 index 96e175a1..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: "hami-scheduler" - {{- include "hami-vgpu.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ include "hami-vgpu.scheduler" . }} -subjects: - - kind: ServiceAccount - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} ---- -{{- if .Values.mockDevicePlugin.enabled }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "hami-vgpu.mock-device-plugin" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "hami-vgpu.mock-device-plugin" . }} -subjects: - - kind: ServiceAccount - name: {{ include "hami-vgpu.mock-device-plugin" . }} - namespace: {{ include "hami-vgpu.namespace" . }} -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/scheduler/service.yaml b/packages/system/hami/charts/hami/templates/scheduler/service.yaml deleted file mode 100644 index d7538fed..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/service.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.labels" . | nindent 4 }} - {{- if .Values.scheduler.service.labels }} - {{ toYaml .Values.scheduler.service.labels | indent 4 }} - {{- end }} - {{- if .Values.scheduler.service.annotations }} - annotations: {{ toYaml .Values.scheduler.service.annotations | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.scheduler.service.type | default "NodePort" }} # Default type is NodePort - ports: - - name: http - port: {{ .Values.scheduler.service.httpPort | default 443 }} # Default HTTP port is 443 - targetPort: {{ .Values.scheduler.service.httpTargetPort | default 443 }} - {{- if eq (.Values.scheduler.service.type | default "NodePort") "NodePort" }} # If type is NodePort, set nodePort - nodePort: {{ .Values.scheduler.service.schedulerPort | default 31998 }} - {{- end }} - protocol: TCP - - name: monitor - port: {{ .Values.scheduler.service.monitorPort | default 31993 }} # Default monitoring port is 31993 - targetPort: {{ .Values.scheduler.service.monitorTargetPort | default 9395 }} - {{- if eq (.Values.scheduler.service.type | default "NodePort") "NodePort" }} # If type is NodePort, set nodePort - nodePort: {{ .Values.scheduler.service.monitorPort | default 31993 }} - {{- end }} - protocol: TCP - selector: - app.kubernetes.io/component: hami-scheduler - {{- include "hami-vgpu.selectorLabels" . | nindent 4 }} diff --git a/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml b/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml deleted file mode 100644 index 0435c003..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - labels: - app.kubernetes.io/component: "hami-scheduler" - {{- include "hami-vgpu.labels" . | nindent 4 }} ---- -{{- if .Values.mockDevicePlugin.enabled }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "hami-vgpu.mock-device-plugin" . }} - namespace: {{ include "hami-vgpu.namespace" . }} -{{- end -}} diff --git a/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml b/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml deleted file mode 100644 index db9f8029..00000000 --- a/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml +++ /dev/null @@ -1,57 +0,0 @@ -{{- if .Values.scheduler.admissionWebhook.enabled -}} -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - {{- if .Values.scheduler.certManager.enabled }} - annotations: - cert-manager.io/inject-ca-from: {{ include "hami-vgpu.namespace" . }}/{{ include "hami-vgpu.scheduler" . }}-serving-cert - {{- end }} - name: {{ include "hami-vgpu.scheduler.webhook" . }} -webhooks: - - admissionReviewVersions: - - v1beta1 - clientConfig: - {{- if .Values.scheduler.admissionWebhook.customURL.enabled }} - url: https://{{ .Values.scheduler.admissionWebhook.customURL.host}}:{{.Values.scheduler.admissionWebhook.customURL.port}}{{.Values.scheduler.admissionWebhook.customURL.path}} - {{- else }} - service: - name: {{ include "hami-vgpu.scheduler" . }} - namespace: {{ include "hami-vgpu.namespace" . }} - path: /webhook - port: {{ .Values.scheduler.service.httpPort }} - {{- end }} - failurePolicy: {{ .Values.scheduler.admissionWebhook.failurePolicy }} - matchPolicy: Equivalent - name: vgpu.hami.io - namespaceSelector: - matchExpressions: - - key: hami.io/webhook - operator: NotIn - values: - - ignore - {{- if .Values.scheduler.admissionWebhook.whitelistNamespaces }} - - key: kubernetes.io/metadata.name - operator: NotIn - values: - {{- toYaml .Values.scheduler.admissionWebhook.whitelistNamespaces | nindent 10 }} - {{- end }} - objectSelector: - matchExpressions: - - key: hami.io/webhook - operator: NotIn - values: - - ignore - reinvocationPolicy: {{ .Values.scheduler.admissionWebhook.reinvocationPolicy }} - rules: - - apiGroups: - - "" - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - scope: '*' - sideEffects: None - timeoutSeconds: 10 -{{- end }} diff --git a/packages/system/hami/charts/hami/values.yaml b/packages/system/hami/charts/hami/values.yaml deleted file mode 100644 index 01caca0b..00000000 --- a/packages/system/hami/charts/hami/values.yaml +++ /dev/null @@ -1,455 +0,0 @@ -## @section Global configuration -## @param global.imageRegistry Global Docker image registry -## @param global.imagePullSecrets Global Docker image pull secrets -global: - ## @param global.imageRegistry Global Docker image registry - imageRegistry: "" - ## E.g. - ## imagePullSecrets: - ## - myRegistryKeySecretName - ## @param global.imagePullSecrets Global Docker image pull secrets - imagePullSecrets: [] - imageTag: "v2.8.1" - gpuHookPath: /usr/local - labels: {} - annotations: {} - managedNodeSelectorEnable: false - managedNodeSelector: - usage: "gpu" - -nameOverride: "" -fullnameOverride: "" -namespaceOverride: "" - -#Nvidia GPU Parameters -resourceName: "nvidia.com/gpu" -resourceMem: "nvidia.com/gpumem" -resourceMemPercentage: "nvidia.com/gpumem-percentage" -resourceCores: "nvidia.com/gpucores" -resourcePriority: "nvidia.com/priority" - -#MLU Parameters -mluResourceName: "cambricon.com/vmlu" -mluResourceMem: "cambricon.com/mlu.smlu.vmemory" -mluResourceCores: "cambricon.com/mlu.smlu.vcore" - -#Hygon DCU Parameters -dcuResourceName: "hygon.com/dcunum" -dcuResourceMem: "hygon.com/dcumem" -dcuResourceCores: "hygon.com/dcucores" - -#Metax sGPU Parameters -metaxResourceName: "metax-tech.com/sgpu" -metaxResourceCore: "metax-tech.com/vcore" -metaxResourceMem: "metax-tech.com/vmemory" -metaxsGPUTopologyAware: "false" - -#Enflame VGCU Parameters -enflameResourceNameVGCU: "enflame.com/vgcu" -enflameResourceNameVGCUPercentage: "enflame.com/vgcu-percentage" - -#Kunlun XPU Parameters -kunlunResourceName: "kunlunxin.com/xpu" -kunlunResourceVCountName: "kunlunxin.com/vxpu" -kunlunResourceVMemoryName: "kunlunxin.com/vxpu-memory" - -schedulerName: "hami-scheduler" - -scheduler: - # @param nodeName defines the node name and the nvidia-vgpu-scheduler-scheduler will schedule to the node. - # if we install the nvidia-vgpu-scheduler-scheduler as default scheduler, we need to remove the k8s default - # scheduler pod from the cluster first, we must specify node name to skip the schedule workflow. - nodeName: "" - #nodeLabelSelector: - # "gpu": "on" - overwriteEnv: "false" - defaultSchedulerPolicy: - nodeSchedulerPolicy: binpack - gpuSchedulerPolicy: spread - metricsBindAddress: ":9395" - # If set to false, When Pod.Spec.SchedulerName equals to the const DefaultSchedulerName in k8s.io/api/core/v1 package, webhook will not overwrite it - forceOverwriteDefaultScheduler: true - livenessProbe: false - leaderElect: true - # when leaderElect is true, replicas is available, otherwise replicas is 1. - replicas: 1 - kubeScheduler: - # @param enabled indicate whether to run kube-scheduler container in the scheduler pod, it's true by default. - enabled: true - ## @param image.registry kube scheduler image registry - ## @param image.repository kube scheduler image repository - ## @param image.tag kube scheduler image tag (immutable tags are recommended) - ## @param image.pullPolicy kube scheduler image pull policy - ## @param image.pullSecrets Specify docker-registry secret names as an array - image: - registry: "registry.cn-hangzhou.aliyuncs.com" - repository: "google_containers/kube-scheduler" - tag: "" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - resources: {} - # If you do want to specify resources, uncomment the following lines, adjust them as necessary. - # and remove the curly braces after 'resources:'. -# limits: -# cpu: 1000m -# memory: 1000Mi -# requests: -# cpu: 100m -# memory: 100Mi - extraNewArgs: - - --config=/config/config.yaml - - -v=4 - extraArgs: - - --policy-config-file=/config/config.json - - -v=4 - extender: - ## @param image.registry scheduler extender image registry - ## @param image.repository scheduler extender image repository - ## @param image.tag scheduler extender image tag (immutable tags are recommended) - ## @param image.pullPolicy scheduler extender image pull policy - ## @param image.pullSecrets Specify docker-registry secret names as an array - image: - registry: "docker.io" - repository: "projecthami/hami" - tag: "" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - resources: {} - # If you do want to specify resources, uncomment the following lines, adjust them as necessary, - # and remove the curly braces after 'resources:'. -# limits: -# cpu: 1000m -# memory: 1000Mi -# requests: -# cpu: 100m -# memory: 100Mi - extraArgs: - - --debug - - -v=4 - nodeLockExpire: "5m" - podAnnotations: {} - tolerations: [] - #serviceAccountName: "hami-vgpu-scheduler-sa" - admissionWebhook: - # If set to false, the admission webhook is not installed and any pods that should use HAMi must be - # configured to use the right 'schedulerName' and other device-specific configurations. - enabled: true - customURL: - enabled: false - # must be an endpoint using https. - # should generate host certs here - host: 127.0.0.1 # hostname or ip, can be your node'IP if you want to use https://:/ - port: 31998 - path: /webhook - whitelistNamespaces: - # Specify the namespaces that the webhook will not be applied to. - # - default - # - kube-system - # - istio-system - reinvocationPolicy: Never - failurePolicy: Ignore - ## TLS Certificate Option 1: Use cert-manager to generate self-signed certificate. - ## If enabled, always takes precedence over options 2. - certManager: - enabled: false - ## TLS Certificate Option 2: Use kube-webhook-certgen to generate self-signed certificate. - ## If true and certManager.enabled is false, Helm will automatically create a self-signed cert and secret for you. - patch: - enabled: true - ## @param image.registry scheduler extender image registry - ## @param image.repository scheduler extender image repository - ## @param image.tag scheduler extender image tag (immutable tags are recommended) - ## @param image.pullPolicy scheduler extender image pull policy - ## @param image.pullSecrets Specify docker-registry secret names as an array - image: - registry: "docker.io" - repository: "jettech/kube-webhook-certgen" - tag: "v1.5.2" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## @param image.registry scheduler extender image registry - ## @param image.repository scheduler extender image repository - ## @param image.tag scheduler extender image tag (immutable tags are recommended) - ## @param image.pullPolicy scheduler extender image pull policy - ## @param image.pullSecrets Specify docker-registry secret names as an array - imageNew: - registry: "docker.io" - repository: "liangjw/kube-webhook-certgen" - tag: "v1.1.1" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - priorityClassName: "" - podAnnotations: {} - nodeSelector: {} - tolerations: [] - runAsUser: 2000 - service: - type: NodePort # Default type is NodePort, can be changed to ClusterIP - httpPort: 443 # HTTP port - schedulerPort: 31998 # NodePort for HTTP - monitorPort: 31993 # Monitoring port - monitorTargetPort: 9395 - httpTargetPort: 443 - labels: {} - annotations: {} - -devicePlugin: - enabled: true - gpuOperatorToolkitReady: - enabled: false - hostPath: "/run/nvidia/validations" - ## @param image.registry devicePlugin image registry - ## @param image.repository devicePlugin image repository - ## @param image.tag devicePlugin image tag (immutable tags are recommended) - ## @param image.pullPolicy devicePlugin image pull policy - ## @param image.pullSecrets Specify docker-registry secret names as an array - image: - registry: "docker.io" - repository: "projecthami/hami" - tag: "" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - monitor: - ## @param image.registry monitor image registry - ## @param image.repository monitor image repository - ## @param image.tag monitor image tag (immutable tags are recommended) - ## @param image.pullPolicy monitor image pull policy - ## @param image.pullSecrets Specify docker-registry secret names as an array - image: - registry: "docker.io" - repository: "projecthami/hami" - tag: "" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ctrPath: /usr/local/vgpu/containers - resyncInterval: "5m" - extraArgs: - - -v=4 - extraEnvs: {} - resources: {} - # If you do want to specify resources, uncomment the following lines, adjust them as necessary. - # and remove the curly braces after 'resources:'. -# limits: -# cpu: 1000m -# memory: 1000Mi -# requests: -# cpu: 100m -# memory: 100Mi - - deviceSplitCount: 10 - deviceMemoryScaling: 1 - deviceCoreScaling: 1 - # Node configuration for device plugin, Priority: externalConfigName > config > default config - nodeConfiguration: - # If you want to use a custom config.json, you can set the content here. - # If this is set, it will override the default config.json(An example is as follows). - config: | - { - "nodeconfig": [ - { - "name": "your-node-name", - "operatingmode": "hami-core", - "devicememoryscaling": 1, - "devicesplitcount": 10, - "migstrategy": "none", - "filterdevices": { - "uuid": [], - "index": [] - } - } - ] - } - # If you want to use an existing ConfigMap, you can set the name here. - # If this is set, the chart will not create the ConfigMap and will use the existing one. - externalConfigName: "" - # The runtime class name to be used by the device plugin, and added to the pod.spec.runtimeClassName of applications utilizing NVIDIA GPUs - runtimeClassName: "" - # Whether to create runtime class, name comes from runtimeClassName when it is set - createRuntimeClass: false - migStrategy: "none" - disablecorelimit: "false" - passDeviceSpecsEnabled: false - deviceListStrategy: "envvar" - nvidiaHookPath: null - nvidiaDriverRoot: null - gdrcopyEnabled: null - gdsEnabled: null - mofedEnabled: null - - extraArgs: - - -v=4 - extraEnvs: {} - service: - type: NodePort # Default type is NodePort, can be changed to ClusterIP - httpPort: 31992 - labels: {} - annotations: {} - - pluginPath: /var/lib/kubelet/device-plugins - libPath: /usr/local/vgpu - - podAnnotations: {} - nvidiaNodeSelector: - gpu: "on" - tolerations: [] - # The updateStrategy for DevicePlugin DaemonSet. - # If you want to update the DaemonSet by manual, set type as "OnDelete". - # We recommend use OnDelete update strategy because DevicePlugin pod restart will cause business pod restart, this behavior is destructive. - # Otherwise, you can use RollingUpdate update strategy to rolling update DevicePlugin pod. - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 1 - - resources: {} - # If you do want to specify resources, uncomment the following lines, adjust them as necessary. - # and remove the curly braces after 'resources:'. -# limits: -# cpu: 1000m -# memory: 1000Mi -# requests: -# cpu: 100m -# memory: 100Mi - -mockDevicePlugin: - enabled: false - image: - registry: "docker.io" - repository: "projecthami/mock-device-plugin" - tag: "1.0.1" - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] -devices: - amd: - customresources: - - amd.com/gpu - - amd.com/gpu-memory - awsneuron: - customresources: - - aws.amazon.com/neuron - - aws.amazon.com/neuroncore - kunlun: - enabled: true - customresources: - - kunlunxin.com/xpu - - kunlunxin.com/vxpu - - kunlunxin.com/vxpu-memory - enflame: - enabled: true - customresources: - - enflame.com/vgcu - - enflame.com/vgcu-percentage - - enflame.com/gcu - mthreads: - enabled: true - customresources: - - mthreads.com/vgpu - nvidia: - gpuCorePolicy: default - libCudaLogLevel: 1 - ascend: - enabled: false - image: "" - imagePullPolicy: IfNotPresent - extraArgs: [] - nodeSelector: - ascend: "on" - tolerations: [] - customresources: - - huawei.com/Ascend910A - - huawei.com/Ascend910A-memory - - huawei.com/Ascend910B2 - - huawei.com/Ascend910B2-memory - - huawei.com/Ascend910B3 - - huawei.com/Ascend910B3-memory - - huawei.com/Ascend910B4 - - huawei.com/Ascend910B4-memory - - huawei.com/Ascend910B4-1 - - huawei.com/Ascend910B4-1-memory - - huawei.com/Ascend310P - - huawei.com/Ascend310P-memory - iluvatar: - enabled: false - customresources: - - iluvatar.ai/BI-V100-vgpu - - iluvatar.ai/BI-V100.vCore - - iluvatar.ai/BI-V100.vMem - - iluvatar.ai/BI-V150-vgpu - - iluvatar.ai/BI-V150.vCore - - iluvatar.ai/BI-V150.vMem - - iluvatar.ai/MR-V100-vgpu - - iluvatar.ai/MR-V100.vCore - - iluvatar.ai/MR-V100.vMem - - iluvatar.ai/MR-V50-vgpu - - iluvatar.ai/MR-V50.vCore - - iluvatar.ai/MR-V50.vMem diff --git a/packages/system/hami/values.yaml b/packages/system/hami/values.yaml deleted file mode 100644 index 76e8d631..00000000 --- a/packages/system/hami/values.yaml +++ /dev/null @@ -1,17 +0,0 @@ -hami: - scheduler: - kubeScheduler: - image: - registry: registry.k8s.io - repository: kube-scheduler - devicePlugin: - runtimeClassName: nvidia - updateStrategy: - type: RollingUpdate - # See https://github.com/Project-HAMi/HAMi/blob/v2.8.1/deployments/charts/hami/values.yaml - # Each entry: {"name": "node-name", "operatingmode": "hami-core", "devicesplitcount": N, ...} - nodeConfiguration: - config: | - { - "nodeconfig": [] - } diff --git a/packages/system/harbor-rd/cozyrds/harbor.yaml b/packages/system/harbor-rd/cozyrds/harbor.yaml index 5682c053..0112dc11 100644 --- a/packages/system/harbor-rd/cozyrds/harbor.yaml +++ b/packages/system/harbor-rd/cozyrds/harbor.yaml @@ -8,11 +8,12 @@ spec: singular: harbor plural: harbors openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}} + {"title":"Chart Values","type":"object","properties":{"core":{"description":"Core API server configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"database":{"description":"PostgreSQL database configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of database instances.","type":"integer","default":2},"size":{"description":"Persistent Volume size for database storage.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"host":{"description":"Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).","type":"string","default":""},"jobservice":{"description":"Background job service configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"redis":{"description":"Redis cache configuration.","type":"object","default":{},"required":["replicas","size"],"properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"size":{"description":"Persistent Volume size for cache storage.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"registry":{"description":"Container image registry configuration.","type":"object","default":{},"properties":{"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"trivy":{"description":"Trivy vulnerability scanner configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable the vulnerability scanner.","type":"boolean","default":true},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for vulnerability database cache.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}} release: prefix: "harbor-" labels: sharding.fluxcd.io/key: tenants + internal.cozystack.io/tenantmodule: "true" chartRef: kind: ExternalArtifact name: cozystack-harbor-application-default-harbor @@ -23,6 +24,7 @@ spec: plural: Harbor name: harbor description: Managed Harbor container registry + module: true tags: - registry - container diff --git a/packages/system/harbor/templates/database.yaml b/packages/system/harbor/templates/database.yaml index 9a948601..b1221e1c 100644 --- a/packages/system/harbor/templates/database.yaml +++ b/packages/system/harbor/templates/database.yaml @@ -5,9 +5,6 @@ metadata: name: {{ .Values.harbor.fullnameOverride }}-db spec: instances: {{ .Values.db.replicas }} - {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace (printf "%s-db" .Values.harbor.fullnameOverride) }} - {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }} - imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }} storage: size: {{ .Values.db.size }} {{- with .Values.db.storageClass }} diff --git a/packages/system/hetzner-robotlb/charts/robotlb/Chart.yaml b/packages/system/hetzner-robotlb/charts/robotlb/Chart.yaml index 192470dd..743f255d 100644 --- a/packages/system/hetzner-robotlb/charts/robotlb/Chart.yaml +++ b/packages/system/hetzner-robotlb/charts/robotlb/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 0.0.6 +appVersion: 0.0.5 description: A Helm chart for robotlb (loadbalancer on hetzner cloud). name: robotlb type: application diff --git a/packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml b/packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml index 41b4661a..4fd71366 100644 --- a/packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml +++ b/packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml @@ -5,7 +5,7 @@ metadata: labels: {{- include "robotlb.labels" . | nindent 4 }} spec: - replicas: 1 + replicas: {{ .Values.replicas }} selector: matchLabels: {{- include "robotlb.selectorLabels" . | nindent 6 }} diff --git a/packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml b/packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml index 76bac249..3a7b9334 100644 --- a/packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml +++ b/packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml @@ -3,8 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ include "robotlb.fullname" . }}-cr -rules: - {{- toYaml .Values.serviceAccount.permissions | nindent 2 }} +rules: {{- toYaml .Values.serviceAccount.permissions | nindent 2 }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding diff --git a/packages/system/hetzner-robotlb/charts/robotlb/values.yaml b/packages/system/hetzner-robotlb/charts/robotlb/values.yaml index 4365f677..739c7b73 100644 --- a/packages/system/hetzner-robotlb/charts/robotlb/values.yaml +++ b/packages/system/hetzner-robotlb/charts/robotlb/values.yaml @@ -36,9 +36,6 @@ serviceAccount: - apiGroups: [""] resources: [nodes, pods] verbs: [get, list, watch] - - apiGroups: [discovery.k8s.io] - resources: [endpointslices] - verbs: [get, list, watch] podAnnotations: {} podLabels: {} diff --git a/packages/system/http-cache-rd/cozyrds/http-cache.yaml b/packages/system/http-cache-rd/cozyrds/http-cache.yaml index 6e5e0619..0fe2c9cf 100644 --- a/packages/system/http-cache-rd/cozyrds/http-cache.yaml +++ b/packages/system/http-cache-rd/cozyrds/http-cache.yaml @@ -8,7 +8,7 @@ spec: plural: httpcaches singular: httpcache openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"endpoints":{"description":"Endpoints configuration, as a list of .","type":"array","default":[],"items":{"type":"string"}},"haproxy":{"description":"HAProxy configuration.","type":"object","default":{},"required":["replicas","resourcesPreset"],"properties":{"replicas":{"description":"Number of HAProxy replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"nginx":{"description":"Nginx configuration.","type":"object","default":{},"required":["replicas","resourcesPreset"],"properties":{"replicas":{"description":"Number of Nginx replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}} + {"title":"Chart Values","type":"object","properties":{"endpoints":{"description":"Endpoints configuration, as a list of .","type":"array","default":[],"items":{"type":"string"}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"haproxy":{"description":"HAProxy configuration.","type":"object","default":{},"required":["replicas","resourcesPreset"],"properties":{"replicas":{"description":"Number of HAProxy replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"nginx":{"description":"Nginx configuration.","type":"object","default":{},"required":["replicas","resourcesPreset"],"properties":{"replicas":{"description":"Number of Nginx replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}} release: prefix: http-cache- labels: diff --git a/packages/system/ingress-rd/cozyrds/ingress.yaml b/packages/system/ingress-rd/cozyrds/ingress.yaml index f814ac52..5743856f 100644 --- a/packages/system/ingress-rd/cozyrds/ingress.yaml +++ b/packages/system/ingress-rd/cozyrds/ingress.yaml @@ -8,7 +8,7 @@ spec: plural: ingresses singular: ingress openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of ingress-nginx replicas.","type":"integer","default":2},"whitelist":{"description":"List of client networks.","type":"array","default":[],"items":{"type":"string"}},"cloudflareProxy":{"description":"Restoring original visitor IPs when Cloudflare proxied is enabled.","type":"boolean","default":false},"resources":{"description":"Explicit CPU and memory configuration for each ingress-nginx replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}} + {"title":"Chart Values","type":"object","properties":{"cloudflareProxy":{"description":"Restoring original visitor IPs when Cloudflare proxied is enabled.","type":"boolean","default":false},"replicas":{"description":"Number of ingress-nginx replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each ingress-nginx replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"List of client networks.","type":"array","default":[],"items":{"type":"string"}}}} release: prefix: "" labels: diff --git a/packages/system/kafka-rd/cozyrds/kafka.yaml b/packages/system/kafka-rd/cozyrds/kafka.yaml index 8685792f..a4cc11e1 100644 --- a/packages/system/kafka-rd/cozyrds/kafka.yaml +++ b/packages/system/kafka-rd/cozyrds/kafka.yaml @@ -8,7 +8,7 @@ spec: plural: kafkas singular: kafka openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"topics":{"description":"Topics configuration.","type":"array","default":[],"items":{"type":"object","required":["config","name","partitions","replicas"],"properties":{"config":{"description":"Topic configuration.","type":"object","x-kubernetes-preserve-unknown-fields":true},"name":{"description":"Topic name.","type":"string"},"partitions":{"description":"Number of partitions.","type":"integer"},"replicas":{"description":"Number of replicas.","type":"integer"}}}},"kafka":{"description":"Kafka configuration.","type":"object","default":{},"required":["replicas","resourcesPreset","size","storageClass"],"properties":{"replicas":{"description":"Number of Kafka replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for Kafka.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the Kafka data.","type":"string","default":""}}},"zookeeper":{"description":"ZooKeeper configuration.","type":"object","default":{},"required":["replicas","resourcesPreset","size","storageClass"],"properties":{"replicas":{"description":"Number of ZooKeeper replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for ZooKeeper.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the ZooKeeper data.","type":"string","default":""}}}}} + {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"kafka":{"description":"Kafka configuration.","type":"object","default":{},"required":["replicas","resourcesPreset","size","storageClass"],"properties":{"replicas":{"description":"Number of Kafka replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for Kafka.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the Kafka data.","type":"string","default":""}}},"topics":{"description":"Topics configuration.","type":"array","default":[],"items":{"type":"object","required":["config","name","partitions","replicas"],"properties":{"config":{"description":"Topic configuration.","type":"object","x-kubernetes-preserve-unknown-fields":true},"name":{"description":"Topic name.","type":"string"},"partitions":{"description":"Number of partitions.","type":"integer"},"replicas":{"description":"Number of replicas.","type":"integer"}}}},"zookeeper":{"description":"ZooKeeper configuration.","type":"object","default":{},"required":["replicas","resourcesPreset","size","storageClass"],"properties":{"replicas":{"description":"Number of ZooKeeper replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size for ZooKeeper.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the ZooKeeper data.","type":"string","default":""}}}}} release: prefix: kafka- labels: diff --git a/packages/system/kamaji/Makefile b/packages/system/kamaji/Makefile index b23fb1bf..f82c4c7a 100644 --- a/packages/system/kamaji/Makefile +++ b/packages/system/kamaji/Makefile @@ -6,7 +6,7 @@ include ../../../hack/package.mk update: rm -rf charts - tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/clastix/kamaji | grep -E 'refs/tags/[0-9]+\.[0-9]+\.[0-9]+-edge$$' | awk -F/ 'END{print $$NF}') && \ + tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/clastix/kamaji | grep refs/tags/edge- | awk -F'[/^]' 'END{print $$3}') && \ curl -sSL https://github.com/clastix/kamaji/archive/refs/tags/$${tag}.tar.gz | \ tar -xzvf - --strip 1 kamaji-$${tag}/charts && \ sed -i "/ARG VERSION/ s|=.*|=$${tag}|g" images/kamaji/Dockerfile diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml index c02419af..253cebae 100644 --- a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml +++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_datastores_spec.yaml @@ -11,10 +11,6 @@ versions: jsonPath: .spec.driver name: Driver type: string - - description: DataStore validated and ready for use - jsonPath: .status.ready - name: Ready - type: boolean - description: Age jsonPath: .metadata.creationTimestamp name: Age @@ -276,83 +272,18 @@ versions: rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true' - message: When driver is not etcd, either tlsConfig or basicAuth must be provided rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true' - - message: driver is immutable and cannot be changed after creation - rule: oldSelf == null || self.driver == oldSelf.driver status: description: DataStoreStatus defines the observed state of DataStore. properties: - conditions: - description: Conditions contains the validation conditions for the given Datastore. - items: - description: Condition contains details for one aspect of the current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array observedGeneration: description: ObservedGeneration represents the .metadata.generation that was last reconciled. format: int64 type: integer - ready: - description: |- - Ready returns if the DataStore is accepted and ready to get used: - Kamaji will ensure certificates are available, or correctly referenced. - type: boolean usedBy: description: List of the Tenant Control Planes, namespaced named, using this data store. items: type: string type: array - required: - - ready type: object type: object served: true diff --git a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml index 9625abb4..43fbc59a 100644 --- a/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml +++ b/packages/system/kamaji/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml @@ -6165,397 +6165,6 @@ versions: type: string type: object type: object - probes: - description: |- - Probes defines the probe configuration for the Control Plane components - (kube-apiserver, controller-manager, and scheduler). - Override TimeoutSeconds, PeriodSeconds, and FailureThreshold for resource-constrained environments. - properties: - apiServer: - description: APIServer defines probe overrides for kube-apiserver, taking precedence over global probe settings. - properties: - liveness: - description: Liveness defines parameters for the liveness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - readiness: - description: Readiness defines parameters for the readiness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - startup: - description: Startup defines parameters for the startup probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - type: object - controllerManager: - description: ControllerManager defines probe overrides for kube-controller-manager, taking precedence over global probe settings. - properties: - liveness: - description: Liveness defines parameters for the liveness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - readiness: - description: Readiness defines parameters for the readiness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - startup: - description: Startup defines parameters for the startup probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - type: object - liveness: - description: Liveness defines default parameters for liveness probes of all Control Plane components. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - readiness: - description: Readiness defines default parameters for the readiness probe of kube-apiserver. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - scheduler: - description: Scheduler defines probe overrides for kube-scheduler, taking precedence over global probe settings. - properties: - liveness: - description: Liveness defines parameters for the liveness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - readiness: - description: Readiness defines parameters for the readiness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - startup: - description: Startup defines parameters for the startup probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - type: object - startup: - description: Startup defines default parameters for startup probes of all Control Plane components. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - type: object registrySettings: default: apiServerImage: kube-apiserver @@ -7287,6 +6896,9 @@ versions: type: object type: array type: object + x-kubernetes-validations: + - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji + rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))' ingress: description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane properties: @@ -7576,8 +7188,8 @@ versions: properties: address: description: |- - Address where API server will be exposed. - In the case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager. + Address where API server of will be exposed. + In case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager. type: string allowAddressAsExternalIP: description: |- @@ -7607,7 +7219,6 @@ versions: for IPv6 from the CIDR 2001:db8:abcd::/64 the resulting DNS Service IP will be 2001:db8:abcd::10. items: type: string - maxItems: 8 type: array loadBalancerClass: description: |- @@ -7629,34 +7240,21 @@ versions: Example: {"192.168.1.0/24", "10.0.0.0/8"} items: type: string - maxItems: 16 type: array - x-kubernetes-validations: - - message: all LoadBalancer source range entries must be valid CIDR - rule: self.all(r, isCIDR(r)) podCidr: default: 10.244.0.0/16 description: 'CIDR for Kubernetes Pods: if empty, defaulted to 10.244.0.0/16.' type: string - x-kubernetes-validations: - - message: podCidr must be empty or a valid CIDR - rule: self == '' || isCIDR(self) port: default: 6443 - description: Port where API server will be exposed + description: Port where API server of will be exposed format: int32 type: integer serviceCidr: default: 10.96.0.0/16 description: 'CIDR for Kubernetes Services: if empty, defaulted to 10.96.0.0/16.' type: string - x-kubernetes-validations: - - message: serviceCidr must be empty or a valid CIDR - rule: self == '' || isCIDR(self) type: object - x-kubernetes-validations: - - message: all DNS service IPs must be part of the Service CIDR - rule: '!has(self.dnsServiceIPs) || self.dnsServiceIPs.all(r, cidr(self.serviceCidr).containsIP(r))' writePermissions: description: |- WritePermissions allows to select which operations (create, delete, update) must be blocked: diff --git a/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml b/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml index b7eb1690..7042df0b 100644 --- a/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml +++ b/packages/system/kamaji/charts/kamaji/controller-gen/validating-webhook.yaml @@ -19,6 +19,46 @@ resources: - tenantcontrolplanes sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: '{{ include "kamaji.webhookServiceName" . }}' + namespace: '{{ .Release.Namespace }}' + path: /validate-kamaji-clastix-io-v1alpha1-datastore + failurePolicy: Fail + name: vdatastore.kb.io + rules: + - apiGroups: + - kamaji.clastix.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + - DELETE + resources: + - datastores + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: '{{ include "kamaji.webhookServiceName" . }}' + namespace: '{{ .Release.Namespace }}' + path: /validate--v1-secret + failurePolicy: Ignore + name: vdatastoresecrets.kb.io + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - DELETE + resources: + - secrets + sideEffects: None - admissionReviewVersions: - v1 clientConfig: diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml index 903f7c69..896a40e8 100644 --- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml +++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml @@ -20,10 +20,6 @@ spec: jsonPath: .spec.driver name: Driver type: string - - description: DataStore validated and ready for use - jsonPath: .status.ready - name: Ready - type: boolean - description: Age jsonPath: .metadata.creationTimestamp name: Age @@ -285,83 +281,18 @@ spec: rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true' - message: When driver is not etcd, either tlsConfig or basicAuth must be provided rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true' - - message: driver is immutable and cannot be changed after creation - rule: oldSelf == null || self.driver == oldSelf.driver status: description: DataStoreStatus defines the observed state of DataStore. properties: - conditions: - description: Conditions contains the validation conditions for the given Datastore. - items: - description: Condition contains details for one aspect of the current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array observedGeneration: description: ObservedGeneration represents the .metadata.generation that was last reconciled. format: int64 type: integer - ready: - description: |- - Ready returns if the DataStore is accepted and ready to get used: - Kamaji will ensure certificates are available, or correctly referenced. - type: boolean usedBy: description: List of the Tenant Control Planes, namespaced named, using this data store. items: type: string type: array - required: - - ready type: object type: object served: true diff --git a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml index f3c72dcd..506d4379 100644 --- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml +++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml @@ -6173,397 +6173,6 @@ spec: type: string type: object type: object - probes: - description: |- - Probes defines the probe configuration for the Control Plane components - (kube-apiserver, controller-manager, and scheduler). - Override TimeoutSeconds, PeriodSeconds, and FailureThreshold for resource-constrained environments. - properties: - apiServer: - description: APIServer defines probe overrides for kube-apiserver, taking precedence over global probe settings. - properties: - liveness: - description: Liveness defines parameters for the liveness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - readiness: - description: Readiness defines parameters for the readiness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - startup: - description: Startup defines parameters for the startup probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - type: object - controllerManager: - description: ControllerManager defines probe overrides for kube-controller-manager, taking precedence over global probe settings. - properties: - liveness: - description: Liveness defines parameters for the liveness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - readiness: - description: Readiness defines parameters for the readiness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - startup: - description: Startup defines parameters for the startup probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - type: object - liveness: - description: Liveness defines default parameters for liveness probes of all Control Plane components. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - readiness: - description: Readiness defines default parameters for the readiness probe of kube-apiserver. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - scheduler: - description: Scheduler defines probe overrides for kube-scheduler, taking precedence over global probe settings. - properties: - liveness: - description: Liveness defines parameters for the liveness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - readiness: - description: Readiness defines parameters for the readiness probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - startup: - description: Startup defines parameters for the startup probe. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - type: object - startup: - description: Startup defines default parameters for startup probes of all Control Plane components. - properties: - failureThreshold: - description: FailureThreshold is the consecutive failure count required to consider the probe failed. - format: int32 - minimum: 1 - type: integer - initialDelaySeconds: - description: InitialDelaySeconds is the number of seconds after the container has started before the probe is initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: PeriodSeconds is how often (in seconds) to perform the probe. - format: int32 - minimum: 1 - type: integer - successThreshold: - description: |- - SuccessThreshold is the minimum consecutive successes for the probe to be considered successful. - Must be 1 for liveness and startup probes. - format: int32 - minimum: 1 - type: integer - timeoutSeconds: - description: TimeoutSeconds is the number of seconds after which the probe times out. - format: int32 - minimum: 1 - type: integer - type: object - type: object registrySettings: default: apiServerImage: kube-apiserver @@ -7295,6 +6904,9 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: parentRefs must not specify port or sectionName, these are set automatically by Kamaji + rule: '!has(self.parentRefs) || size(self.parentRefs) == 0 || self.parentRefs.all(ref, !has(ref.port) && !has(ref.sectionName))' ingress: description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane properties: @@ -7584,8 +7196,8 @@ spec: properties: address: description: |- - Address where API server will be exposed. - In the case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager. + Address where API server of will be exposed. + In case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager. type: string allowAddressAsExternalIP: description: |- @@ -7615,7 +7227,6 @@ spec: for IPv6 from the CIDR 2001:db8:abcd::/64 the resulting DNS Service IP will be 2001:db8:abcd::10. items: type: string - maxItems: 8 type: array loadBalancerClass: description: |- @@ -7637,34 +7248,21 @@ spec: Example: {"192.168.1.0/24", "10.0.0.0/8"} items: type: string - maxItems: 16 type: array - x-kubernetes-validations: - - message: all LoadBalancer source range entries must be valid CIDR - rule: self.all(r, isCIDR(r)) podCidr: default: 10.244.0.0/16 description: 'CIDR for Kubernetes Pods: if empty, defaulted to 10.244.0.0/16.' type: string - x-kubernetes-validations: - - message: podCidr must be empty or a valid CIDR - rule: self == '' || isCIDR(self) port: default: 6443 - description: Port where API server will be exposed + description: Port where API server of will be exposed format: int32 type: integer serviceCidr: default: 10.96.0.0/16 description: 'CIDR for Kubernetes Services: if empty, defaulted to 10.96.0.0/16.' type: string - x-kubernetes-validations: - - message: serviceCidr must be empty or a valid CIDR - rule: self == '' || isCIDR(self) type: object - x-kubernetes-validations: - - message: all DNS service IPs must be part of the Service CIDR - rule: '!has(self.dnsServiceIPs) || self.dnsServiceIPs.all(r, cidr(self.serviceCidr).containsIP(r))' writePermissions: description: |- WritePermissions allows to select which operations (create, delete, update) must be blocked: diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile index 4dd0bb3f..ddb49636 100644 --- a/packages/system/kamaji/images/kamaji/Dockerfile +++ b/packages/system/kamaji/images/kamaji/Dockerfile @@ -1,7 +1,7 @@ # Build the manager binary FROM golang:1.26 AS builder -ARG VERSION=26.3.5-edge +ARG VERSION=edge-26.2.4 ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff new file mode 100644 index 00000000..1a8767b5 --- /dev/null +++ b/packages/system/kamaji/images/kamaji/patches/disable-datastore-check.diff @@ -0,0 +1,30 @@ +diff --git a/cmd/manager/cmd.go b/cmd/manager/cmd.go +--- a/cmd/manager/cmd.go ++++ b/cmd/manager/cmd.go +@@ -4,7 +4,6 @@ + package manager + + import ( +- "context" + "flag" + "fmt" + "io" +@@ -34,7 +33,6 @@ + "github.com/clastix/kamaji/controllers/soot" + "github.com/clastix/kamaji/internal" + "github.com/clastix/kamaji/internal/builders/controlplane" +- datastoreutils "github.com/clastix/kamaji/internal/datastore/utils" + "github.com/clastix/kamaji/internal/utilities" + "github.com/clastix/kamaji/internal/webhook" + "github.com/clastix/kamaji/internal/webhook/handlers" +@@ -85,10 +83,6 @@ + + if webhookCABundle, err = os.ReadFile(webhookCAPath); err != nil { + return fmt.Errorf("unable to read webhook CA: %w", err) +- } +- +- if err = datastoreutils.CheckExists(context.Background(), scheme, datastore); err != nil { +- return err + } + + if controllerReconcileTimeout.Seconds() == 0 { diff --git a/packages/system/kamaji/images/kamaji/patches/increase-startup-probe-threshold.diff b/packages/system/kamaji/images/kamaji/patches/increase-startup-probe-threshold.diff new file mode 100644 index 00000000..1938c9f6 --- /dev/null +++ b/packages/system/kamaji/images/kamaji/patches/increase-startup-probe-threshold.diff @@ -0,0 +1,31 @@ +diff --git a/internal/builders/controlplane/deployment.go b/internal/builders/controlplane/deployment.go +index e7f0b88..d67a851 100644 +--- a/internal/builders/controlplane/deployment.go ++++ b/internal/builders/controlplane/deployment.go +@@ -376,7 +376,7 @@ func (d Deployment) buildScheduler(podSpec *corev1.PodSpec, tenantControlPlane k + TimeoutSeconds: 1, + PeriodSeconds: 10, + SuccessThreshold: 1, +- FailureThreshold: 3, ++ FailureThreshold: 30, + } + + switch { +@@ -469,7 +469,7 @@ func (d Deployment) buildControllerManager(podSpec *corev1.PodSpec, tenantContro + TimeoutSeconds: 1, + PeriodSeconds: 10, + SuccessThreshold: 1, +- FailureThreshold: 3, ++ FailureThreshold: 30, + } + switch { + case tenantControlPlane.Spec.ControlPlane.Deployment.Resources == nil: +@@ -600,7 +600,7 @@ func (d Deployment) buildKubeAPIServer(podSpec *corev1.PodSpec, tenantControlPla + TimeoutSeconds: 1, + PeriodSeconds: 10, + SuccessThreshold: 1, +- FailureThreshold: 3, ++ FailureThreshold: 30, + } + podSpec.Containers[index].ImagePullPolicy = corev1.PullAlways + // Volume mounts diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml index 6ba649f0..5c562d2b 100644 --- a/packages/system/kamaji/values.yaml +++ b/packages/system/kamaji/values.yaml @@ -3,37 +3,14 @@ kamaji: deploy: false image: pullPolicy: IfNotPresent - tag: v1.3.0@sha256:8c9af083b60600c0800eb56a2cda75f26007b7272a1cf019140de003bfce1a4d + tag: v1.1.7@sha256:e9456e26c2b6f681704ad7b3017444eb244b370c8b5b3aee8ae30e967022f08b repository: ghcr.io/cozystack/cozystack/kamaji resources: limits: cpu: 200m - memory: 512Mi + memory: 500Mi requests: cpu: 100m - memory: 256Mi - startupProbe: - httpGet: - path: /healthz - port: healthcheck - initialDelaySeconds: 5 - periodSeconds: 5 - timeoutSeconds: 3 - successThreshold: 1 - failureThreshold: 12 - livenessProbe: - httpGet: - path: /healthz - port: healthcheck - initialDelaySeconds: 30 - periodSeconds: 20 - timeoutSeconds: 1 - readinessProbe: - httpGet: - path: /readyz - port: healthcheck - initialDelaySeconds: 30 - periodSeconds: 10 - timeoutSeconds: 1 + memory: 100Mi extraArgs: - - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.3.0@sha256:8c9af083b60600c0800eb56a2cda75f26007b7272a1cf019140de003bfce1a4d + - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.1.7@sha256:e9456e26c2b6f681704ad7b3017444eb244b370c8b5b3aee8ae30e967022f08b diff --git a/packages/system/keycloak-configure/templates/configure-kk.yaml b/packages/system/keycloak-configure/templates/configure-kk.yaml index a5683957..d2ed13d5 100644 --- a/packages/system/keycloak-configure/templates/configure-kk.yaml +++ b/packages/system/keycloak-configure/templates/configure-kk.yaml @@ -37,18 +37,6 @@ spec: displayHtmlName: {{ $brandingConfig.branding }} {{- end }} {{- end }} - {{- with .Values.login }} - login: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.smtp }} - smtp: - {{- toYaml . | nindent 4 }} - {{- end }} - sessions: - ssoSessionSettings: - idleTimeout: 86400 - maxLifespan: 604800 --- diff --git a/packages/system/keycloak-configure/values.yaml b/packages/system/keycloak-configure/values.yaml deleted file mode 100644 index 0b4fa03c..00000000 --- a/packages/system/keycloak-configure/values.yaml +++ /dev/null @@ -1,39 +0,0 @@ -# login: -# userRegistration: false -# verifyEmail: false -# duplicateEmails: false -# editUsername: false -# emailAsUsername: false -# forgotPassword: false -# loginWithEmail: true -# rememberMe: false - -# smtp: -# template: -# from: "noreply@example.com" -# fromDisplayName: "" -# replyTo: "" -# replyToDisplayName: "" -# envelopeFrom: "" -# connection: -# host: "smtp.example.com" -# port: 587 -# enableSSL: false -# enableStartTLS: true -# authentication: -# username: -# value: "user" -# # secretKeyRef: -# # name: "secret-name" -# # key: "key" -# # configMapKeyRef: -# # name: "configmap-name" -# # key: "key" -# password: -# secretKeyRef: -# name: "smtp-credentials" -# key: "password" -# # value: "plaintext-password" -# # configMapKeyRef: -# # name: "configmap-name" -# # key: "key" diff --git a/packages/system/keycloak-operator/Makefile b/packages/system/keycloak-operator/Makefile index 3386cf18..9c8d63c1 100644 --- a/packages/system/keycloak-operator/Makefile +++ b/packages/system/keycloak-operator/Makefile @@ -4,17 +4,6 @@ export NAMESPACE=cozy-keycloak include ../../../hack/common-envs.mk include ../../../hack/package.mk -image: - docker buildx build images/keycloak-operator \ - --tag $(REGISTRY)/keycloak-operator:$(call settag,$(TAG)) \ - --cache-from type=registry,ref=$(REGISTRY)/keycloak-operator:latest \ - --cache-to type=inline \ - --metadata-file images/keycloak-operator.json \ - $(BUILDX_ARGS) - TAG="$(call settag,$(TAG))@$$(yq e '."containerimage.digest"' images/keycloak-operator.json -r)" \ - yq -i '.keycloak-operator.image.tag = strenv(TAG)' values.yaml - rm -f images/keycloak-operator.json - update: rm -rf charts helm repo add epamedp https://epam.github.io/edp-helm-charts/stable diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/Chart.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/Chart.yaml index 5bd434ce..f9d53963 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/Chart.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/Chart.yaml @@ -157,29 +157,30 @@ annotations: - apiVersion: v1.edp.epam.com/v1 kind: KeycloakRealmIdentityProvider metadata: - name: github-test + name: instagram-test spec: realm: d2-id-k8s-realm-name - alias: github + alias: instagram authenticateByDefault: false enabled: true firstBrokerLoginFlowAlias: "first broker login" - providerId: "github" + providerId: "instagram" config: clientId: "foo" clientSecret: "bar" + hideOnLoginPage: "true" syncMode: "IMPORT" useJwksUrl: "true" mappers: - name: "test3212" identityProviderMapper: "oidc-hardcoded-role-idp-mapper" - identityProviderAlias: "github" + identityProviderAlias: "instagram" config: role: "role-tr" syncMode: "INHERIT" - name: "test-33221" identityProviderMapper: "hardcoded-attribute-idp-mapper" - identityProviderAlias: "github" + identityProviderAlias: "instagram" config: attribute: "foo" "attribute.value": "bar" @@ -271,8 +272,8 @@ annotations: secret: secret-name-in-operator-ns url: https://keycloak.example.com artifacthub.io/images: | - - name: keycloak-operator:1.32.0 - image: epamedp/keycloak-operator:1.32.0 + - name: keycloak-operator:1.25.0 + image: epamedp/keycloak-operator:1.25.0 artifacthub.io/license: Apache-2.0 artifacthub.io/links: | - name: KubeRocketCI Documentation @@ -282,7 +283,7 @@ annotations: artifacthub.io/operator: "true" artifacthub.io/operatorCapabilities: Deep Insights apiVersion: v2 -appVersion: 1.32.0 +appVersion: 1.25.0 description: A Helm chart for KubeRocketCI Keycloak Operator home: https://docs.kuberocketci.io/ icon: https://docs.kuberocketci.io/img/logo.svg @@ -307,4 +308,4 @@ name: keycloak-operator sources: - https://github.com/epam/edp-keycloak-operator type: application -version: 1.32.0 +version: 1.25.0 diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/README.md b/packages/system/keycloak-operator/charts/keycloak-operator/README.md index 61355b59..abd23443 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/README.md +++ b/packages/system/keycloak-operator/charts/keycloak-operator/README.md @@ -1,6 +1,6 @@ # keycloak-operator -![Version: 1.32.0](https://img.shields.io/badge/Version-1.32.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.32.0](https://img.shields.io/badge/AppVersion-1.32.0-informational?style=flat-square) +![Version: 1.25.0](https://img.shields.io/badge/Version-1.25.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.25.0](https://img.shields.io/badge/AppVersion-1.25.0-informational?style=flat-square) A Helm chart for KubeRocketCI Keycloak Operator @@ -16,7 +16,6 @@ _**NOTE:** Operator is platform-independent, which is why there is a unified ins 1. Linux machine or Windows Subsystem for Linux instance with [Helm 3](https://helm.sh/docs/intro/install/) installed; 2. Cluster admin access to the cluster; -3. [cert-manager](https://cert-manager.io/docs/installation/) installed in the cluster (required for webhook functionality, can be disabled via `enableWebhooks: false`); ## Installation Using Helm Chart @@ -33,7 +32,7 @@ To install the Keycloak Operator, follow the steps below: ```bash helm search repo epamedp/keycloak-operator -l NAME CHART VERSION APP VERSION DESCRIPTION - epamedp/keycloak-operator 1.31.0 1.31.0 A Helm chart for KRCI Keycloak Operator + epamedp/keycloak-operator 1.24.0 1.24.0 A Helm chart for KRCI Keycloak Operator ``` _**NOTE:** It is highly recommended to use the latest stable version._ @@ -130,21 +129,14 @@ Development versions are also available from the [snapshot helm chart repository |-----|------|---------|-------------| | affinity | object | `{}` | Affinity for pod assignment | | annotations | object | `{}` | Annotations to be added to the Deployment | -| clusterDomain | string | `"cluster.local"` | Cluster domain for constructing service DNS names | | clusterReconciliationEnabled | bool | `false` | If clusterReconciliationEnabled is true, the operator reconciles all Keycloak instances in the cluster; otherwise, it only reconciles instances in the same namespace by default, and cluster-scoped resources are ignored. | -| containerSecurityContext | object | `{"allowPrivilegeEscalation":false}` | Container Security Context Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ | -| enableOwnerRef | bool | `true` | If set to true, the operator will set the owner reference for all resources that have Keycloak or KeycloakRealm as reference. This is legacy behavior and not recommended for use. In the future, this will be set to false by default. | -| enableWebhooks | bool | `true` | If set to true, enables webhook resources (ValidatingWebhookConfiguration, Service, and Certificate). Webhooks require cert-manager to be installed in the cluster. | | extraVolumeMounts | list | `[]` | Additional volumeMounts to be added to the container | | extraVolumes | list | `[]` | Additional volumes to be added to the pod | -| image.registry | string | `""` | KubeRocketCI keycloak-operator Docker image registry. | | image.repository | string | `"epamedp/keycloak-operator"` | KubeRocketCI keycloak-operator Docker image name. The released image can be found on [Dockerhub](https://hub.docker.com/r/epamedp/keycloak-operator) | | image.tag | string | `nil` | KubeRocketCI keycloak-operator Docker image tag. The released image can be found on [Dockerhub](https://hub.docker.com/r/epamedp/keycloak-operator/tags) | | imagePullPolicy | string | `"IfNotPresent"` | If defined, a imagePullPolicy applied to the deployment | | imagePullSecrets | list | `[]` | If defined, imagePullSecrets are applied to deployment | | name | string | `"keycloak-operator"` | Application name string | | nodeSelector | object | `{}` | Node labels for pod assignment | -| podLabels | object | `{}` | Labels to be added to the pod | | resources | object | `{"limits":{"memory":"192Mi"},"requests":{"cpu":"50m","memory":"64Mi"}}` | Resource limits and requests for the pod | -| securityContext | object | `{"runAsNonRoot":true}` | Deployment Security Context Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ | | tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints | diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/README.md.gotmpl b/packages/system/keycloak-operator/charts/keycloak-operator/README.md.gotmpl index 3b67933b..9dffecab 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/README.md.gotmpl +++ b/packages/system/keycloak-operator/charts/keycloak-operator/README.md.gotmpl @@ -17,7 +17,6 @@ _**NOTE:** Operator is platform-independent, which is why there is a unified ins 1. Linux machine or Windows Subsystem for Linux instance with [Helm 3](https://helm.sh/docs/intro/install/) installed; 2. Cluster admin access to the cluster; -3. [cert-manager](https://cert-manager.io/docs/installation/) installed in the cluster (required for webhook functionality, can be disabled via `enableWebhooks: false`); ## Installation Using Helm Chart @@ -34,7 +33,7 @@ To install the Keycloak Operator, follow the steps below: ```bash helm search repo epamedp/keycloak-operator -l NAME CHART VERSION APP VERSION DESCRIPTION - epamedp/keycloak-operator 1.31.0 1.31.0 A Helm chart for KRCI Keycloak Operator + epamedp/keycloak-operator 1.24.0 1.24.0 A Helm chart for KRCI Keycloak Operator ``` _**NOTE:** It is highly recommended to use the latest stable version._ diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml index 287938b4..20d7c6f4 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml @@ -7,25 +7,3 @@ spec: realmName: realm-sample1234 authenticationFlows: browserFlow: browserFlow-sample - login: - userRegistration: true - forgotPassword: true - rememberMe: true - emailAsUsername: false - loginWithEmail: true - duplicateEmails: false - verifyEmail: true - editUsername: false - sessions: - ssoLoginSettings: - accessCodeLifespanLogin: 1800 # 30 minutes - accessCodeLifespanUserAction: 300 # 5 minutes - ssoSessionSettings: - idleTimeout: 1800 # 30 minutes - idleTimeoutRememberMe: 604800 # 7 days - maxLifespan: 36000 # 10 hours - maxLifespanRememberMe: 2592000 # 30 days - ssoOfflineSessionSettings: - idleTimeout: 2592000 # 30 days - maxLifespan: 5184000 # 60 days - maxLifespanEnabled: true diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclient.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclient.yaml index 97dde9c2..fdd9d018 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclient.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclient.yaml @@ -14,16 +14,11 @@ spec: webUrl: https://argocd.example.com adminUrl: https://admin.example.com homeUrl: /home/ + defaultClientScopes: + - groups redirectUris: - /url1/* - /url2/* - clientRolesV2: - - name: roleA - description: "Role A" - associatedClientRoles: - - roleB - - name: roleB - description: "Role B" --- diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml index 5b4c2d13..d19a317c 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml @@ -8,7 +8,6 @@ spec: name: keycloakrealm-sample kind: KeycloakRealm description: "Group Membership" - type: default protocol: openid-connect protocolMappers: - name: groups diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakorganizationorganization.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakorganizationorganization.yaml deleted file mode 100644 index 506da761..00000000 --- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakorganizationorganization.yaml +++ /dev/null @@ -1,45 +0,0 @@ -# Organization with identity provider configuration -apiVersion: v1.edp.epam.com/v1alpha1 -kind: KeycloakOrganization -metadata: - name: test-keycloak-organization - namespace: default -spec: - name: "Test Organization" - alias: "test-org" - domains: - - "example.com" - - "test.com" - redirectUrl: "https://example.com/redirect" - description: "Test organization" - attributes: - department: - - "engineering" - - "qa" - location: - - "us-east" - identityProviders: - - alias: "test-org-idp" - realmRef: - kind: KeycloakRealm - name: test-org-realm - ---- - -apiVersion: v1.edp.epam.com/v1 -kind: KeycloakRealmIdentityProvider -metadata: - name: test-org-idp - namespace: default -spec: - alias: "test-org-idp" - enabled: true - providerId: "github" - realmRef: - kind: KeycloakRealm - name: test-org-realm - config: - clientId: "test-org-client-id" - clientSecret: "test-org-client-secret" - kc.org.domain: "example.com" - kc.org.broker.redirect.mode.email-matches: "true" \ No newline at end of file diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealm.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealm.yaml index bd8771e5..4f6c080a 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealm.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealm.yaml @@ -3,6 +3,7 @@ kind: KeycloakRealm metadata: name: keycloakrealm-sample spec: + id: bfebeff6-ac63-4b46-a1f3-37df5099a9c4 realmName: realm-sample keycloakRef: name: keycloak-sample @@ -15,7 +16,6 @@ spec: realmEventConfig: adminEventsDetailsEnabled: false adminEventsEnabled: true - adminEventsExpiration: 544 enabledEventTypes: - UPDATE_CONSENT_ERROR - CLIENT_LOGIN @@ -32,15 +32,6 @@ spec: refreshTokenMaxReuse: 300 revokeRefreshToken: true defaultSignatureAlgorithm: RS256 - login: - userRegistration: true - forgotPassword: true - rememberMe: true - emailAsUsername: true - loginWithEmail: true - duplicateEmails: false - verifyEmail: true - editUsername: true userProfileConfig: unmanagedAttributePolicy: "ENABLED" attributes: @@ -103,16 +94,3 @@ spec: key: "password" username: value: "username" - sessions: - ssoLoginSettings: - accessCodeLifespanLogin: 1800 # 30 minutes - accessCodeLifespanUserAction: 300 # 5 minutes - ssoSessionSettings: - idleTimeout: 1800 # 30 minutes - idleTimeoutRememberMe: 604800 # 7 days - maxLifespan: 36000 # 10 hours - maxLifespanRememberMe: 2592000 # 30 days - ssoOfflineSessionSettings: - idleTimeout: 2592000 # 30 days - maxLifespan: 5184000 # 60 days - maxLifespanEnabled: true diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmgroup.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmgroup.yaml index 0f0ded93..59333660 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmgroup.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmgroup.yaml @@ -7,29 +7,3 @@ spec: name: keycloakrealm-sample kind: KeycloakRealm name: ArgoCDAdmins ---- -# Example of a child group using parentGroup -apiVersion: v1.edp.epam.com/v1 -kind: KeycloakRealmGroup -metadata: - name: keycloakrealmgroup-child-sample -spec: - realmRef: - name: keycloakrealm-sample - kind: KeycloakRealm - name: ArgoCDDevelopers - parentGroup: - name: keycloakrealmgroup-sample - ---- -apiVersion: v1.edp.epam.com/v1 -kind: KeycloakRealmGroup -metadata: - name: keycloakrealmgroup-child-sample2 -spec: - realmRef: - name: keycloakrealm-sample - kind: KeycloakRealm - name: ArgoCDGoDevs - parentGroup: - name: keycloakrealmgroup-child-sample \ No newline at end of file diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmidentityprovider.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmidentityprovider.yaml index 812ed081..a66a628c 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmidentityprovider.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmidentityprovider.yaml @@ -5,33 +5,23 @@ metadata: spec: realmRef: kind: KeycloakRealm - name: keycloakrealm-sample - alias: github + name: realm + alias: instagram authenticateByDefault: false enabled: true firstBrokerLoginFlowAlias: "first broker login" - postBrokerLoginFlowAlias: "browser" - providerId: "github" + providerId: "instagram" config: clientId: "foo" - clientSecret: "$test-idp-secret:secret" + clientSecret: "$secretName:secretKey" + hideOnLoginPage: "true" syncMode: "IMPORT" useJwksUrl: "true" mappers: - name: "test-33221" identityProviderMapper: "hardcoded-attribute-idp-mapper" - identityProviderAlias: "github" + identityProviderAlias: "instagram" config: attribute: "foo" "attribute.value": "bar" syncMode: "IMPORT" - ---- - -apiVersion: v1 -kind: Secret -metadata: - name: test-idp-secret -type: Opaque -data: - secret: "c2VjcmV0" # base64 encoded value of "secret" \ No newline at end of file diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser.yaml index 97289a66..1847d992 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser.yaml @@ -13,21 +13,8 @@ spec: enabled: true emailVerified: true keepResource: true - passwordSecret: - key: password - name: keycloakrealmuser-sample-password - temporary: true requiredUserActions: - - UPDATE_PROFILE - attributesV2: - department: ["IT"] - location: ["Winterfell"] - ---- -apiVersion: v1 -kind: Secret -metadata: - name: keycloakrealmuser-sample-password -type: Opaque -data: - password: "U29tZVBhc3N3b3JkMTIzIQ==" # SomePassword123! \ No newline at end of file + - UPDATE_PASSWORD + attributes: + foo: "bar" + baz: "jazz" diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser_password.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser_password.yaml index ea99e794..daf3f6a7 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser_password.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakrealmuser_password.yaml @@ -19,5 +19,3 @@ spec: passwordSecret: name: existing-k8s-secret key: key-which-contains-password - identityProviders: - - provider-alias diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml index b3a363c8..f2d8e337 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: clusterkeycloakrealms.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -97,57 +97,6 @@ spec: nullable: true type: boolean type: object - login: - description: Login settings for the realm. - nullable: true - properties: - duplicateEmails: - default: false - description: DuplicateEmails allows multiple users to have the - same email address. - type: boolean - editUsername: - default: false - description: EditUsername allows to edit username. - type: boolean - emailAsUsername: - default: false - description: EmailAsUsername allows users to set email as username. - type: boolean - forgotPassword: - default: false - description: ForgotPassword shows a link on the login page for - users who have forgotten their credentials. - type: boolean - loginWithEmail: - default: true - description: LoginWithEmail allows users to log in with their - email address. - type: boolean - rememberMe: - default: false - description: RememberMe shows checkbox on the login page to allow - the user to remain logged in between browser restarts until - the session expires. - type: boolean - userRegistration: - default: false - description: UserRegistration enables/disables the registration - page. A link for registration will show on the login page too. - type: boolean - verifyEmail: - default: false - description: VerifyEmail requires user to verify their email address - after initial login or after address changes are submitted. - type: boolean - type: object - organizationsEnabled: - default: false - description: |- - OrganizationsEnabled enables Keycloak Organizations feature for this realm. - When enabled, this realm can support Organization resources for multi-tenant scenarios, - identity provider groupings, and domain-based user routing. - type: boolean passwordPolicy: description: PasswordPolicies is a list of password policies to apply to the realm. @@ -204,80 +153,6 @@ spec: realmName: description: RealmName specifies the name of the realm. type: string - sessions: - description: Sessions defines the session settings for the realm. - properties: - ssoLoginSettings: - description: SSOLoginSettings defines the SSO login settings for - the realm. - properties: - accessCodeLifespanLogin: - default: 1800 - description: AccessCodeLifespanLogin represents the max time - a user has to complete a login. This is recommended to be - relatively long, such as 30 minutes or more. - type: integer - accessCodeLifespanUserAction: - default: 300 - description: AccessCodeLifespanUserAction represents the max - time a user has to complete login related actions like update - password or configure totp. This is recommended to be relatively - long, such as 5 minutes or more. - type: integer - type: object - ssoOfflineSessionSettings: - description: SSOOfflineSessionSettings defines the SSO offline - session settings for the realm. - properties: - idleTimeout: - default: 2592000 - description: |- - IdleTimeout represents the time an offline session is allowed to be idle before it expires. - You need to use offline token to refresh at least once within this period; otherwise offline session will expire. - type: integer - maxLifespan: - default: 5184000 - description: MaxLifespan represents the max time before an - offline session is expired regardless of activity. - type: integer - maxLifespanEnabled: - default: false - description: MaxLifespanEnabled enables the offline session - maximum lifetime. - type: boolean - type: object - ssoSessionSettings: - description: SSOSessionSettings defines the SSO session settings - for the realm. - properties: - idleTimeout: - default: 1800 - description: |- - IdleTimeout represents the time a session is allowed to be idle before it expires. - Tokens and browser sessions are invalidated when a session is expired. - type: integer - idleTimeoutRememberMe: - default: 0 - description: |- - IdleTimeoutRememberMe represents the time a session is allowed to be idle before it expires. - Tokens and browser sessions are invalidated when a session is expired. - If not set it uses the standard ssoSessionIdle value. - type: integer - maxLifespan: - default: 36000 - description: |- - MaxLifespan represents the max time before a session is expired. - Tokens and browser sessions are invalidated when a session is expired. - type: integer - maxLifespanRememberMe: - default: 0 - description: |- - MaxLifespanRememberMe represents the max time before a session is expired when a user has set the remember me option. - Tokens and browser sessions are invalidated when a session is expired. - If not set it uses the standard ssoSessionMax value. - type: integer - type: object - type: object smtp: description: Smtp is the configuration for email in the realm. nullable: true @@ -299,13 +174,10 @@ spec: description: The key to select. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key @@ -318,13 +190,10 @@ spec: description: The key of the secret to select from. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key @@ -341,13 +210,10 @@ spec: description: The key to select. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key @@ -360,13 +226,10 @@ spec: description: The key of the secret to select from. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloaks.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloaks.yaml index 971a88b5..45628ebf 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloaks.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloaks.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: clusterkeycloaks.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -66,13 +66,10 @@ spec: description: The key to select. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key @@ -85,13 +82,10 @@ spec: description: The key of the secret to select from. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakauthflows.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakauthflows.yaml index 7a2cca34..7ac30a14 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakauthflows.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakauthflows.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakauthflows.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -15,7 +15,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -109,11 +109,15 @@ spec: description: ProviderID for root auth flow and provider for child auth flows. type: string + realm: + description: |- + Deprecated: use RealmRef instead. + Realm is name of KeycloakRealm custom resource. + type: string realmRef: description: RealmRef is reference to Realm custom resource. properties: kind: - default: KeycloakRealm description: Kind specifies the kind of the Keycloak resource. enum: - KeycloakRealm @@ -122,8 +126,6 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object topLevel: description: TopLevel is true if this is root auth flow. @@ -132,7 +134,6 @@ spec: - alias - builtIn - providerId - - realmRef - topLevel type: object status: diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclients.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclients.yaml index a1505689..c79d8376 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclients.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclients.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakclients.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -15,7 +15,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -45,10 +45,8 @@ spec: description: KeycloakClientSpec defines the desired state of KeycloakClient. properties: adminFineGrainedPermissionsEnabled: - description: |- - AdminFineGrainedPermissionsEnabled enable/disable fine-grained admin permissions for a client. - Feature flag admin-fine-grained-authz:v1 should be enabled in Keycloak server. - Important: FGAP:V1 Keycloak feature remains in preview and may be deprecated and removed in a future releases. + description: AdminFineGrainedPermissionsEnabled enable/disable fine-grained + admin permissions for a client. type: boolean adminUrl: description: |- @@ -224,8 +222,6 @@ spec: within an access token or ID token representing the identity asking permissions. If not defined, user's groups are obtained from your realm configuration. type: string - required: - - groups type: object logic: default: POSITIVE @@ -423,36 +419,12 @@ spec: URI and tokens. type: string clientRoles: - description: |- - ClientRoles is a list of client roles names assigned to client. - Deprecated: Use ClientRolesV2 instead. + description: ClientRoles is a list of client roles names assigned + to client. items: type: string nullable: true type: array - clientRolesV2: - description: ClientRolesV2 is a list of client roles assigned to client. - items: - properties: - associatedClientRoles: - description: |- - AssociatedClientRoles is a list of client roles names associated with the current role. - These roles won't be created automatically, user should specify them separately in clientRolesV2. - items: - type: string - nullable: true - type: array - description: - description: Description is a client role description. - type: string - name: - description: Name is a client role name. - type: string - required: - - name - type: object - nullable: true - type: array consentRequired: description: ConsentRequired is a flag to enable consent. type: boolean @@ -552,7 +524,6 @@ spec: description: RealmRef is reference to Realm custom resource. properties: kind: - default: KeycloakRealm description: Kind specifies the kind of the Keycloak resource. enum: - KeycloakRealm @@ -561,8 +532,6 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object realmRoles: description: RealmRoles is a list of realm roles assigned to client. @@ -613,19 +582,7 @@ spec: attributes: additionalProperties: type: string - description: |- - Attributes is a map of service account attributes. - Deprecated: Use AttributesV2 instead. - nullable: true - type: object - attributesV2: - additionalProperties: - items: - type: string - type: array - description: |- - AttributesV2 is a map of service account attributes. - Each attribute can have multiple values. + description: Attributes is a map of service account attributes. nullable: true type: object clientRoles: @@ -638,7 +595,7 @@ spec: type: string roles: description: Roles is a list of client roles names assigned - to user. + to service account. items: type: string nullable: true @@ -651,12 +608,6 @@ spec: enabled: description: Enabled is a flag to enable service account. type: boolean - groups: - description: Groups is a list of groups assigned to service account - items: - type: string - nullable: true - type: array realmRoles: description: RealmRoles is a list of realm roles assigned to service account. @@ -672,6 +623,13 @@ spec: surrogateAuthRequired: description: SurrogateAuthRequired is a flag to enable surrogate auth. type: boolean + targetRealm: + description: |- + Deprecated: use RealmRef instead. + TargetRealm is a realm name where client will be created. + It has higher priority than RealmRef for backward compatibility. + If both TargetRealm and RealmRef are specified, TargetRealm will be used for client creation. + type: string webOrigins: description: |- WebOrigins is a list of allowed CORS origins. @@ -689,72 +647,12 @@ spec: type: string required: - clientId - - realmRef type: object status: description: KeycloakClientStatus defines the observed state of KeycloakClient. properties: clientId: type: string - conditions: - description: Conditions represent the latest available observations - of an object's state. - items: - description: Condition contains details for one aspect of the current - state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - nullable: true - type: array failureCount: format: int64 type: integer diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclientscopes.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclientscopes.yaml index a5329ecb..26e9876b 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclientscopes.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclientscopes.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakclientscopes.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -15,7 +15,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -52,9 +52,7 @@ spec: nullable: true type: object default: - description: |- - Default is a flag to set client scope as default. - Deprecated: Use Type: default instead. + description: Default is a flag to set client scope as default. type: boolean description: description: Description is a description of client scope. @@ -89,11 +87,15 @@ spec: type: object nullable: true type: array + realm: + description: |- + Deprecated: use RealmRef instead. + Realm is name of KeycloakRealm custom resource. + type: string realmRef: description: RealmRef is reference to Realm custom resource. properties: kind: - default: KeycloakRealm description: Kind specifies the kind of the Keycloak resource. enum: - KeycloakRealm @@ -102,25 +104,10 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object - type: - default: none - description: |- - Type of the client scope. - If set to "default", the client scope is assigned to all clients by default. - If set to "optional", the client scope can be assigned to clients on demand. - If set to "none", the client scope is not assigned to any clients by default. - enum: - - default - - optional - - none - type: string required: - name - protocol - - realmRef type: object status: description: KeycloakClientScopeStatus defines the observed state of KeycloakClientScope. diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakorganizations.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakorganizations.yaml deleted file mode 100644 index 2ca7c1de..00000000 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakorganizations.yaml +++ /dev/null @@ -1,149 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.18.0 - name: keycloakorganizations.v1.edp.epam.com -spec: - group: v1.edp.epam.com - names: - kind: KeycloakOrganization - listKind: KeycloakOrganizationList - plural: keycloakorganizations - singular: keycloakorganization - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: Reconciliation status - jsonPath: .status.value - name: Status - type: string - - description: Keycloak organization ID - jsonPath: .status.organizationId - name: Organization ID - type: string - - description: Keycloak realm name - jsonPath: .spec.realmName - name: Realm - type: string - - description: Keycloak instance name - jsonPath: .spec.keycloakRef.name - name: Keycloak - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - description: KeycloakOrganization is the Schema for the organizations API. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: KeycloakOrganizationSpec defines the desired state of Organization. - properties: - alias: - description: |- - Alias is the unique alias for the organization. - The alias should be unique across Organizations. - type: string - attributes: - additionalProperties: - items: - type: string - type: array - description: Attributes is a map of custom attributes for the organization. - nullable: true - type: object - description: - description: Description is an optional description of the organization. - type: string - domains: - description: |- - Domains is a list of email domains associated with the organization. - Each domain should be unique across Organizations. - items: - type: string - minItems: 1 - type: array - identityProviders: - description: |- - IdentityProviders is a list of identity providers associated with the organization. - One identity provider can't be assigned to multiple organizations. - items: - description: OrgIdentityProvider defines an identity provider for - an organization. - properties: - alias: - description: Alias is the unique identifier for the identity - provider within the organization. - type: string - required: - - alias - type: object - nullable: true - type: array - name: - description: |- - Name is the unique name of the organization. - The name should be unique across Organizations. - type: string - realmRef: - description: RealmRef is reference to Realm custom resource. - properties: - kind: - default: KeycloakRealm - description: Kind specifies the kind of the Keycloak resource. - enum: - - KeycloakRealm - - ClusterKeycloakRealm - type: string - name: - description: Name specifies the name of the Keycloak resource. - type: string - required: - - name - type: object - redirectUrl: - description: RedirectURL is the optional redirect URL for the organization. - type: string - required: - - alias - - domains - - name - - realmRef - type: object - status: - description: KeycloakOrganizationStatus defines the observed state of - Organization. - properties: - error: - description: Error is the error message if the reconciliation failed. - type: string - organizationId: - description: OrganizationID is the unique identifier of the organization - in Keycloak. - type: string - value: - description: Value contains the current reconciliation status. - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmcomponents.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmcomponents.yaml index c73c2b63..52129b3a 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmcomponents.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmcomponents.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakrealmcomponents.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -15,7 +15,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -90,11 +90,15 @@ spec: providerType: description: ProviderType is a provider type of component. type: string + realm: + description: |- + Deprecated: use RealmRef instead. + Realm is name of KeycloakRealm custom resource. + type: string realmRef: description: RealmRef is reference to Realm custom resource. properties: kind: - default: KeycloakRealm description: Kind specifies the kind of the Keycloak resource. enum: - KeycloakRealm @@ -103,14 +107,11 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object required: - name - providerId - providerType - - realmRef type: object status: description: KeycloakComponentStatus defines the observed state of KeycloakRealmComponent. diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmgroups.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmgroups.yaml index 2eb3f1d2..a8d3dee6 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmgroups.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmgroups.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakrealmgroups.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -15,7 +15,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -67,7 +67,7 @@ spec: type: string roles: description: Roles is a list of client roles names assigned - to user. + to service account. items: type: string nullable: true @@ -80,28 +80,18 @@ spec: name: description: Name of keycloak group. type: string - parentGroup: - description: |- - ParentGroup is a reference to a parent KeycloakRealmGroup custom resource. - If specified, this group will be created as a child group of the referenced parent. - The parent KeycloakRealmGroup must exist in the same namespace. - nullable: true - properties: - name: - description: Name specifies the name of the KeycloakRealmGroup - custom resource. - type: string - required: - - name - type: object path: description: Path is a group path. type: string + realm: + description: |- + Deprecated: use RealmRef instead. + Realm is name of KeycloakRealm custom resource. + type: string realmRef: description: RealmRef is reference to Realm custom resource. properties: kind: - default: KeycloakRealm description: Kind specifies the kind of the Keycloak resource. enum: - KeycloakRealm @@ -110,8 +100,6 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object realmRoles: description: RealmRoles is a list of realm roles assigned to group. @@ -120,16 +108,13 @@ spec: nullable: true type: array subGroups: - description: |- - SubGroups is a list of subgroups assigned to group. - Deprecated: This filed doesn't allow to fully support child groups. Use ParentGroup approach instead. + description: SubGroups is a list of subgroups assigned to group. items: type: string nullable: true type: array required: - name - - realmRef type: object status: description: KeycloakRealmGroupStatus defines the observed state of KeycloakRealmGroup. diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmidentityproviders.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmidentityproviders.yaml index ceaf14de..b779f5b1 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmidentityproviders.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmidentityproviders.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakrealmidentityproviders.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -15,7 +15,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -50,12 +50,6 @@ spec: description: AddReadTokenRoleOnCreate is a flag to add read token role on create. type: boolean - adminFineGrainedPermissionsEnabled: - description: |- - AdminFineGrainedPermissionsEnabled enable/disable fine-grained admin permissions for an identity provider. - Feature flag admin-fine-grained-authz:v1 should be enabled in Keycloak server. - Important: FGAP:V1 Keycloak feature remains in preview and may be deprecated and removed in a future releases. - type: boolean alias: description: Alias is a alias of identity provider. type: string @@ -108,38 +102,18 @@ spec: type: object nullable: true type: array - permission: - description: Permission is a identity provider permissions configuration - nullable: true - properties: - scopePermissions: - description: ScopePermissions mapping of scope and the policies - attached - items: - properties: - name: - type: string - policies: - items: - type: string - type: array - required: - - name - type: object - type: array - type: object - postBrokerLoginFlowAlias: - description: PostBrokerLoginFlowAlias is a post broker login flow - alias. - type: string providerId: description: ProviderID is a provider ID of identity provider. type: string + realm: + description: |- + Deprecated: use RealmRef instead. + Realm is name of KeycloakRealm custom resource. + type: string realmRef: description: RealmRef is reference to Realm custom resource. properties: kind: - default: KeycloakRealm description: Kind specifies the kind of the Keycloak resource. enum: - KeycloakRealm @@ -148,8 +122,6 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object storeToken: description: StoreToken is a flag to store token. @@ -162,7 +134,6 @@ spec: - config - enabled - providerId - - realmRef type: object status: description: KeycloakRealmIdentityProviderStatus defines the observed diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmrolebatches.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmrolebatches.yaml index aa926c6f..b691a407 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmrolebatches.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmrolebatches.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakrealmrolebatches.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -15,7 +15,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -44,11 +44,15 @@ spec: spec: description: KeycloakRealmRoleBatchSpec defines the desired state of KeycloakRealmRoleBatch. properties: + realm: + description: |- + Deprecated: use RealmRef instead. + Realm is name of KeycloakRealm custom resource. + type: string realmRef: description: RealmRef is reference to Realm custom resource. properties: kind: - default: KeycloakRealm description: Kind specifies the kind of the Keycloak resource. enum: - KeycloakRealm @@ -57,8 +61,6 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object roles: description: Roles is a list of roles to be created. @@ -102,7 +104,6 @@ spec: type: object type: array required: - - realmRef - roles type: object status: diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmroles.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmroles.yaml index 1ed11331..20adde93 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmroles.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmroles.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakrealmroles.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -15,7 +15,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -98,11 +98,15 @@ spec: name: description: Name of keycloak role. type: string + realm: + description: |- + Deprecated: use RealmRef instead. + Realm is name of KeycloakRealm custom resource. + type: string realmRef: description: RealmRef is reference to Realm custom resource. properties: kind: - default: KeycloakRealm description: Kind specifies the kind of the Keycloak resource. enum: - KeycloakRealm @@ -111,12 +115,9 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object required: - name - - realmRef type: object status: description: KeycloakRealmRoleStatus defines the observed state of KeycloakRealmRole. diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealms.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealms.yaml index 312a6055..69523264 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealms.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealms.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakrealms.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -19,7 +19,7 @@ spec: jsonPath: .status.available name: Available type: boolean - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -83,11 +83,16 @@ spec: description: ID is the ID of the realm. nullable: true type: string + keycloakOwner: + description: |- + Deprecated: use KeycloakRef instead. + KeycloakOwner specifies the name of the Keycloak instance that owns the realm. + nullable: true + type: string keycloakRef: description: KeycloakRef is reference to Keycloak custom resource. properties: kind: - default: Keycloak description: Kind specifies the kind of the Keycloak resource. enum: - Keycloak @@ -96,60 +101,7 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object - login: - description: Login settings for the realm. - nullable: true - properties: - duplicateEmails: - default: false - description: DuplicateEmails allows multiple users to have the - same email address. - type: boolean - editUsername: - default: false - description: EditUsername allows to edit username. - type: boolean - emailAsUsername: - default: false - description: EmailAsUsername allows users to set email as username. - type: boolean - forgotPassword: - default: false - description: ForgotPassword shows a link on the login page for - users who have forgotten their credentials. - type: boolean - loginWithEmail: - default: true - description: LoginWithEmail allows users to log in with their - email address. - type: boolean - rememberMe: - default: false - description: RememberMe shows checkbox on the login page to allow - the user to remain logged in between browser restarts until - the session expires. - type: boolean - userRegistration: - default: false - description: UserRegistration enables/disables the registration - page. A link for registration will show on the login page too. - type: boolean - verifyEmail: - default: false - description: VerifyEmail requires user to verify their email address - after initial login or after address changes are submitted. - type: boolean - type: object - organizationsEnabled: - default: false - description: |- - OrganizationsEnabled enables Keycloak Organizations feature for this realm. - When enabled, this realm can support Organization resources for multi-tenant scenarios, - identity provider groupings, and domain-based user routing. - type: boolean passwordPolicy: description: PasswordPolicies is a list of password policies to apply to the realm. @@ -206,83 +158,6 @@ spec: realmName: description: RealmName specifies the name of the realm. type: string - x-kubernetes-validations: - - message: Value is immutable - rule: self == oldSelf - sessions: - description: Sessions defines the session settings for the realm. - properties: - ssoLoginSettings: - description: SSOLoginSettings defines the SSO login settings for - the realm. - properties: - accessCodeLifespanLogin: - default: 1800 - description: AccessCodeLifespanLogin represents the max time - a user has to complete a login. This is recommended to be - relatively long, such as 30 minutes or more. - type: integer - accessCodeLifespanUserAction: - default: 300 - description: AccessCodeLifespanUserAction represents the max - time a user has to complete login related actions like update - password or configure totp. This is recommended to be relatively - long, such as 5 minutes or more. - type: integer - type: object - ssoOfflineSessionSettings: - description: SSOOfflineSessionSettings defines the SSO offline - session settings for the realm. - properties: - idleTimeout: - default: 2592000 - description: |- - IdleTimeout represents the time an offline session is allowed to be idle before it expires. - You need to use offline token to refresh at least once within this period; otherwise offline session will expire. - type: integer - maxLifespan: - default: 5184000 - description: MaxLifespan represents the max time before an - offline session is expired regardless of activity. - type: integer - maxLifespanEnabled: - default: false - description: MaxLifespanEnabled enables the offline session - maximum lifetime. - type: boolean - type: object - ssoSessionSettings: - description: SSOSessionSettings defines the SSO session settings - for the realm. - properties: - idleTimeout: - default: 1800 - description: |- - IdleTimeout represents the time a session is allowed to be idle before it expires. - Tokens and browser sessions are invalidated when a session is expired. - type: integer - idleTimeoutRememberMe: - default: 0 - description: |- - IdleTimeoutRememberMe represents the time a session is allowed to be idle before it expires. - Tokens and browser sessions are invalidated when a session is expired. - If not set it uses the standard ssoSessionIdle value. - type: integer - maxLifespan: - default: 36000 - description: |- - MaxLifespan represents the max time before a session is expired. - Tokens and browser sessions are invalidated when a session is expired. - type: integer - maxLifespanRememberMe: - default: 0 - description: |- - MaxLifespanRememberMe represents the max time before a session is expired when a user has set the remember me option. - Tokens and browser sessions are invalidated when a session is expired. - If not set it uses the standard ssoSessionMax value. - type: integer - type: object - type: object smtp: description: Smtp is the configuration for email in the realm. nullable: true @@ -304,13 +179,10 @@ spec: description: The key to select. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key @@ -323,13 +195,10 @@ spec: description: The key of the secret to select from. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key @@ -346,13 +215,10 @@ spec: description: The key to select. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key @@ -365,13 +231,10 @@ spec: description: The key of the secret to select from. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key @@ -687,7 +550,6 @@ spec: nullable: true type: array required: - - keycloakRef - realmName type: object status: diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmusers.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmusers.yaml index ac2538fe..05097bcd 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmusers.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealmusers.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloakrealmusers.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -15,7 +15,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - description: Reconciliation status + - description: Reconcilation status jsonPath: .status.value name: Status type: string @@ -47,40 +47,9 @@ spec: attributes: additionalProperties: type: string - description: |- - Attributes is a map of user attributes. - Deprecated: Use AttributesV2 instead. + description: Attributes is a map of user attributes. nullable: true type: object - attributesV2: - additionalProperties: - items: - type: string - type: array - description: |- - AttributesV2 is a map of service account attributes. - Each attribute can have multiple values. - nullable: true - type: object - clientRoles: - description: ClientRoles is a list of client roles assigned to user. - items: - properties: - clientId: - description: ClientID is a client ID. - type: string - roles: - description: Roles is a list of client roles names assigned - to user. - items: - type: string - nullable: true - type: array - required: - - clientId - type: object - nullable: true - type: array email: description: Email is a user email. type: string @@ -99,13 +68,6 @@ spec: type: string nullable: true type: array - identityProviders: - description: IdentityProviders is a list of identity providers aliases - linked to the user. - items: - type: string - nullable: true - type: array keepResource: default: true description: |- @@ -117,9 +79,9 @@ spec: description: LastName is a user last name. type: string password: - description: |- - Password is a user password. Allows to keep user password within Custom Resource. For security concerns, it is recommended to use PasswordSecret instead. - Deperecated: use PasswordSecret instead. + description: Password is a user password. Allows to keep user password + within Custom Resource. For security concerns, it is recommended + to use PasswordSecret instead. type: string passwordSecret: description: PasswordSecret defines Kubernetes secret Name and Key, @@ -132,19 +94,19 @@ spec: name: description: Name is the name of the secret. type: string - temporary: - default: false - description: Temporary indicates whether the password is temporary. - type: boolean required: - key - name type: object + realm: + description: |- + Deprecated: use RealmRef instead. + Realm is name of KeycloakRealm custom resource. + type: string realmRef: description: RealmRef is reference to Realm custom resource. properties: kind: - default: KeycloakRealm description: Kind specifies the kind of the Keycloak resource. enum: - KeycloakRealm @@ -153,13 +115,11 @@ spec: name: description: Name specifies the name of the Keycloak resource. type: string - required: - - name type: object reconciliationStrategy: description: |- - ReconciliationStrategy is a strategy for reconciliation. Possible values: full, addOnly. - Default value: full. If set to addOnly, user will be created only if it does not exist. If user exists, it will not be updated. + ReconciliationStrategy is a strategy for reconciliation. Possible values: full, create-only. + Default value: full. If set to create-only, user will be created only if it does not exist. If user exists, it will not be updated. If set to full, user will be created if it does not exist, or updated if it exists. type: string requiredUserActions: @@ -179,79 +139,14 @@ spec: description: Username is a username in keycloak. type: string required: - - realmRef - username type: object status: description: KeycloakRealmUserStatus defines the observed state of KeycloakRealmUser. properties: - conditions: - description: Conditions represent the latest available observations - of an object's state. - items: - description: Condition contains details for one aspect of the current - state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - nullable: true - type: array failureCount: format: int64 type: integer - lastSyncedPasswordSecretVersion: - description: |- - LastSyncedPasswordSecretVersion stores the ResourceVersion of the password secret - that was last successfully synced to Keycloak. Used to detect secret changes. - type: string value: type: string type: object diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloaks.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloaks.yaml index 9b48d9ca..99660f8c 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloaks.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloaks.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: keycloaks.v1.edp.epam.com spec: group: v1.edp.epam.com @@ -64,13 +64,10 @@ spec: description: The key to select. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key @@ -83,13 +80,10 @@ spec: description: The key of the secret to select from. type: string name: - default: "" description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string required: - key diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/clusterrole.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/clusterrole.yaml index 4c290815..fe8f80e8 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/clusterrole.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/clusterrole.yaml @@ -156,32 +156,6 @@ rules: - get - patch - update - - apiGroups: - - v1.edp.epam.com - resources: - - keycloakorganizations - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - - apiGroups: - - v1.edp.epam.com - resources: - - keycloakorganizations/finalizers - verbs: - - update - - apiGroups: - - v1.edp.epam.com - resources: - - keycloakorganizations/status - verbs: - - get - - patch - - update - apiGroups: - v1.edp.epam.com resources: diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/deployment.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/deployment.yaml index cd73c03a..fbeaa42e 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/deployment.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/deployment.yaml @@ -16,20 +16,11 @@ spec: template: metadata: labels: - {{- include "keycloak-operator.selectorLabels" . | nindent 8 }} name: {{ .Values.name }} - control-plane: controller-manager - {{- if hasKey .Values.podLabels "name" }} - {{ fail "The 'name' key is not allowed in podLabels" }} - {{- end }} - {{- range $key, $value := .Values.podLabels }} - {{ $key }}: {{ $value | quote }} - {{- end }} spec: serviceAccountName: edp-{{ .Values.name }} - {{- if .Values.securityContext }} - securityContext: {{ toYaml .Values.securityContext | nindent 8 }} - {{- end }} + securityContext: + runAsNonRoot: true {{- with .Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} @@ -37,20 +28,12 @@ spec: containers: - name: {{ .Values.name }} # Replace this with the built image name - image: {{ if .Values.image.registry }}{{ .Values.image.registry }}/{{ end }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }} + image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }} imagePullPolicy: "{{ .Values.imagePullPolicy }}" command: - /manager - args: - - --metrics-bind-address=:8443 - - --leader-elect - - --health-probe-bind-address=:8081 - {{- if .Values.enableWebhooks }} - - --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs - {{- end }} - {{- if .Values.containerSecurityContext }} - securityContext: {{ toYaml .Values.containerSecurityContext | nindent 12 }} - {{- end }} + securityContext: + allowPrivilegeEscalation: false env: - name: WATCH_NAMESPACE {{- if .Values.clusterReconciliationEnabled }} @@ -68,26 +51,11 @@ spec: valueFrom: fieldRef: fieldPath: metadata.name - - name: ENABLE_OWNER_REF - value: {{ .Values.enableOwnerRef | quote }} - - name: ENABLE_WEBHOOKS - value: {{ .Values.enableWebhooks | quote }} - {{- if or .Values.extraVolumeMounts .Values.enableWebhooks }} + {{- if .Values.extraVolumeMounts }} volumeMounts: - {{- if .Values.enableWebhooks }} - - mountPath: /tmp/k8s-webhook-server/serving-certs - name: webhook-certs - readOnly: true - {{- end }} {{- if .Values.extraVolumeMounts }} {{- toYaml .Values.extraVolumeMounts | nindent 12 }} {{- end }} - {{- end }} - {{- if .Values.enableWebhooks }} - ports: - - containerPort: 9443 - name: webhook-server - protocol: TCP {{- end }} livenessProbe: httpGet: @@ -103,13 +71,8 @@ spec: periodSeconds: 10 resources: {{ toYaml .Values.resources | indent 12 }} - {{- if or .Values.extraVolumes .Values.enableWebhooks }} + {{- if .Values.extraVolumes }} volumes: - {{- if .Values.enableWebhooks }} - - name: webhook-certs - secret: - secretName: webhook-server-cert - {{- end }} {{- if .Values.extraVolumes }} {{- toYaml .Values.extraVolumes | nindent 8 }} {{- end }} diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/operator_role.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/operator_role.yaml index 0f9f3b6e..1d95a354 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/operator_role.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/templates/operator_role.yaml @@ -5,82 +5,309 @@ metadata: labels: {{- include "keycloak-operator.labels" . | nindent 4 }} rules: -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - v1 - resources: - - configmap - verbs: - - get - - list - - watch -- apiGroups: - - v1.edp.epam.com - resources: - - keycloakauthflows - - keycloakclients - - keycloakclientscopes - - keycloakorganizations - - keycloakrealmcomponents - - keycloakrealmgroups - - keycloakrealmidentityproviders - - keycloakrealmrolebatches - - keycloakrealmroles - - keycloakrealms - - keycloakrealmusers - - keycloaks - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - v1.edp.epam.com - resources: - - keycloakauthflows/finalizers - - keycloakclients/finalizers - - keycloakclientscopes/finalizers - - keycloakorganizations/finalizers - - keycloakrealmcomponents/finalizers - - keycloakrealmgroups/finalizers - - keycloakrealmidentityproviders/finalizers - - keycloakrealmrolebatches/finalizers - - keycloakrealmroles/finalizers - - keycloakrealms/finalizers - - keycloakrealmusers/finalizers - - keycloaks/finalizers - verbs: - - update -- apiGroups: - - v1.edp.epam.com - resources: - - keycloakauthflows/status - - keycloakclients/status - - keycloakclientscopes/status - - keycloakorganizations/status - - keycloakrealmcomponents/status - - keycloakrealmgroups/status - - keycloakrealmidentityproviders/status - - keycloakrealmrolebatches/status - - keycloakrealmroles/status - - keycloakrealms/status - - keycloakrealmusers/status - - keycloaks/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakauthflows + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakauthflows/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakauthflows/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakclients + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakclients/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakclients/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakclientscopes + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakclientscopes/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakclientscopes/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmcomponents + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmcomponents/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmcomponents/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmgroups + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmgroups/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmgroups/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmidentityproviders + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmidentityproviders/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmidentityproviders/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmrolebatches + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmrolebatches/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmrolebatches/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmroles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmroles/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmroles/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealms + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealms/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealms/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmusers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmusers/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloakrealmusers/status + verbs: + - get + - patch + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloaks + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - v1.edp.epam.com + resources: + - keycloaks/finalizers + verbs: + - update + - apiGroups: + - v1.edp.epam.com + resources: + - keycloaks/status + verbs: + - get + - patch + - update diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/certmanager.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/certmanager.yaml deleted file mode 100644 index e3cec94e..00000000 --- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/certmanager.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.enableWebhooks }} -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - labels: - {{- include "keycloak-operator.labels" . | nindent 4 }} - name: {{ .Values.name }}-serving-cert -spec: - dnsNames: - - {{ .Values.name }}-webhook-service.{{ .Release.Namespace }}.svc - - {{ .Values.name }}-webhook-service.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} - issuerRef: - kind: Issuer - name: {{ .Values.name }}-selfsigned-issuer - secretName: webhook-server-cert ---- -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - labels: - {{- include "keycloak-operator.labels" . | nindent 4 }} - name: {{ .Values.name }}-selfsigned-issuer -spec: - selfSigned: {} -{{- end }} diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/manifest.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/manifest.yaml deleted file mode 100644 index 2f5a222b..00000000 --- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/manifest.yaml +++ /dev/null @@ -1,78 +0,0 @@ -{{- if .Values.enableWebhooks }} -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - name: {{ .Values.name }}-mutating-webhook-configuration-{{ .Release.Namespace }} - labels: - {{- include "keycloak-operator.labels" . | nindent 4 }} - annotations: - cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.name }}-serving-cert -webhooks: -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: {{ .Values.name }}-webhook-service - namespace: {{ .Release.Namespace }} - path: /mutate-v1-edp-epam-com-v1-keycloakclient - failurePolicy: Fail - name: mkeycloakclient-v1.kb.io - {{- /* Namespace-scoped webhook to prevent cross-namespace conflicts. */ -}} - {{- if not .Values.clusterReconciliationEnabled }} - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: In - values: - - {{ .Release.Namespace }} - {{- end }} - rules: - - apiGroups: - - v1.edp.epam.com - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - keycloakclients - sideEffects: None ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - labels: - {{- include "keycloak-operator.labels" . | nindent 4 }} - annotations: - cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.name }}-serving-cert - name: {{ .Values.name }}-validating-webhook-configuration-{{ .Release.Namespace }} -webhooks: -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: {{ .Values.name }}-webhook-service - namespace: {{ .Release.Namespace }} - path: /validate-v1-edp-epam-com-v1-keycloakrealm - failurePolicy: Fail - name: vkeycloakrealm-v1.kb.io - {{- /* Namespace-scoped webhook validation to prevent cross-namespace conflicts. */ -}} - {{- if not .Values.clusterReconciliationEnabled }} - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: In - values: - - {{ .Release.Namespace }} - {{- end }} - rules: - - apiGroups: - - v1.edp.epam.com - apiVersions: - - v1 - operations: - - CREATE - resources: - - keycloakrealms - sideEffects: None -{{- end }} diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/rbac.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/rbac.yaml deleted file mode 100644 index 6fca5e20..00000000 --- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/rbac.yaml +++ /dev/null @@ -1,33 +0,0 @@ -{{- if .Values.enableWebhooks }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - {{- include "keycloak-operator.labels" . | nindent 4 }} - name: edp-{{ .Release.Namespace }}-webhook-clusterrole -rules: -- apiGroups: - - v1.edp.epam.com - resources: - - keycloakrealms - verbs: - - get - - list - - watch - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - {{- include "keycloak-operator.labels" . | nindent 4 }} - name: edp-{{ .Release.Namespace }}-webhook-clusterrolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: edp-{{ .Release.Namespace }}-webhook-clusterrole -subjects: - - kind: ServiceAccount - name: edp-{{ .Values.name }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/service.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/service.yaml deleted file mode 100644 index 96a7c245..00000000 --- a/packages/system/keycloak-operator/charts/keycloak-operator/templates/webhook/service.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if .Values.enableWebhooks }} -apiVersion: v1 -kind: Service -metadata: - labels: - {{- include "keycloak-operator.labels" . | nindent 4 }} - name: {{ .Values.name }}-webhook-service -spec: - ports: - - port: 443 - protocol: TCP - targetPort: 9443 - selector: - {{- include "keycloak-operator.selectorLabels" . | nindent 4 }} - control-plane: controller-manager -{{- end }} diff --git a/packages/system/keycloak-operator/charts/keycloak-operator/values.yaml b/packages/system/keycloak-operator/charts/keycloak-operator/values.yaml index 64226135..fbd6ae53 100644 --- a/packages/system/keycloak-operator/charts/keycloak-operator/values.yaml +++ b/packages/system/keycloak-operator/charts/keycloak-operator/values.yaml @@ -2,10 +2,6 @@ name: keycloak-operator # -- Annotations to be added to the Deployment annotations: {} -# -- Cluster domain for constructing service DNS names -clusterDomain: cluster.local -# -- Labels to be added to the pod -podLabels: {} # -- Node labels for pod assignment nodeSelector: {} # -- Node tolerations for server scheduling to nodes with taints @@ -13,8 +9,6 @@ tolerations: [] # -- Affinity for pod assignment affinity: {} image: - # -- KubeRocketCI keycloak-operator Docker image registry. - registry: "" # -- KubeRocketCI keycloak-operator Docker image name. The released image can be found on [Dockerhub](https://hub.docker.com/r/epamedp/keycloak-operator) repository: epamedp/keycloak-operator # if not defined then .Chart.AppVersion is used @@ -33,16 +27,6 @@ resources: cpu: 50m memory: 64Mi -# -- Deployment Security Context -# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ -securityContext: - runAsNonRoot: true - -# -- Container Security Context -# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ -containerSecurityContext: - allowPrivilegeEscalation: false - # -- Additional volumes to be added to the pod extraVolumes: [] # - name: custom-ca @@ -60,11 +44,3 @@ extraVolumeMounts: [] # -- If clusterReconciliationEnabled is true, the operator reconciles all Keycloak instances in the cluster; # otherwise, it only reconciles instances in the same namespace by default, and cluster-scoped resources are ignored. clusterReconciliationEnabled: false - -# -- If set to true, the operator will set the owner reference for all resources that have Keycloak or KeycloakRealm as reference. -# This is legacy behavior and not recommended for use. In the future, this will be set to false by default. -enableOwnerRef: true - -# -- If set to true, enables webhook resources (ValidatingWebhookConfiguration, Service, and Certificate). -# Webhooks require cert-manager to be installed in the cluster. -enableWebhooks: true diff --git a/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile b/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile deleted file mode 100644 index 8167042f..00000000 --- a/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile +++ /dev/null @@ -1,29 +0,0 @@ -# syntax=docker/dockerfile:1.2 - -FROM alpine AS source -ARG COMMIT_REF=facbc36 -RUN apk add --no-cache curl tar git -WORKDIR /src - -RUN curl -sSL https://github.com/epam/edp-keycloak-operator/archive/${COMMIT_REF}.tar.gz \ - | tar -xz --strip-components=1 - -COPY patches /patches -RUN git apply /patches/*.diff - -FROM --platform=$BUILDPLATFORM docker.io/golang:1.24 AS builder -ARG TARGETOS -ARG TARGETARCH - -WORKDIR /go/src/keycloak-operator - -COPY --from=source /src/go.mod /src/go.sum ./ -RUN go mod download - -COPY --from=source /src . -RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /build/manager ./cmd - -FROM gcr.io/distroless/static:nonroot -COPY --from=builder /build/manager /manager -USER 65532:65532 -ENTRYPOINT ["/manager"] diff --git a/packages/system/keycloak-operator/images/keycloak-operator/patches/pr309.diff b/packages/system/keycloak-operator/images/keycloak-operator/patches/pr309.diff deleted file mode 100644 index 80f08777..00000000 --- a/packages/system/keycloak-operator/images/keycloak-operator/patches/pr309.diff +++ /dev/null @@ -1,187 +0,0 @@ -diff --git a/internal/controller/keycloakrealmgroup/chain/chain.go b/internal/controller/keycloakrealmgroup/chain/chain.go -index 1ca497a0..dbc3844b 100644 ---- a/internal/controller/keycloakrealmgroup/chain/chain.go -+++ b/internal/controller/keycloakrealmgroup/chain/chain.go -@@ -15,6 +15,10 @@ type GroupContext struct { - // GroupID is the Keycloak group ID, set by CreateOrUpdateGroup handler. - GroupID string - -+ // ExistingGroupID is the Keycloak group ID from a previous reconciliation (status.ID). -+ // Used to detect renames: if set, the group is fetched by ID first. -+ ExistingGroupID string -+ - // ParentGroupID is the parent group's Keycloak ID (empty if top-level). - ParentGroupID string - -diff --git a/internal/controller/keycloakrealmgroup/chain/create_or_update_group.go b/internal/controller/keycloakrealmgroup/chain/create_or_update_group.go -index 0504d9dd..931fab27 100644 ---- a/internal/controller/keycloakrealmgroup/chain/create_or_update_group.go -+++ b/internal/controller/keycloakrealmgroup/chain/create_or_update_group.go -@@ -33,17 +33,34 @@ func (h *CreateOrUpdateGroup) Serve( - err error - ) - -- if groupCtx.ParentGroupID != "" { -- existingGroup, _, err = kClient.Groups.FindChildGroupByName(ctx, realm, groupCtx.ParentGroupID, spec.Name) -- } else { -- existingGroup, _, err = kClient.Groups.FindGroupByName(ctx, realm, spec.Name) -+ // If we already have an ID from a previous reconciliation, fetch by ID first. -+ // This handles renames: spec.Name may have changed but the ID stays the same. -+ if groupCtx.ExistingGroupID != "" { -+ existingGroup, _, err = kClient.Groups.GetGroup(ctx, realm, groupCtx.ExistingGroupID) -+ if err != nil && !keycloakv2.IsNotFound(err) { -+ return fmt.Errorf("unable to get group by ID %q: %w", groupCtx.ExistingGroupID, err) -+ } -+ -+ if keycloakv2.IsNotFound(err) { -+ log.Info("Group not found by ID, will search by name", "groupID", groupCtx.ExistingGroupID) -+ existingGroup = nil -+ } - } - -- if err != nil && !keycloakv2.IsNotFound(err) { -- return fmt.Errorf("unable to search for group %q: %w", spec.Name, err) -+ // If we didn't find the group by ID, search by name. -+ if existingGroup == nil { -+ if groupCtx.ParentGroupID != "" { -+ existingGroup, _, err = kClient.Groups.FindChildGroupByName(ctx, realm, groupCtx.ParentGroupID, spec.Name) -+ } else { -+ existingGroup, _, err = kClient.Groups.FindGroupByName(ctx, realm, spec.Name) -+ } -+ -+ if err != nil && !keycloakv2.IsNotFound(err) { -+ return fmt.Errorf("unable to search for group %q: %w", spec.Name, err) -+ } - } - -- if keycloakv2.IsNotFound(err) { -+ if existingGroup == nil { - groupRep := keycloakv2.GroupRepresentation{ - Name: &spec.Name, - Description: &spec.Description, -@@ -67,6 +84,7 @@ func (h *CreateOrUpdateGroup) Serve( - log.Info("Group created", "groupID", groupCtx.GroupID) - } else { - groupCtx.GroupID = *existingGroup.Id -+ existingGroup.Name = &spec.Name - existingGroup.Description = &spec.Description - existingGroup.Path = &spec.Path - existingGroup.Attributes = &spec.Attributes -diff --git a/internal/controller/keycloakrealmgroup/chain/create_or_update_group_test.go b/internal/controller/keycloakrealmgroup/chain/create_or_update_group_test.go -index 26841a71..000c7538 100644 ---- a/internal/controller/keycloakrealmgroup/chain/create_or_update_group_test.go -+++ b/internal/controller/keycloakrealmgroup/chain/create_or_update_group_test.go -@@ -265,3 +265,97 @@ func TestCreateOrUpdateGroup_Serve_FindChildGroupError(t *testing.T) { - err := h.Serve(context.Background(), group, kClient, groupCtx) - assert.ErrorContains(t, err, "unable to search for group") - } -+ -+func TestCreateOrUpdateGroup_Serve_RenameByID(t *testing.T) { -+ mockGroups := mocks.NewMockGroupsClient(t) -+ -+ kClient := &keycloakv2.KeycloakClient{Groups: mockGroups} -+ groupCtx := &GroupContext{RealmName: "test-realm", ExistingGroupID: "existing-id"} -+ -+ group := &keycloakApi.KeycloakRealmGroup{} -+ group.Spec.Name = "new-name" -+ group.Spec.Description = "Updated desc" -+ group.Spec.Path = "/new-name" -+ group.Spec.Attributes = map[string][]string{"key": {"val"}} -+ -+ mockGroups.EXPECT().GetGroup( -+ context.Background(), "test-realm", "existing-id", -+ ).Return(&keycloakv2.GroupRepresentation{ -+ Id: ptr.To("existing-id"), -+ Name: ptr.To("old-name"), -+ Path: ptr.To("/old-name"), -+ }, nil, nil) -+ -+ mockGroups.EXPECT().UpdateGroup( -+ context.Background(), "test-realm", "existing-id", -+ keycloakv2.GroupRepresentation{ -+ Id: ptr.To("existing-id"), -+ Name: ptr.To("new-name"), -+ Description: ptr.To("Updated desc"), -+ Path: ptr.To("/new-name"), -+ Attributes: &map[string][]string{"key": {"val"}}, -+ }, -+ ).Return(nil, nil) -+ -+ h := NewCreateOrUpdateGroup() -+ err := h.Serve(context.Background(), group, kClient, groupCtx) -+ require.NoError(t, err) -+ assert.Equal(t, "existing-id", groupCtx.GroupID) -+} -+ -+func TestCreateOrUpdateGroup_Serve_ExistingIDNotFound_FallsBackToName(t *testing.T) { -+ mockGroups := mocks.NewMockGroupsClient(t) -+ -+ kClient := &keycloakv2.KeycloakClient{Groups: mockGroups} -+ groupCtx := &GroupContext{RealmName: "test-realm", ExistingGroupID: "deleted-id"} -+ -+ group := &keycloakApi.KeycloakRealmGroup{} -+ group.Spec.Name = testGroupName -+ group.Spec.Path = "/test-group" -+ group.Spec.Attributes = map[string][]string{"key": {"val"}} -+ -+ mockGroups.EXPECT().GetGroup( -+ context.Background(), "test-realm", "deleted-id", -+ ).Return(nil, nil, keycloakv2.ErrNotFound) -+ -+ mockGroups.EXPECT().FindGroupByName( -+ context.Background(), "test-realm", testGroupName, -+ ).Return(nil, nil, keycloakv2.ErrNotFound) -+ -+ mockGroups.EXPECT().CreateGroup( -+ context.Background(), "test-realm", -+ keycloakv2.GroupRepresentation{ -+ Name: ptr.To(testGroupName), -+ Description: ptr.To(""), -+ Path: ptr.To("/test-group"), -+ Attributes: &map[string][]string{"key": {"val"}}, -+ }, -+ ).Return(&keycloakv2.Response{ -+ HTTPResponse: &http.Response{ -+ Header: http.Header{"Location": []string{"http://localhost/admin/realms/test-realm/groups/new-id"}}, -+ }, -+ }, nil) -+ -+ h := NewCreateOrUpdateGroup() -+ err := h.Serve(context.Background(), group, kClient, groupCtx) -+ require.NoError(t, err) -+ assert.Equal(t, "new-id", groupCtx.GroupID) -+} -+ -+func TestCreateOrUpdateGroup_Serve_GetGroupByIDError(t *testing.T) { -+ mockGroups := mocks.NewMockGroupsClient(t) -+ -+ kClient := &keycloakv2.KeycloakClient{Groups: mockGroups} -+ groupCtx := &GroupContext{RealmName: "test-realm", ExistingGroupID: "existing-id"} -+ -+ group := &keycloakApi.KeycloakRealmGroup{} -+ group.Spec.Name = testGroupName -+ -+ mockGroups.EXPECT().GetGroup( -+ context.Background(), "test-realm", "existing-id", -+ ).Return(nil, nil, errors.New("connection error")) -+ -+ h := NewCreateOrUpdateGroup() -+ err := h.Serve(context.Background(), group, kClient, groupCtx) -+ assert.ErrorContains(t, err, "unable to get group by ID") -+} -diff --git a/internal/controller/keycloakrealmgroup/keycloakrealmgroup_controller.go b/internal/controller/keycloakrealmgroup/keycloakrealmgroup_controller.go -index 0f7e6ce3..52015e24 100644 ---- a/internal/controller/keycloakrealmgroup/keycloakrealmgroup_controller.go -+++ b/internal/controller/keycloakrealmgroup/keycloakrealmgroup_controller.go -@@ -166,8 +166,9 @@ func (r *ReconcileKeycloakRealmGroup) tryReconcile(ctx context.Context, keycloak - } - - groupCtx := &chain.GroupContext{ -- RealmName: realmName, -- ParentGroupID: parentGroupID, -+ RealmName: realmName, -+ ParentGroupID: parentGroupID, -+ ExistingGroupID: keycloakRealmGroup.Status.ID, - } - - if err := chain.MakeChain().Serve(ctx, keycloakRealmGroup, kClientV2, groupCtx); err != nil { diff --git a/packages/system/keycloak-operator/values.yaml b/packages/system/keycloak-operator/values.yaml index 3bdacddc..fc61c51f 100644 --- a/packages/system/keycloak-operator/values.yaml +++ b/packages/system/keycloak-operator/values.yaml @@ -1,8 +1,4 @@ keycloak-operator: - image: - registry: ghcr.io - repository: cozystack/cozystack/keycloak-operator - tag: "latest@sha256:27279247dfbd2d1e86fc4e827d34c891880ca65eefd75da1701bc0a1adf865a9" clusterReconciliationEnabled: true resources: limits: diff --git a/packages/system/keycloak/templates/db.yaml b/packages/system/keycloak/templates/db.yaml index 6a57e93a..1cd98ffc 100644 --- a/packages/system/keycloak/templates/db.yaml +++ b/packages/system/keycloak/templates/db.yaml @@ -4,9 +4,6 @@ metadata: name: keycloak-db spec: instances: 2 - {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace "keycloak-db" }} - {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }} - imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }} storage: size: 20Gi {{- if .Values._cluster.scheduling }} diff --git a/packages/system/keycloak/templates/sts.yaml b/packages/system/keycloak/templates/sts.yaml index c1827b93..e2bba431 100644 --- a/packages/system/keycloak/templates/sts.yaml +++ b/packages/system/keycloak/templates/sts.yaml @@ -1,7 +1,3 @@ -{{- define "keycloak.theme.sanitizedName" -}} -{{- regexReplaceAll "-+" (regexReplaceAll "[^a-z0-9-]" (. | lower) "-") "-" | trimPrefix "-" | trimSuffix "-" -}} -{{- end -}} - {{- $host := index .Values._cluster "root-host" }} {{- $ingressHost := .Values.ingress.host | default (printf "keycloak.%s" $host) }} {{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }} @@ -43,48 +39,8 @@ spec: app: keycloak-ha spec: restartPolicy: Always - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} securityContext: fsGroup: 1000 - {{- if .Values.themes }} - {{- $themeNames := list }} - {{- range .Values.themes }} - {{- if not .name }}{{ fail "theme entry missing required field: name" }}{{- end }} - {{- if not .image }}{{ fail "theme entry missing required field: image" }}{{- end }} - {{- $sanitized := include "keycloak.theme.sanitizedName" .name }} - {{- if not $sanitized }}{{ fail (printf "theme name %q produces empty container name after sanitization" .name) }}{{- end }} - {{- if gt (len (printf "theme-%s" $sanitized)) 63 }}{{ fail (printf "theme name %q produces container name exceeding 63 characters" .name) }}{{- end }} - {{- if has $sanitized $themeNames }}{{ fail (printf "duplicate theme name after sanitization: %s (from %s)" $sanitized .name) }}{{- end }} - {{- $themeNames = append $themeNames $sanitized }} - {{- end }} - initContainers: - {{- range .Values.themes }} - - name: theme-{{ include "keycloak.theme.sanitizedName" .name }} - image: "{{ .image }}" - imagePullPolicy: IfNotPresent - command: ["sh", "-c", "[ -d /themes ] && cp -r /themes/. /opt/keycloak/themes/ || { echo 'ERROR: /themes directory not found in image'; exit 1; }"] - resources: - requests: - cpu: 10m - memory: 32Mi - limits: - memory: 64Mi - securityContext: - runAsNonRoot: true - runAsUser: 1000 - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - volumeMounts: - - name: themes - mountPath: /opt/keycloak/themes - {{- end }} - {{- end }} containers: - name: keycloak image: {{ .Values.image }} @@ -172,11 +128,6 @@ spec: value: https://{{ $ingressHost }} - name: JAVA_OPTS_APPEND value: "-Djgroups.dns.query=keycloak-headless.cozy-keycloak.svc.{{ $clusterDomain }}" - {{- if .Values.themes }} - volumeMounts: - - name: themes - mountPath: /opt/keycloak/themes - {{- end }} ports: - name: http containerPort: 8080 @@ -204,10 +155,4 @@ spec: periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 3 - {{- if .Values.themes }} - volumes: - - name: themes - emptyDir: - sizeLimit: 256Mi - {{- end }} terminationGracePeriodSeconds: 60 diff --git a/packages/system/keycloak/values.yaml b/packages/system/keycloak/values.yaml index 4368ea2c..708edc2c 100644 --- a/packages/system/keycloak/values.yaml +++ b/packages/system/keycloak/values.yaml @@ -1,4 +1,4 @@ -image: quay.io/keycloak/keycloak:26.5.2 +image: quay.io/keycloak/keycloak:26.0.4 ingress: # Custom hostname for the Keycloak Ingress. @@ -14,13 +14,3 @@ resources: requests: memory: 500Mi cpu: 100m - -themes: [] -# - name: my-theme -# image: my-registry/my-keycloak-theme:v1.0 -# Theme images must contain theme files under /themes/ directory. -# Each theme is copied into Keycloak's /opt/keycloak/themes/ via init container. -# If multiple themes contain files with the same path, later entries take precedence. - -imagePullSecrets: [] -# - name: my-registry-secret diff --git a/packages/system/kilo/Makefile b/packages/system/kilo/Makefile index c6f47322..48dcb938 100644 --- a/packages/system/kilo/Makefile +++ b/packages/system/kilo/Makefile @@ -5,9 +5,9 @@ include ../../../hack/common-envs.mk include ../../../hack/package.mk update: - tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/squat/kilo | awk -F'[/^]' 'END{print $$3}') && \ - digest=$$(skopeo inspect --override-os linux --override-arch amd64 --format '{{.Digest}}' docker://ghcr.io/squat/kilo:$${tag}) && \ - REPOSITORY="ghcr.io/squat/kilo" \ + tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/kilo | awk -F'[/^]' 'END{print $$3}') && \ + digest=$$(skopeo inspect --override-os linux --override-arch amd64 --format '{{.Digest}}' docker://ghcr.io/cozystack/cozystack/kilo:amd64-$${tag}) && \ + REPOSITORY="ghcr.io/cozystack/cozystack/kilo" \ yq -i '.kilo.image.repository = strenv(REPOSITORY)' values.yaml && \ TAG="$${tag}@$${digest}" \ yq -i '.kilo.image.tag = strenv(TAG)' values.yaml diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml index 0c2e4439..d7c00af4 100644 --- a/packages/system/kilo/values.yaml +++ b/packages/system/kilo/values.yaml @@ -1,8 +1,8 @@ kilo: image: pullPolicy: IfNotPresent - tag: 0.7.0@sha256:c7468aee96425f47369fd1d33b9736147aebc2e9c6e4355d0593461c30af308e - repository: ghcr.io/squat/kilo + tag: v0.8.2@sha256:9f27000ffd0bbf9adf3aefd017b7835dfae57b6ea38bf7488fb636536c2467da + repository: ghcr.io/cozystack/cozystack/kilo transitCIDR: 100.66.0.0/16 meshGranularity: location cleanUpInterface: false diff --git a/packages/system/kubeovn-plunger/templates/deployment.yaml b/packages/system/kubeovn-plunger/templates/deployment.yaml index 37b49620..183e8c5e 100644 --- a/packages/system/kubeovn-plunger/templates/deployment.yaml +++ b/packages/system/kubeovn-plunger/templates/deployment.yaml @@ -29,8 +29,6 @@ spec: {{- end }} - --metrics-bind-address=:8080 - --metrics-secure=false - - --kube-ovn-namespace={{ .Release.Namespace }} - - --ovn-central-name={{ .Values.ovnCentralName }} ports: - name: metrics containerPort: 8080 diff --git a/packages/system/kubeovn-plunger/templates/rbac.yaml b/packages/system/kubeovn-plunger/templates/rbac.yaml index 3ca22740..a0c5527b 100644 --- a/packages/system/kubeovn-plunger/templates/rbac.yaml +++ b/packages/system/kubeovn-plunger/templates/rbac.yaml @@ -22,6 +22,8 @@ rules: - get - list - watch + resourceNames: + - {{ .Values.ovnCentralName }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml index 02620593..7d68b4d6 100644 --- a/packages/system/kubeovn-plunger/values.yaml +++ b/packages/system/kubeovn-plunger/values.yaml @@ -1,4 +1,4 @@ portSecurity: true routes: "" -image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.3.0@sha256:b75a0facb99c3b0fe8090414b3425f5c4858fff632d1de122ce9944c4daa89c0 +image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.1.7@sha256:3c134647f27ec8c0fdd6f3a0780dcc999300f35ad8d6f3a4d3cf221bb5bbd39d ovnCentralName: ovn-central diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml index 0c6ce81a..d08af2db 100644 --- a/packages/system/kubeovn-webhook/values.yaml +++ b/packages/system/kubeovn-webhook/values.yaml @@ -1,3 +1,3 @@ portSecurity: true routes: "" -image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.3.0@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a +image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.1.7@sha256:e18f9fd679e38f65362a8d0042f25468272f6d081136ad47027168d8e7e07a4a diff --git a/packages/system/kubeovn/charts/kube-ovn/Chart.yaml b/packages/system/kubeovn/charts/kube-ovn/Chart.yaml index 9c01c123..f0295b87 100644 --- a/packages/system/kubeovn/charts/kube-ovn/Chart.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/Chart.yaml @@ -15,12 +15,12 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: v1.15.10 +version: v1.15.3 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "1.15.10" +appVersion: "1.15.3" kubeVersion: ">= 1.29.0-0" diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml index 62ae328e..5b093be6 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml @@ -1353,77 +1353,6 @@ spec: type: string type: object type: array - resources: - description: |- - `resources` are the compute resources required by this container. - For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. - - This field depends on the DynamicResourceAllocation feature gate. - - This field is immutable. It can only be set for containers. - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - request: - description: |- - Request is the name chosen for a request in the referenced claim. - If empty, everything from the claim is made available, otherwise - only the result of this request. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - bandwidth: - type: object - description: Optional bandwidth limit for each egress gateway instance in both ingress and egress directions. - properties: - ingress: - type: integer - format: int64 - description: ingress bandwidth limit in Mbps - egress: - type: integer - format: int64 - description: egress bandwidth limit in Mbps --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml index 06971d01..8be8eba6 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml @@ -126,9 +126,6 @@ spec: - --enable-ovn-ipsec={{- .Values.func.ENABLE_OVN_IPSEC }} - --set-vxlan-tx-off={{- .Values.func.SET_VXLAN_TX_OFF }} - --non-primary-cni-mode={{- .Values.cni_conf.NON_PRIMARY_CNI }} - {{- with .Values.mtu }} - - --mtu={{ . }} - {{- end }} securityContext: runAsUser: 0 privileged: false diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/pre-upgrade-ovs-ovn.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/pre-upgrade-ovs-ovn.yaml deleted file mode 100644 index a18a4111..00000000 --- a/packages/system/kubeovn/charts/kube-ovn/templates/pre-upgrade-ovs-ovn.yaml +++ /dev/null @@ -1,129 +0,0 @@ -{{- if include "kubeovn.ovn.versionCompatibility" . -}} ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: ovs-ovn-pre-upgrade - namespace: {{ .Values.namespace }} - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-weight": "1" - "helm.sh/hook-delete-policy": hook-succeeded -automountServiceAccountToken: false ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - annotations: - rbac.authorization.k8s.io/system-only: "true" - "helm.sh/hook": pre-upgrade - "helm.sh/hook-weight": "2" - "helm.sh/hook-delete-policy": hook-succeeded - name: system:ovs-ovn-pre-upgrade -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - list - - get - - apiGroups: - - "" - resources: - - pods/exec - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: ovs-ovn-pre-upgrade - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-weight": "3" - "helm.sh/hook-delete-policy": hook-succeeded -roleRef: - name: system:ovs-ovn-pre-upgrade - kind: ClusterRole - apiGroup: rbac.authorization.k8s.io -subjects: - - kind: ServiceAccount - name: ovs-ovn-pre-upgrade - namespace: {{ .Values.namespace }} ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: "{{ .Chart.Name }}-pre-upgrade-hook" - namespace: {{ .Values.namespace }} - labels: - app.kubernetes.io/managed-by: {{ .Release.Service | quote }} - app.kubernetes.io/instance: {{ .Release.Name | quote }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-weight": "4" - "helm.sh/hook-delete-policy": hook-succeeded -spec: - completions: 1 - template: - metadata: - name: "{{ .Release.Name }}" - labels: - app.kubernetes.io/managed-by: {{ .Release.Service | quote }} - app.kubernetes.io/instance: {{ .Release.Name | quote }} - helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - app: pre-upgrade - component: job - spec: - tolerations: - - key: "" - operator: "Exists" - effect: "NoSchedule" - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - topologyKey: kubernetes.io/hostname - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - pre-upgrade - - key: component - operator: In - values: - - job - restartPolicy: Never - hostNetwork: true - nodeSelector: - kubernetes.io/os: "linux" - serviceAccountName: ovs-ovn-pre-upgrade - automountServiceAccountToken: true - securityContext: - seccompProfile: - type: RuntimeDefault - containers: - - name: ovs-ovn-pre-upgrade - image: "{{ .Values.global.registry.address}}/{{ .Values.global.images.kubeovn.repository }}:{{ .Values.global.images.kubeovn.tag }}" - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - command: - - bash - - -eo - - pipefail - - -c - - bash /kube-ovn/pre-upgrade-ovs.sh 2>&1 | tee -a /var/log/kube-ovn/pre-upgrade-ovs.log - volumeMounts: - - mountPath: /var/log/kube-ovn - name: kube-ovn-log - volumes: - - name: kube-ovn-log - hostPath: - path: {{ .Values.log_conf.LOG_DIR }}/kube-ovn -{{- end -}} diff --git a/packages/system/kubeovn/charts/kube-ovn/values.yaml b/packages/system/kubeovn/charts/kube-ovn/values.yaml index fd3472f6..3ffb7750 100644 --- a/packages/system/kubeovn/charts/kube-ovn/values.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/values.yaml @@ -8,11 +8,11 @@ global: images: kubeovn: repository: kube-ovn - tag: v1.15.10 + tag: v1.15.3 natgateway: repository: vpc-nat-gateway # Falls back to the same tag as kubeovn if empty - tag: v1.15.10 + tag: v1.15.3 image: pullPolicy: IfNotPresent diff --git a/packages/system/kubeovn/values.yaml b/packages/system/kubeovn/values.yaml index e9d2d10f..6911f8aa 100644 --- a/packages/system/kubeovn/values.yaml +++ b/packages/system/kubeovn/values.yaml @@ -65,4 +65,4 @@ global: images: kubeovn: repository: kubeovn - tag: v1.15.10@sha256:741299cbd0081a786a6b60c460fa3156b3a42a38141c559dd8ac031f50c5504f + tag: v1.15.3@sha256:fa53d5f254f640cb626329ad35d9e7aad647dd8e1e645e68f3f13c3659472a30 diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml index f81eaff0..9ed813f6 100644 --- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml +++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml @@ -2,27 +2,13 @@ apiVersion: cozystack.io/v1alpha1 kind: ApplicationDefinition metadata: name: kubernetes - annotations: - # Kubernetes tenants boot a Kamaji control plane whose admin-kubeconfig - # Secret is provisioned asynchronously. Cold Kamaji start (image pull + - # etcd + apiserver Ready) plus admin-kubeconfig generation can exceed - # Flux helm-controller's default wait budget, causing remediation loops - # that uninstall the Cluster CR. This override is applied by cozystack-api - # to the HelmRelease Spec.Install.Timeout and Spec.Upgrade.Timeout. - # - # Coupling: the wait-for-kubeconfig init container in - # packages/apps/kubernetes/templates/_helpers.tpl hard-codes a 10m - # deadline chosen to stay strictly below this value so the pod's - # CrashLoopBackOff surfaces before flux remediation fires. If this - # annotation is raised, update that init deadline correspondingly. - release.cozystack.io/helm-install-timeout: "15m" spec: application: kind: Kubernetes singular: kubernetes plural: kuberneteses openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `.` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","hami","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"hami":{"description":"HAMi GPU virtualization middleware.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable HAMi (requires GPU Operator).","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"images":{"description":"Optional image overrides for air-gapped or rate-limited registries.","type":"object","default":{},"properties":{"waitForKubeconfig":{"description":"Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.","type":"string","default":""}}}}} + {"title":"Chart Values","type":"object","properties":{"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `.` if empty.","type":"string","default":""},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]}}} release: prefix: kubernetes- labels: @@ -40,7 +26,7 @@ spec: tags: - compute icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODFfMjg0NSkiLz4KPHBhdGggZD0iTTcxLjk5NjggMTlDNzAuMzAzOSAxOS4wMDAyIDY4LjkzMTIgMjAuNTMyMiA2OC45MzE0IDIyLjQyMjFDNjguOTMxNCAyMi40NTExIDY4LjkzNzMgMjIuNDc4OCA2OC45Mzc5IDIyLjUwNzZDNjguOTM1NCAyMi43NjQ0IDY4LjkyMzEgMjMuMDczNyA2OC45MzE0IDIzLjI5NzNDNjguOTcxNyAyNC4zODczIDY5LjIwODIgMjUuMjIxNiA2OS4zNTA2IDI2LjIyNThDNjkuNjA4NCAyOC4zNzUyIDY5LjgyNDUgMzAuMTU2OSA2OS42OTEyIDMxLjgxM0M2OS41NjE1IDMyLjQzNzUgNjkuMTAzNyAzMy4wMDg2IDY4LjY5NTYgMzMuNDA1Nkw2OC42MjM1IDM0LjcwODZDNjYuNzgzOSAzNC44NjE3IDY0LjkzMTkgMzUuMTQyMSA2My4wODIxIDM1LjU2NDFDNTUuMTIyNiAzNy4zNzk4IDQ4LjI2OTUgNDEuNDk5MSA0My4wNTIgNDcuMDYwOUM0Mi43MTM0IDQ2LjgyODggNDIuMTIxMSA0Ni40MDE5IDQxLjk0NSA0Ni4yNzEyQzQxLjM5NzcgNDYuMzQ1NCA0MC44NDQ1IDQ2LjUxNTEgNDAuMTI0MSA0Ni4wOTM1QzM4Ljc1MjIgNDUuMTY1NyAzNy41MDI4IDQzLjg4NTEgMzUuOTkxIDQyLjM0MjRDMzUuMjk4MiA0MS42MDQ0IDM0Ljc5NjYgNDAuOTAxOCAzMy45NzM1IDQwLjE5MDRDMzMuNzg2NiA0MC4wMjg5IDMzLjUwMTQgMzkuODEwNCAzMy4yOTIzIDM5LjY0NDJDMzIuNjQ4OSAzOS4xMjg4IDMxLjg5IDM4Ljg2IDMxLjE1NyAzOC44MzQ4QzMwLjIxNDcgMzguODAyNCAyOS4zMDc1IDM5LjE3MjUgMjguNzEzOCAzOS45MjA2QzI3LjY1ODQgNDEuMjUwNiAyNy45OTYzIDQzLjI4MzMgMjkuNDY3MSA0NC40NjE0QzI5LjQ4MiA0NC40NzM0IDI5LjQ5NzkgNDQuNDgyNyAyOS41MTI5IDQ0LjQ5NDNDMjkuNzE1IDQ0LjY1ODkgMjkuOTYyNSA0NC44Njk4IDMwLjE0ODMgNDUuMDA3NkMzMS4wMjE3IDQ1LjY1NTUgMzEuODE5NSA0NS45ODcyIDMyLjY4OTcgNDYuNTAxNUMzNC41MjMxIDQ3LjYzOTEgMzYuMDQzIDQ4LjU4MjMgMzcuMjQ4NiA0OS43MTk2QzM3LjcxOTQgNTAuMjIzNyAzNy44MDE2IDUxLjExMjIgMzcuODY0MyA1MS40OTY0TDM4Ljg0NjggNTIuMzc4MkMzMy41ODcyIDYwLjMzMDggMzEuMTUzIDcwLjE1MzkgMzIuNTkxNSA4MC4xNjI3TDMxLjMwNzcgODAuNTM3OEMzMC45NjkzIDgwLjk3NjggMzAuNDkxMiA4MS42Njc2IDI5Ljk5MTEgODEuODczOEMyOC40MTM4IDgyLjM3MjkgMjYuNjM4NyA4Mi41NTYyIDI0LjQ5NTYgODIuNzgxOUMyMy40ODk0IDgyLjg2NiAyMi42MjEzIDgyLjgxNTggMjEuNTU0NiA4My4wMTg4QzIxLjMxOTggODMuMDYzNSAyMC45OTI3IDgzLjE0OTEgMjAuNzM1OCA4My4yMDk3QzIwLjcyNjkgODMuMjExNiAyMC43MTg2IDgzLjIxNDIgMjAuNzA5NiA4My4yMTYyQzIwLjY5NTYgODMuMjE5NSAyMC42NzcyIDgzLjIyNjMgMjAuNjYzOCA4My4yMjk0QzE4Ljg1NyA4My42NjggMTcuNjk2MyA4NS4zMzY1IDE4LjA2OTkgODYuOTgwNUMxOC40NDM3IDg4LjYyNDggMjAuMjA4NiA4OS42MjQ4IDIyLjAyNjIgODkuMjMxMkMyMi4wMzkzIDg5LjIyODIgMjIuMDU4NCA4OS4yMjc3IDIyLjA3MiA4OS4yMjQ2QzIyLjA5MjYgODkuMjE5OSAyMi4xMTA2IDg5LjIwOTkgMjIuMTMxIDg5LjIwNDlDMjIuMzg0NCA4OS4xNDkgMjIuNzAxOSA4OS4wODY4IDIyLjkyMzYgODkuMDI3MkMyMy45NzIzIDg4Ljc0NTEgMjQuNzMxOCA4OC4zMzA2IDI1LjY3NDYgODcuOTY3N0MyNy43MDI5IDg3LjIzNjggMjkuMzgyOCA4Ni42MjYyIDMxLjAxOTUgODYuMzg4M0MzMS43MDMgODYuMzM0NSAzMi40MjMyIDg2LjgxMiAzMi43ODE0IDg3LjAxMzRMMzQuMTE3NyA4Ni43ODMxQzM3LjE5MjYgOTYuMzYxMyA0My42MzY2IDEwNC4xMDMgNTEuNzk2MyAxMDguOTYxTDUxLjIzOTYgMTEwLjMwM0M1MS40NDAzIDExMC44MjQgNTEuNjYxNiAxMTEuNTMgNTEuNTEyMSAxMTIuMDQ1QzUwLjkxNzEgMTEzLjU5NSA0OS44OTggMTE1LjIzMSA0OC43Mzc0IDExNy4wNTVDNDguMTc1NSAxMTcuODk4IDQ3LjYwMDQgMTE4LjU1MiA0Ny4wOTM0IDExOS41MTZDNDYuOTcyIDExOS43NDcgNDYuODE3NSAxMjAuMTAyIDQ2LjcwMDQgMTIwLjM0NkM0NS45MTI1IDEyMi4wMzkgNDYuNDkwNCAxMjMuOTkgNDguMDAzOCAxMjQuNzIyQzQ5LjUyNjggMTI1LjQ1OSA1MS40MTcxIDEyNC42ODIgNTIuMjM1MiAxMjIuOTg1QzUyLjIzNjQgMTIyLjk4MiA1Mi4yNDA2IDEyMi45OCA1Mi4yNDE3IDEyMi45NzhDNTIuMjQyNiAxMjIuOTc2IDUyLjI0MDkgMTIyLjk3MyA1Mi4yNDE3IDEyMi45NzFDNTIuMzU4MiAxMjIuNzMxIDUyLjUyMzMgMTIyLjQxNSA1Mi42MjE2IDEyMi4xODhDNTMuMDU2IDEyMS4xODkgNTMuMjAwNSAxMjAuMzMyIDUzLjUwNTkgMTE5LjM2NUM1NC4zMTcgMTE3LjMxOCA1NC43NjI2IDExNS4xNyA1NS44NzkxIDExMy44MzJDNTYuMTg0OSAxMTMuNDY2IDU2LjY4MzMgMTEzLjMyNSA1Ny4yMDAxIDExMy4xODZMNTcuODk0NCAxMTEuOTIyQzY1LjAwOCAxMTQuNjY1IDcyLjk3MDUgMTE1LjQwMiA4MC45MjQ1IDExMy41ODdDODIuNzM5MSAxMTMuMTczIDg0LjQ5MDggMTEyLjYzNyA4Ni4xODQzIDExMS45OTRDODYuMzc5NCAxMTIuMzQyIDg2Ljc0MiAxMTMuMDExIDg2LjgzOTMgMTEzLjE3OUM4Ny4zNjQ0IDExMy4zNTEgODcuOTM3NyAxMTMuNDM5IDg4LjQwNDcgMTE0LjEzM0M4OS4yNDAxIDExNS41NjcgODkuODExNCAxMTcuMjYzIDkwLjUwNzMgMTE5LjMxMkM5MC44MTI4IDEyMC4yNzkgOTAuOTYzOCAxMjEuMTM2IDkxLjM5ODEgMTIyLjEzNkM5MS40OTcxIDEyMi4zNjMgOTEuNjYxNCAxMjIuNjg0IDkxLjc3OCAxMjIuOTI1QzkyLjU5NDQgMTI0LjYyOCA5NC40OTA3IDEyNS40MDcgOTYuMDE1OSAxMjQuNjY5Qzk3LjUyOTIgMTIzLjkzNyA5OC4xMDc3IDEyMS45ODYgOTcuMzE5NCAxMjAuMjkzQzk3LjIwMjMgMTIwLjA0OSA5Ny4wNDEyIDExOS42OTUgOTYuOTE5OCAxMTkuNDY0Qzk2LjQxMjcgMTE4LjQ5OSA5NS44Mzc3IDExNy44NTIgOTUuMjc1OCAxMTcuMDA5Qzk0LjExNTIgMTE1LjE4NSA5My4xNTI2IDExMy42NyA5Mi41NTc1IDExMi4xMkM5Mi4zMDg3IDExMS4zMiA5Mi41OTk1IDExMC44MjMgOTIuNzkzMyAxMTAuMzAzQzkyLjY3NzIgMTEwLjE3IDkyLjQyODggMTA5LjQxNCA5Mi4yODI0IDEwOS4wNTlDMTAwLjc2MiAxMDQuMDI5IDEwNy4wMTcgOTUuOTk4NSAxMDkuOTU1IDg2LjcyMzlDMTEwLjM1MSA4Ni43ODY1IDExMS4wNDEgODYuOTA5MSAxMTEuMjY1IDg2Ljk1NDJDMTExLjcyNiA4Ni42NDg3IDExMi4xNDkgODYuMjUwMSAxMTIuOTgxIDg2LjMxNTlDMTE0LjYxNyA4Ni41NTM3IDExNi4yOTcgODcuMTY0NSAxMTguMzI2IDg3Ljg5NTNDMTE5LjI2OCA4OC4yNTgxIDEyMC4wMjggODguNjc5MyAxMjEuMDc3IDg4Ljk2MTRDMTIxLjI5OCA4OS4wMjEgMTIxLjYxNiA4OS4wNzY2IDEyMS44NjkgODkuMTMyNUMxMjEuODg5IDg5LjEzNzUgMTIxLjkwOCA4OS4xNDc1IDEyMS45MjggODkuMTUyMkMxMjEuOTQyIDg5LjE1NTMgMTIxLjk2MSA4OS4xNTU4IDEyMS45NzQgODkuMTU4OEMxMjMuNzkyIDg5LjU1MiAxMjUuNTU3IDg4LjU1MjYgMTI1LjkzIDg2LjkwODFDMTI2LjMwMyA4NS4yNjQxIDEyNS4xNDMgODMuNTk1MiAxMjMuMzM2IDgzLjE1N0MxMjMuMDc0IDgzLjA5NyAxMjIuNzAxIDgyLjk5NSAxMjIuNDQ2IDgyLjk0NjVDMTIxLjM3OSA4Mi43NDM1IDEyMC41MTEgODIuNzkzNSAxMTkuNTA1IDgyLjcwOTVDMTE3LjM2MSA4Mi40ODM5IDExNS41ODYgODIuMzAwNCAxMTQuMDA5IDgxLjgwMTRDMTEzLjM2NiA4MS41NTA3IDExMi45MDggODAuNzgxOSAxMTIuNjg2IDgwLjQ2NTVMMTExLjQ0OCA4MC4xMDM1QzExMi4wOSA3NS40MzggMTExLjkxNyA3MC41ODI1IDExMC44MDYgNjUuNzI0M0MxMDkuNjg1IDYwLjgyMDggMTA3LjcwNCA1Ni4zMzYxIDEwNS4wNjIgNTIuMzg0OEMxMDUuMzc5IDUyLjA5NDggMTA1Ljk3OSA1MS41NjEyIDEwNi4xNDkgNTEuNDA0M0MxMDYuMTk5IDUwLjg1MTcgMTA2LjE1NiA1MC4yNzIyIDEwNi43MjUgNDkuNjYwM0MxMDcuOTMxIDQ4LjUyMyAxMDkuNDUxIDQ3LjU3OTkgMTExLjI4NCA0Ni40NDIzQzExMi4xNTQgNDUuOTI3OSAxMTIuOTU5IDQ1LjU5NjQgMTEzLjgzMiA0NC45NDg0QzExNC4wMyA0NC44MDE5IDExNC4yOTkgNDQuNTY5OSAxMTQuNTA3IDQ0LjQwMjJDMTE1Ljk3NyA0My4yMjM3IDExNi4zMTYgNDEuMTkxMSAxMTUuMjYgMzkuODYxNEMxMTQuMjA0IDM4LjUzMTcgMTEyLjE1OSAzOC40MDY1IDExMC42ODggMzkuNTg1QzExMC40NzkgMzkuNzUxNiAxMTAuMTk1IDM5Ljk2ODggMTEwLjAwNyA0MC4xMzEyQzEwOS4xODQgNDAuODQyNiAxMDguNjc2IDQxLjU0NTIgMTA3Ljk4MyA0Mi4yODMyQzEwNi40NzEgNDMuODI1OSAxMDUuMjIyIDQ1LjExMyAxMDMuODUgNDYuMDQwOUMxMDMuMjU1IDQ2LjM4ODUgMTAyLjM4NSA0Ni4yNjgyIDEwMS45OSA0Ni4yNDQ5TDEwMC44MjQgNDcuMDgwNkM5NC4xNzUzIDQwLjA3NjMgODUuMTIzNSAzNS41OTgyIDc1LjM3NjYgMzQuNzI4M0M3NS4zNDk0IDM0LjMxNzkgNzUuMzEzNyAzMy41NzYxIDc1LjMwNDYgMzMuMzUyOUM3NC45MDU2IDMyLjk2OTMgNzQuNDIzNSAzMi42NDE4IDc0LjMwMjQgMzEuODEzQzc0LjE2OTEgMzAuMTU2OSA3NC4zOTE3IDI4LjM3NTIgNzQuNjQ5NiAyNi4yMjU4Qzc0Ljc5MTkgMjUuMjIxNiA3NS4wMjg0IDI0LjM4NzMgNzUuMDY4OCAyMy4yOTczQzc1LjA3OCAyMy4wNDk1IDc1LjA2MzIgMjIuNjkgNzUuMDYyMiAyMi40MjIxQzc1LjA2MiAyMC41MzIyIDczLjY4OTggMTguOTk5OCA3MS45OTY4IDE5Wk02OC4xNTg1IDQyLjg4ODZMNjcuMjQ4IDU5LjA0NDdMNjcuMTgyNSA1OS4wNzc2QzY3LjEyMTQgNjAuNTIyOSA2NS45Mzc1IDYxLjY3NyA2NC40ODM5IDYxLjY3N0M2My44ODg0IDYxLjY3NyA2My4zMzg4IDYxLjQ4NDkgNjIuODkyMiA2MS4xNTcxTDYyLjg2NiA2MS4xNzAzTDQ5LjY4MDcgNTEuNzc5NEM1My43MzMxIDQ3Ljc3NTkgNTguOTE2NCA0NC44MTcyIDY0Ljg5IDQzLjQ1NDZDNjUuOTgxMiA0My4yMDU2IDY3LjA3MTkgNDMuMDIwOSA2OC4xNTg1IDQyLjg4ODZaTTc1Ljg0MTcgNDIuODg4NkM4Mi44MTU5IDQzLjc1MDQgODkuMjY1NyA0Ni45MjMyIDk0LjIwODEgNTEuNzg2TDgxLjEwOCA2MS4xMTc2TDgxLjA2MjEgNjEuMDk3OUM3OS44OTk0IDYxLjk1MTIgNzguMjYxMSA2MS43Mzk0IDc3LjM1NDggNjAuNTk3OEM3Ni45ODM1IDYwLjEzMDEgNzYuNzg4NyA1OS41ODAxIDc2Ljc2NTMgNTkuMDI0OUw3Ni43NTIyIDU5LjAxODRMNzUuODQxNyA0Mi44ODg2Wk00NC44OTkxIDU3LjgxNEw1Ni45MzgyIDY4LjYzM0w1Ni45MjUxIDY4LjY5ODhDNTguMDExNyA2OS42NDc5IDU4LjE3MiA3MS4yOTQ5IDU3LjI2NTcgNzIuNDM2OEM1Ni44OTQ0IDcyLjkwNDUgNTYuMzk3NSA3My4yMTgyIDU1Ljg2MzkgNzMuMzY0N0w1NS44NTA4IDczLjQxNzNMNDAuNDE4OCA3Ny44OTIzQzM5LjYzMzQgNzAuNjc2NSA0MS4zMjYxIDYzLjY2MjEgNDQuODk5MSA1Ny44MTRaTTk5LjAwOTQgNTcuODIwNkMxMDAuNzk4IDYwLjczMzYgMTAyLjE1MyA2My45ODcxIDEwMi45NTkgNjcuNTE0M0MxMDMuNzU2IDcwLjk5OTEgMTAzLjk1NiA3NC40Nzc4IDEwMy42MjcgNzcuODM5N0w4OC4xMTY2IDczLjM1MTVMODguMTAzNSA3My4yODU3Qzg2LjcxNDUgNzIuOTA0MyA4NS44NjA5IDcxLjQ4NDggODYuMTg0MyA3MC4wNjExQzg2LjMxNjggNjkuNDc3OCA4Ni42MjQ5IDY4Ljk4NDQgODcuMDQyMyA2OC42MTk4TDg3LjAzNTggNjguNTg2OUw5OS4wMDk0IDU3LjgyMDZaTTY5LjUyNzQgNjkuNDY4OEg3NC40NTk2TDc3LjUyNTEgNzMuMzE4Nkw3Ni40MjQ3IDc4LjEyMjZMNzEuOTk2OCA4MC4yNjE0TDY3LjU1NTggNzguMTE2MUw2Ni40NTU0IDczLjMxMkw2OS41Mjc0IDY5LjQ2ODhaTTg1LjMzOTMgODIuNjQzN0M4NS41NDg5IDgyLjYzMzEgODUuNzU3NiA4Mi42NTIgODUuOTYxNiA4Mi42ODk4TDg1Ljk4NzggODIuNjU2OUwxMDEuOTUgODUuMzY4MkM5OS42MTQyIDkxLjk2MjQgOTUuMTQ0IDk3LjY3NSA4OS4xNzExIDEwMS40OThMODIuOTc0NyA4Ni40NjA2TDgyLjk5NDQgODYuNDM0M0M4Mi40MjUyIDg1LjEwNTUgODIuOTk0OCA4My41NDcyIDg0LjMwNDQgODIuOTEzNUM4NC42Mzk3IDgyLjc1MTMgODQuOTkgODIuNjYxNCA4NS4zMzkzIDgyLjY0MzdaTTU4LjUyOTggODIuNzA5NUM1OS43NDggODIuNzI2NyA2MC44NDA2IDgzLjU3NjEgNjEuMTIzNyA4NC44MjJDNjEuMjU2MiA4NS40MDUyIDYxLjE5MTcgODUuOTgzMSA2MC45NzMgODYuNDkzNUw2MS4wMTg5IDg2LjU1MjdMNTQuODg4IDEwMS40MzlDNDkuMTU1OSA5Ny43NDMyIDQ0LjU5MDQgOTIuMjA5OSA0Mi4xNDgxIDg1LjQyMDhMNTcuOTczMSA4Mi43MjI3TDU3Ljk5OTMgODIuNzU1NkM1OC4xNzYzIDgyLjcyMjkgNTguMzU1OCA4Mi43MDcxIDU4LjUyOTggODIuNzA5NVpNNzEuODk4NiA4OS4yMzEyQzcyLjMyMjkgODkuMjE1NSA3Mi43NTM0IDg5LjMwMyA3My4xNjI3IDg5LjUwMUM3My42OTkyIDg5Ljc2MDYgNzQuMTEzNiA5MC4xNjkyIDc0LjM3NDUgOTAuNjU5Mkg3NC40MzM0TDgyLjIzNDYgMTA0LjgyMUM4MS4yMjIxIDEwNS4xNjIgODAuMTgxMyAxMDUuNDU0IDc5LjExNjcgMTA1LjY5N0M3My4xNTA1IDEwNy4wNTggNjcuMjAzMiAxMDYuNjQ1IDYxLjgxOCAxMDQuODAyTDY5LjU5OTUgOTAuNjY1OEg2OS42MTI2QzcwLjA3OTUgODkuNzg4OCA3MC45NjUgODkuMjY1NiA3MS44OTg2IDg5LjIzMTJaIiBmaWxsPSJ3aGl0ZSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIwLjI1Ii8+CjxkZWZzPgo8bGluZWFyR3JhZGllbnQgaWQ9InBhaW50MF9saW5lYXJfNjgxXzI4NDUiIHgxPSIxMCIgeTE9IjE1LjUiIHgyPSIxNDQiIHkyPSIxMzEuNSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjNEQ4N0ZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzA1NDdEMCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8L2RlZnM+Cjwvc3ZnPgo= - keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "hami"], ["spec", "addons", "hami", "enabled"], ["spec", "addons", "hami", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"], ["spec", "images"], ["spec", "images", "waitForKubeconfig"]] + keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"]] secrets: exclude: [] include: diff --git a/packages/system/kubevirt-cdi/templates/cdi-cr.yaml b/packages/system/kubevirt-cdi/templates/cdi-cr.yaml index 7dc15ee0..8f57ec43 100644 --- a/packages/system/kubevirt-cdi/templates/cdi-cr.yaml +++ b/packages/system/kubevirt-cdi/templates/cdi-cr.yaml @@ -3,7 +3,7 @@ kind: CDI metadata: name: cdi spec: - cloneStrategyOverride: csi-clone + cloneStrategyOverride: copy config: {{- with .Values.uploadProxyURL }} uploadProxyURLOverride: {{ quote . }} diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml index 56e28543..3f0977a0 100644 --- a/packages/system/kubevirt-csi-node/values.yaml +++ b/packages/system/kubevirt-csi-node/values.yaml @@ -1,3 +1,3 @@ storageClass: replicated csiDriver: - image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:72154a97054e16cdf3dea6129d962b8d7e86b55cf9386095e8ac2ce7c8b69172 + image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:c40b352c18e4a7d9b3a40d6c29c32bbf6dd9bd8fdca35185b194187e797aeeb6 diff --git a/packages/system/lineage-controller-webhook/Makefile b/packages/system/lineage-controller-webhook/Makefile index cdc1cf01..d5bada31 100644 --- a/packages/system/lineage-controller-webhook/Makefile +++ b/packages/system/lineage-controller-webhook/Makefile @@ -4,13 +4,8 @@ NAMESPACE=cozy-system include ../../../hack/common-envs.mk include ../../../hack/package.mk -.PHONY: test - image: image-lineage-controller-webhook -test: - helm unittest . - image-lineage-controller-webhook: docker buildx build -f images/lineage-controller-webhook/Dockerfile ../../.. \ --tag $(REGISTRY)/lineage-controller-webhook:$(call settag,$(TAG)) \ diff --git a/packages/system/lineage-controller-webhook/README.md b/packages/system/lineage-controller-webhook/README.md deleted file mode 100644 index 1e43c9c8..00000000 --- a/packages/system/lineage-controller-webhook/README.md +++ /dev/null @@ -1,67 +0,0 @@ -# lineage-controller-webhook - -Cozystack system package for the **lineage controller webhook** — a mutating -admission webhook that stamps "lineage" labels onto tenant workloads, linking -each resource back to the Cozystack `Application` that ultimately owns it. - -The webhook intercepts CREATE and UPDATE on `pods`, `secrets`, `services`, -`persistentvolumeclaims`, `ingresses.networking.k8s.io`, and -`workloadmonitors.cozystack.io` outside system namespaces. For each request it -walks the ownership graph upward (Kubernetes `ownerReferences`, then the -`HelmRelease` Flux installed the resource with, then the Cozystack -`Application`-derived CRD that produced the HelmRelease) and writes the -discovered application's group, kind and name as labels -(`apps.cozystack.io/application.{group,kind,name}`) on the incoming object. -Those labels let the aggregated API server, the Cozystack dashboard, and other -lineage-aware consumers reason about which application a resource belongs to. - -The webhook serves TLS on port 9443 with a cert-manager issued certificate, and -runs with `failurePolicy: Fail` — every CREATE/UPDATE on the resources above -is gated on the webhook being reachable. - -## Topology - -The chart ships a single shape, modelled on `cozystack-api`: - -- **Deployment** with two replicas (override via `replicas`). -- **Soft `nodeAffinity`** preferring `node-role.kubernetes.io/control-plane` - (`Exists`, so it matches both Talos's empty value and k3s/kubeadm's `"true"`). - Soft means: the pod lands on a control-plane node when one is reachable, and - on any worker otherwise — no override needed for managed Kubernetes, - Cozy-in-Cozy tenants, or any other cluster where control-plane nodes aren't - visible. -- **Permissive `tolerations`** (`[{operator: Exists}]`) so the pod can land on - tainted control-plane nodes when the soft affinity is satisfiable. -- **Soft `podAntiAffinity`** on `kubernetes.io/hostname` so replicas spread - across nodes when possible (best-effort). -- **`PodDisruptionBudget`** with `maxUnavailable: 1`, unconditional. At - `replicas: 1` it's a useful no-op (allows full drain); at `replicas >= 2` - it caps disruption to one pod. -- **`Service` with `spec.trafficDistribution: PreferClose`** so the apiserver - prefers a webhook endpoint on its own node when one exists, and transparently - falls over to a remote endpoint otherwise. Requires Kubernetes ≥ 1.31; on - older clusters the field is silently ignored and traffic uses default - cluster-wide distribution. - -## Parameters - -All keys live under the top-level `lineageControllerWebhook:` map. - -| Name | Description | Value | -| ----------------------------- | --------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `image` | Container image (digest-pinned) | `ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0@sha256:e898…6fb0` | -| `debug` | Enable `--zap-log-level=debug` instead of `info` | `false` | -| `replicas` | Deployment replica count | `2` | -| `localK8sAPIEndpoint.enabled` | **Deprecated.** See note below. | `false` | - -### `localK8sAPIEndpoint.enabled` (deprecated) - -When enabled, this injects `KUBERNETES_SERVICE_HOST=status.hostIP` and -`KUBERNETES_SERVICE_PORT=6443` so the webhook talks to the kube-apiserver on -its own node. It was originally added to avoid latency on the -webhook-to-apiserver path, but it is only valid when the pod is actually -scheduled on an apiserver-bearing node — which the chart's soft control-plane -affinity no longer guarantees. With this flag enabled and the pod scheduled -off a control-plane node, the controller will crash-loop dialing a non- -apiserver hostIP. Slated for removal once the latency motivation is addressed -in the webhook itself; **leave disabled**. diff --git a/packages/system/lineage-controller-webhook/templates/workload.yaml b/packages/system/lineage-controller-webhook/templates/daemonset.yaml similarity index 67% rename from packages/system/lineage-controller-webhook/templates/workload.yaml rename to packages/system/lineage-controller-webhook/templates/daemonset.yaml index 097919c6..860aee6e 100644 --- a/packages/system/lineage-controller-webhook/templates/workload.yaml +++ b/packages/system/lineage-controller-webhook/templates/daemonset.yaml @@ -1,11 +1,10 @@ apiVersion: apps/v1 -kind: Deployment +kind: DaemonSet metadata: name: lineage-controller-webhook labels: app: lineage-controller-webhook spec: - replicas: {{ .Values.lineageControllerWebhook.replicas }} selector: matchLabels: app: lineage-controller-webhook @@ -14,25 +13,13 @@ spec: labels: app: lineage-controller-webhook spec: - serviceAccountName: lineage-controller-webhook + {{- with .Values.lineageControllerWebhook.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} tolerations: - operator: Exists - affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - preference: - matchExpressions: - - key: node-role.kubernetes.io/control-plane - operator: Exists - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - topologyKey: kubernetes.io/hostname - labelSelector: - matchLabels: - app: lineage-controller-webhook + serviceAccountName: lineage-controller-webhook containers: - name: lineage-controller-webhook image: "{{ .Values.lineageControllerWebhook.image }}" diff --git a/packages/system/lineage-controller-webhook/templates/pdb.yaml b/packages/system/lineage-controller-webhook/templates/pdb.yaml deleted file mode 100644 index 0786c8ff..00000000 --- a/packages/system/lineage-controller-webhook/templates/pdb.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: lineage-controller-webhook -spec: - maxUnavailable: 1 - selector: - matchLabels: - app: lineage-controller-webhook diff --git a/packages/system/lineage-controller-webhook/templates/service.yaml b/packages/system/lineage-controller-webhook/templates/service.yaml index fbb3ad54..c5df90fb 100644 --- a/packages/system/lineage-controller-webhook/templates/service.yaml +++ b/packages/system/lineage-controller-webhook/templates/service.yaml @@ -5,7 +5,7 @@ metadata: labels: app: lineage-controller-webhook spec: - trafficDistribution: PreferClose + internalTrafficPolicy: Local type: ClusterIP ports: - port: 443 diff --git a/packages/system/lineage-controller-webhook/tests/service_test.yaml b/packages/system/lineage-controller-webhook/tests/service_test.yaml deleted file mode 100644 index 3cdbddd8..00000000 --- a/packages/system/lineage-controller-webhook/tests/service_test.yaml +++ /dev/null @@ -1,30 +0,0 @@ -suite: lineage-controller-webhook service -templates: - - templates/service.yaml - -release: - name: lineage-controller-webhook - namespace: cozy-system - -tests: - - it: renders a ClusterIP service on 443 -> 9443 with PreferClose traffic distribution - asserts: - - isKind: - of: Service - - equal: - path: spec.type - value: ClusterIP - - equal: - path: spec.trafficDistribution - value: PreferClose - - notExists: - path: spec.internalTrafficPolicy - - equal: - path: spec.ports[0].port - value: 443 - - equal: - path: spec.ports[0].targetPort - value: 9443 - - equal: - path: spec.selector.app - value: lineage-controller-webhook diff --git a/packages/system/lineage-controller-webhook/tests/workload_test.yaml b/packages/system/lineage-controller-webhook/tests/workload_test.yaml deleted file mode 100644 index bcb24014..00000000 --- a/packages/system/lineage-controller-webhook/tests/workload_test.yaml +++ /dev/null @@ -1,99 +0,0 @@ -suite: lineage-controller-webhook workload + PDB -templates: - - templates/workload.yaml - - templates/pdb.yaml - -release: - name: lineage-controller-webhook - namespace: cozy-system - -tests: - # ---- Default Deployment shape ---------------------------------------------- - - - it: defaults render a 2-replica Deployment with soft control-plane nodeAffinity, soft podAntiAffinity, and Exists tolerations - template: templates/workload.yaml - asserts: - - isKind: - of: Deployment - - equal: - path: spec.replicas - value: 2 - - equal: - path: spec.template.spec.tolerations - value: - - operator: Exists - - equal: - path: spec.template.spec.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution - value: - - weight: 100 - preference: - matchExpressions: - - key: node-role.kubernetes.io/control-plane - operator: Exists - - notExists: - path: spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution - - equal: - path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[0].podAffinityTerm.topologyKey - value: kubernetes.io/hostname - - - it: defaults inject no localK8sAPIEndpoint env vars (knob is opt-in) - template: templates/workload.yaml - asserts: - - notExists: - path: spec.template.spec.containers[0].env - - # ---- PDB -------------------------------------------------------------------- - - - it: PDB renders unconditionally with maxUnavailable=1 at the default replica count - template: templates/pdb.yaml - asserts: - - isKind: - of: PodDisruptionBudget - - equal: - path: spec.maxUnavailable - value: 1 - - notExists: - path: spec.minAvailable - - - it: PDB still renders at replicas=1 (no-op, but consistent shape) - set: - lineageControllerWebhook.replicas: 1 - template: templates/pdb.yaml - asserts: - - isKind: - of: PodDisruptionBudget - - equal: - path: spec.maxUnavailable - value: 1 - - # ---- Replica override ------------------------------------------------------- - - - it: replicas value drives spec.replicas - set: - lineageControllerWebhook.replicas: 5 - template: templates/workload.yaml - asserts: - - equal: - path: spec.replicas - value: 5 - - # ---- Deprecated localK8sAPIEndpoint knob ----------------------------------- - - - it: localK8sAPIEndpoint.enabled=true injects KUBERNETES_SERVICE_HOST and PORT env vars - set: - lineageControllerWebhook.localK8sAPIEndpoint.enabled: true - template: templates/workload.yaml - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: KUBERNETES_SERVICE_HOST - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: status.hostIP - - contains: - path: spec.template.spec.containers[0].env - content: - name: KUBERNETES_SERVICE_PORT - value: "6443" diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml index e56d332d..575ce2dd 100644 --- a/packages/system/lineage-controller-webhook/values.yaml +++ b/packages/system/lineage-controller-webhook/values.yaml @@ -1,13 +1,10 @@ lineageControllerWebhook: - image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0@sha256:e8984709686a5eaf19b89da378d7b8c688ea5607e0783a88d9c9e4ccfca96fb0 + image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.1.7@sha256:bc03f10192158e4e7df3e3b3dfcad646b422245c6d31c6f25637cb6bf2db6e27 debug: false - replicas: 2 - # DEPRECATED. Injects KUBERNETES_SERVICE_HOST=status.hostIP and - # KUBERNETES_SERVICE_PORT=6443 so the webhook talks to the apiserver on its - # own node — only valid when the pod is actually scheduled on an apiserver- - # bearing node. Now that the chart's nodeAffinity to control-plane is soft - # (preferred, not required), the pod can land off-control-plane and crash- - # loop dialing a non-apiserver hostIP. Slated for removal once webhook - # performance work obviates the locality motivation. Leave disabled. localK8sAPIEndpoint: - enabled: false + enabled: true + # nodeSelector for the DaemonSet + # Talos uses empty value: "node-role.kubernetes.io/control-plane": "" + # Generic k8s (k3s, kubeadm) uses: "node-role.kubernetes.io/control-plane": "true" + nodeSelector: + node-role.kubernetes.io/control-plane: "" diff --git a/packages/system/linstor-gui/Chart.yaml b/packages/system/linstor-gui/Chart.yaml deleted file mode 100644 index e361a819..00000000 --- a/packages/system/linstor-gui/Chart.yaml +++ /dev/null @@ -1,3 +0,0 @@ -apiVersion: v2 -name: cozy-linstor-gui -version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process diff --git a/packages/system/linstor-gui/Makefile b/packages/system/linstor-gui/Makefile deleted file mode 100644 index b408491d..00000000 --- a/packages/system/linstor-gui/Makefile +++ /dev/null @@ -1,29 +0,0 @@ -export NAME=linstor-gui -export NAMESPACE=cozy-linstor - -include ../../../hack/common-envs.mk -include ../../../hack/package.mk - -LINSTOR_GUI_VERSION ?= 2.3.0 - -.PHONY: image image-linstor-gui test - -image: image-linstor-gui - -image-linstor-gui: - docker buildx build images/linstor-gui \ - --build-arg LINSTOR_GUI_VERSION=$(LINSTOR_GUI_VERSION) \ - --tag $(REGISTRY)/linstor-gui:$(call settag,$(LINSTOR_GUI_VERSION)) \ - --tag $(REGISTRY)/linstor-gui:$(call settag,$(LINSTOR_GUI_VERSION)-$(TAG)) \ - --cache-from type=registry,ref=$(REGISTRY)/linstor-gui:latest \ - --cache-to type=inline \ - --metadata-file images/linstor-gui.json \ - $(BUILDX_ARGS) - REPOSITORY="$(REGISTRY)/linstor-gui" \ - yq -i '.image.repository = strenv(REPOSITORY)' values.yaml - TAG="$(call settag,$(LINSTOR_GUI_VERSION))@$$(yq e '."containerimage.digest"' images/linstor-gui.json -o json -r)" \ - yq -i '.image.tag = strenv(TAG)' values.yaml - rm -f images/linstor-gui.json - -test: - helm unittest . diff --git a/packages/system/linstor-gui/README.md b/packages/system/linstor-gui/README.md deleted file mode 100644 index 8f8053ab..00000000 --- a/packages/system/linstor-gui/README.md +++ /dev/null @@ -1,64 +0,0 @@ -# linstor-gui - -Cozystack system package for [LINBIT/linstor-gui](https://github.com/LINBIT/linstor-gui) -— a web UI for managing LINSTOR nodes, resources, volumes and snapshots. - -Installed alongside the `linstor` package in the `cozy-linstor` namespace. The UI -proxies the LINSTOR controller REST API at `https://linstor-controller.cozy-linstor.svc:3371` -using mTLS with the `linstor-client-tls` secret created by the `linstor` package. - -## Exposing the UI - -### Option 1 — Keycloak-protected Ingress (recommended) - -The chart ships an `oauth2-proxy` based gatekeeper plus a `KeycloakClient` CRD -so the UI can be published on `linstor-gui.` behind the cluster -Keycloak realm. Access is restricted to members of the -`cozystack-cluster-admin` Keycloak group — the same group that grants -cluster-admin RBAC on the host cluster. Authenticating against the `cozy` -realm alone is not sufficient; users outside that group receive a 403 from -oauth2-proxy before any request reaches the UI or the LINSTOR controller. - -To turn it on, add `linstor-gui` to `publishing.exposedServices` in the core -`cozystack` values (same list that controls `dashboard`). OIDC must be -enabled (`authentication.oidc.enabled: true`) — if it is not, the Ingress and -gatekeeper Deployment are deliberately **not** rendered, because the LINSTOR -REST API surface must not be exposed unauthenticated. - -Once enabled, the UI is reachable at `https://linstor-gui.` and -authentication is delegated to Keycloak via the `linstor-gui` client -(auto-provisioned through the `KeycloakClient` CRD; the client secret is -persisted in the `linstor-gui-client` Secret in `cozy-linstor`). - -### Option 2 — Port-forward - -If you have not set up Keycloak or want ad-hoc access, use the `ClusterIP` -Service: - -```bash -kubectl -n cozy-linstor port-forward svc/linstor-gui 3373:80 -``` - -then open . - -## Parameters - -### Image - -| Name | Description | Value | -| ------------------ | ---------------------------------------------------------- | ----------------------------------------- | -| `image.repository` | LINSTOR GUI container image repository | `ghcr.io/cozystack/cozystack/linstor-gui` | -| `image.tag` | LINSTOR GUI container image tag (digest recommended) | `2.3.0` | - -### Deployment - -| Name | Description | Value | -| ---------- | ------------------------------- | ----- | -| `replicas` | Number of linstor-gui replicas | `1` | - -### LINSTOR controller connection - -| Name | Description | Value | -| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------- | -| `linstor.endpoint` | In-cluster URL of the LINSTOR controller REST API (HTTPS, mTLS) | `https://linstor-controller.cozy-linstor.svc:3371` | -| `linstor.clientSecret` | Kubernetes Secret with `tls.crt`, `tls.key`, `ca.crt` used as the mTLS client certificate against the LINSTOR controller. Created by the `linstor` package. | `linstor-client-tls` | diff --git a/packages/system/linstor-gui/images/linstor-gui/Dockerfile b/packages/system/linstor-gui/images/linstor-gui/Dockerfile deleted file mode 100644 index 2082ef0d..00000000 --- a/packages/system/linstor-gui/images/linstor-gui/Dockerfile +++ /dev/null @@ -1,19 +0,0 @@ -# Upstream: https://github.com/LINBIT/linstor-gui (GPL-3.0) -# Serves the pre-built LINSTOR GUI tarball published by LINBIT from a hardened -# nginx-unprivileged image. nginx.conf is supplied by the chart via ConfigMap, -# so the upstream docker-entrypoint.sh / nginx.conf.template is not used. -FROM nginxinc/nginx-unprivileged:1.29-alpine - -ARG LINSTOR_GUI_VERSION -USER root -RUN apk add --no-cache curl tar && \ - curl -fsSL "https://pkg.linbit.com/downloads/linstor/linstor-gui-${LINSTOR_GUI_VERSION}.tar.gz" -o /tmp/linstor-gui.tar.gz && \ - mkdir -p /usr/share/nginx/html && \ - tar -xzf /tmp/linstor-gui.tar.gz -C /usr/share/nginx/html --strip-components=2 "linstor-gui-${LINSTOR_GUI_VERSION}/dist" && \ - rm -f /tmp/linstor-gui.tar.gz && \ - apk del curl tar && \ - chown -R 101:101 /usr/share/nginx/html - -USER 101 -EXPOSE 3373 -CMD ["nginx", "-g", "daemon off;"] diff --git a/packages/system/linstor-gui/templates/_helpers.tpl b/packages/system/linstor-gui/templates/_helpers.tpl deleted file mode 100644 index 6cad99ee..00000000 --- a/packages/system/linstor-gui/templates/_helpers.tpl +++ /dev/null @@ -1,17 +0,0 @@ -{{/* -Common labels -*/}} -{{- define "linstor-gui.labels" -}} -app.kubernetes.io/name: linstor-gui -app.kubernetes.io/instance: {{ .Release.Name }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -app.kubernetes.io/part-of: cozystack -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "linstor-gui.selectorLabels" -}} -app.kubernetes.io/name: linstor-gui -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} diff --git a/packages/system/linstor-gui/templates/configmap-nginx.yaml b/packages/system/linstor-gui/templates/configmap-nginx.yaml deleted file mode 100644 index 86acd0f7..00000000 --- a/packages/system/linstor-gui/templates/configmap-nginx.yaml +++ /dev/null @@ -1,113 +0,0 @@ -{{/* -Parse the LINSTOR endpoint so nginx can set `proxy_ssl_name` correctly. -The endpoint must be an https:// URL — http:// would downgrade the -mTLS-protected controller path. -*/}} -{{- if not (hasPrefix "https://" .Values.linstor.endpoint) -}} -{{- fail "linstor.endpoint must start with https:// to enforce mTLS to the LINSTOR controller" -}} -{{- end -}} -{{- $endpoint := trimPrefix "https://" .Values.linstor.endpoint -}} -{{- $endpointHost := (splitList ":" $endpoint) | first -}} -apiVersion: v1 -kind: ConfigMap -metadata: - name: linstor-gui-nginx - labels: - {{- include "linstor-gui.labels" . | nindent 4 }} -data: - nginx.conf: | - worker_processes auto; - pid /tmp/nginx.pid; - - events { - worker_connections 1024; - } - - http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - server_tokens off; - - client_body_temp_path /tmp/client_body; - proxy_temp_path /tmp/proxy; - fastcgi_temp_path /tmp/fastcgi; - uwsgi_temp_path /tmp/uwsgi; - scgi_temp_path /tmp/scgi; - - sendfile on; - keepalive_timeout 65; - - server { - listen 3373; - server_name _; - - root /usr/share/nginx/html; - index index.html; - - # Shared proxy + mTLS settings for the LINSTOR controller upstream - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_ssl_certificate /etc/linstor/client/tls.crt; - proxy_ssl_certificate_key /etc/linstor/client/tls.key; - proxy_ssl_trusted_certificate /etc/linstor/client/ca.crt; - proxy_ssl_verify on; - proxy_ssl_verify_depth 2; - proxy_ssl_server_name on; - proxy_ssl_name {{ $endpointHost }}; - - # Static UI assets - location / { - try_files $uri $uri/ /index.html; - } - - # Lock the linstor-gui in-app authentication panel. - # - # Unlike most LINSTOR features, the GUI's "authenticationEnabled" - # toggle and user list are NOT controller-side properties — they - # are persisted as ordinary KeyValueStore instances named - # `__gui__settings` and `__gui__users`. The SPA reads them on - # every page load and, if `authenticationEnabled=true`, gates the - # whole UI behind its own login screen against a self-managed - # admin user. - # - # Cozystack already enforces authentication at the Ingress - # (oauth2-proxy + Keycloak), and the in-app login is a foot-gun: - # if a user enables it and forgets/misconfigures the password, the - # only recovery is shelling into the linstor-controller pod and - # running `linstor key-value-store modify __gui__settings - # authenticationEnabled false`. - # - # We allow GETs (so the SPA can read state and render normally - # with auth=off) but reject every mutating method on those two - # KeyValueStore instances. Any other key-value-store entry the - # GUI uses (e.g. __gui__mode) keeps working as expected. - location ~ ^/v1/key-value-store/__gui__(settings|users)(/|$) { - default_type application/json; - # `if ... return` is the one documented-safe use of `if` in - # nginx (see "If is Evil"), so it's fine here. We allow GET/HEAD - # for the SPA's read path and reject every mutating method. - if ($request_method !~ ^(GET|HEAD)$) { - return 403 '{"ret_code":-1,"message":"linstor-gui in-app authentication is disabled by cozystack: authentication is enforced at the Ingress via Keycloak."}'; - } - proxy_pass {{ .Values.linstor.endpoint }}; - } - - # Proxy LINSTOR REST API over mTLS to the controller - location /v1 { - proxy_pass {{ .Values.linstor.endpoint }}; - } - - location /metrics { - proxy_pass {{ .Values.linstor.endpoint }}; - } - - location = /healthz { - access_log off; - # default_type must come BEFORE `return` — `add_header` after a - # `return` is silently dropped by nginx because the response is - # already finalized. - default_type text/plain; - return 200 'ok'; - } - } - } diff --git a/packages/system/linstor-gui/templates/deployment.yaml b/packages/system/linstor-gui/templates/deployment.yaml deleted file mode 100644 index 92e2f7a6..00000000 --- a/packages/system/linstor-gui/templates/deployment.yaml +++ /dev/null @@ -1,100 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: linstor-gui - labels: - {{- include "linstor-gui.labels" . | nindent 4 }} - annotations: - reloader.stakater.com/auto: "true" -spec: - replicas: {{ .Values.replicas }} - selector: - matchLabels: - {{- include "linstor-gui.selectorLabels" . | nindent 6 }} - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 1 - template: - metadata: - labels: - {{- include "linstor-gui.labels" . | nindent 8 }} - spec: - serviceAccountName: linstor-gui - automountServiceAccountToken: false - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - matchLabels: - {{- include "linstor-gui.selectorLabels" . | nindent 20 }} - topologyKey: kubernetes.io/hostname - containers: - - name: linstor-gui - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 3373 - protocol: TCP - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - cpu: 200m - memory: 128Mi - livenessProbe: - httpGet: - path: /healthz - port: http - initialDelaySeconds: 5 - periodSeconds: 20 - readinessProbe: - httpGet: - path: /healthz - port: http - initialDelaySeconds: 2 - periodSeconds: 10 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 101 - runAsGroup: 101 - capabilities: - drop: - - ALL - volumeMounts: - - name: nginx-config - mountPath: /etc/nginx/nginx.conf - subPath: nginx.conf - readOnly: true - - name: linstor-client-tls - mountPath: /etc/linstor/client - readOnly: true - - name: tmp - mountPath: /tmp - - name: nginx-cache - mountPath: /var/cache/nginx - volumes: - - name: nginx-config - configMap: - name: linstor-gui-nginx - - name: linstor-client-tls - secret: - secretName: {{ .Values.linstor.clientSecret }} - # 0444 so nginx (UID 101) can read the mTLS client keypair; - # the secret volume is pod-local, not a broader disclosure. - defaultMode: 0444 - - name: tmp - emptyDir: {} - - name: nginx-cache - emptyDir: {} diff --git a/packages/system/linstor-gui/templates/gatekeeper-sa.yaml b/packages/system/linstor-gui/templates/gatekeeper-sa.yaml deleted file mode 100644 index d89f68dc..00000000 --- a/packages/system/linstor-gui/templates/gatekeeper-sa.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }} -{{- if eq $oidcEnabled "true" }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: linstor-gui-gatekeeper - labels: - app.kubernetes.io/instance: linstor-gui - app.kubernetes.io/name: gatekeeper - app.kubernetes.io/managed-by: {{ .Release.Service }} - app.kubernetes.io/part-of: cozystack -automountServiceAccountToken: false -{{- end }} diff --git a/packages/system/linstor-gui/templates/gatekeeper-svc.yaml b/packages/system/linstor-gui/templates/gatekeeper-svc.yaml deleted file mode 100644 index 7d50219e..00000000 --- a/packages/system/linstor-gui/templates/gatekeeper-svc.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }} -{{- if eq $oidcEnabled "true" }} -apiVersion: v1 -kind: Service -metadata: - name: linstor-gui-gatekeeper - labels: - app.kubernetes.io/instance: linstor-gui - app.kubernetes.io/name: gatekeeper - app.kubernetes.io/managed-by: {{ .Release.Service }} - app.kubernetes.io/part-of: cozystack -spec: - type: ClusterIP - ports: - - name: ingress - port: 8000 - protocol: TCP - targetPort: 8000 - selector: - app.kubernetes.io/instance: linstor-gui - app.kubernetes.io/name: gatekeeper -{{- end }} diff --git a/packages/system/linstor-gui/templates/gatekeeper.yaml b/packages/system/linstor-gui/templates/gatekeeper.yaml deleted file mode 100644 index 81451f41..00000000 --- a/packages/system/linstor-gui/templates/gatekeeper.yaml +++ /dev/null @@ -1,148 +0,0 @@ -{{- $host := index .Values._cluster "root-host" }} -{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }} -{{- $oidcInsecureSkipVerify := index .Values._cluster "oidc-insecure-skip-verify" }} -{{- $keycloakInternalUrl := index .Values._cluster "keycloak-internal-url" | default "" }} - -{{- /* -Gatekeeper (oauth2-proxy) fronts the linstor-gui Service and handles the -OIDC flow against the cluster Keycloak realm. The Ingress below points at -this Service — not at linstor-gui directly — so every external request -authenticates before hitting nginx/mTLS→controller. - -Only rendered when oidc-enabled=true. If the cluster has OIDC disabled we -deliberately do not ship an unauthenticated token-proxy fallback (unlike -dashboard): linstor-gui surfaces raw storage state and should not be -reachable via Ingress without Keycloak login. - -Access is further restricted to the cozystack-cluster-admin group -(--allowed-group below). The proxy authenticates with a static mTLS client -cert and LINSTOR itself has no per-user RBAC, so group membership is the -only boundary between a realm user and raw storage state. -*/ -}} -{{- if eq $oidcEnabled "true" }} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: linstor-gui-gatekeeper - labels: - app.kubernetes.io/instance: linstor-gui - app.kubernetes.io/name: gatekeeper - app.kubernetes.io/managed-by: {{ .Release.Service }} - app.kubernetes.io/part-of: cozystack - annotations: - reloader.stakater.com/auto: "true" -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/instance: linstor-gui - app.kubernetes.io/name: gatekeeper - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - template: - metadata: - labels: - app.kubernetes.io/instance: linstor-gui - app.kubernetes.io/name: gatekeeper - spec: - serviceAccountName: linstor-gui-gatekeeper - automountServiceAccountToken: false - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/instance: linstor-gui - app.kubernetes.io/name: gatekeeper - topologyKey: kubernetes.io/hostname - containers: - - name: auth-proxy - image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0 - imagePullPolicy: IfNotPresent - args: - - --provider=oidc - - --upstream=http://linstor-gui.{{ .Release.Namespace }}.svc:80 - - --http-address=0.0.0.0:8000 - - --redirect-url=https://linstor-gui.{{ $host }}/oauth2/callback - - --oidc-issuer-url=https://keycloak.{{ $host }}/realms/cozy - {{- if $keycloakInternalUrl }} - - --skip-oidc-discovery - - --login-url=https://keycloak.{{ $host }}/realms/cozy/protocol/openid-connect/auth - - --redeem-url={{ $keycloakInternalUrl }}/protocol/openid-connect/token - - --oidc-jwks-url={{ $keycloakInternalUrl }}/protocol/openid-connect/certs - - --validate-url={{ $keycloakInternalUrl }}/protocol/openid-connect/userinfo - - --backend-logout-url={{ $keycloakInternalUrl }}/protocol/openid-connect/logout?id_token_hint={id_token} - {{- else }} - - --backend-logout-url=https://keycloak.{{ $host }}/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token} - {{- end }} - - --whitelist-domain=keycloak.{{ $host }} - - --email-domain=* - - --pass-access-token=true - - --pass-authorization-header=true - - --cookie-refresh=3m - - --cookie-name=kc-access - - --cookie-secure=true - - --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET) - - --skip-provider-button - - --scope=openid email profile groups offline_access - - --allowed-group=cozystack-cluster-admin - {{- if eq $oidcInsecureSkipVerify "true" }} - - --ssl-insecure-skip-verify=true - {{- end }} - env: - - name: OAUTH2_PROXY_CLIENT_ID - value: linstor-gui - - name: OAUTH2_PROXY_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: linstor-gui-client - key: client-secret-key - - name: OAUTH2_PROXY_COOKIE_SECRET - valueFrom: - secretKeyRef: - name: linstor-gui-auth-config - key: cookieSecret - ports: - - name: proxy - containerPort: 8000 - protocol: TCP - livenessProbe: - httpGet: - path: /ping - port: proxy - initialDelaySeconds: 10 - periodSeconds: 15 - timeoutSeconds: 2 - failureThreshold: 3 - readinessProbe: - httpGet: - path: /ping - port: proxy - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 2 - failureThreshold: 3 - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - cpu: 200m - memory: 256Mi - securityContext: - runAsNonRoot: true - runAsUser: 1001 - runAsGroup: 1001 - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault -{{- end }} diff --git a/packages/system/linstor-gui/templates/ingress.yaml b/packages/system/linstor-gui/templates/ingress.yaml deleted file mode 100644 index c50b0f86..00000000 --- a/packages/system/linstor-gui/templates/ingress.yaml +++ /dev/null @@ -1,54 +0,0 @@ -{{- $solver := (index .Values._cluster "solver") | default "http01" }} -{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }} -{{- $host := index .Values._cluster "root-host" }} -{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }} -{{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }} -{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }} - -{{- /* -Only publish an Ingress when the operator has opted this service in AND -OIDC is enabled cluster-wide. If OIDC is off we deliberately do not -expose linstor-gui: without Keycloak there is no authentication layer in -front of the LINSTOR REST API proxy. Users can still reach the UI via -`kubectl port-forward` to the ClusterIP service. -*/ -}} -{{- if and (has "linstor-gui" $exposeServices) (eq $oidcEnabled "true") }} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: linstor-gui-ingress - labels: - {{- include "linstor-gui.labels" . | nindent 4 }} - annotations: - cert-manager.io/cluster-issuer: {{ $clusterIssuer }} - {{- if eq $solver "http01" }} - acme.cert-manager.io/http01-ingress-ingressclassname: {{ $exposeIngress }} - {{- end }} - nginx.ingress.kubernetes.io/proxy-body-size: 100m - # Keycloak access+refresh+id tokens make the oauth2-proxy session - # cookie ~8–10 KB (split across multiple Set-Cookie headers), which - # overflows the default proxy_buffer_size and causes "upstream sent - # too big header" -> HTTP 502 on /oauth2/callback. Same numbers as - # dashboard ingress. - nginx.ingress.kubernetes.io/proxy-buffer-size: 100m - nginx.ingress.kubernetes.io/proxy-buffers-number: "4" - nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" - nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" -spec: - ingressClassName: {{ $exposeIngress }} - rules: - - host: linstor-gui.{{ $host }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: linstor-gui-gatekeeper - port: - number: 8000 - tls: - - hosts: - - linstor-gui.{{ $host }} - secretName: linstor-gui-ingress-tls -{{- end }} diff --git a/packages/system/linstor-gui/templates/keycloakclient.yaml b/packages/system/linstor-gui/templates/keycloakclient.yaml deleted file mode 100644 index e5dab87b..00000000 --- a/packages/system/linstor-gui/templates/keycloakclient.yaml +++ /dev/null @@ -1,72 +0,0 @@ -{{- $host := index .Values._cluster "root-host" }} - -{{- /* -Persist client + cookie secrets across upgrades: if the Secrets already -exist, reuse their values; otherwise generate new random ones. The -KeycloakClient CRD references the same client secret so Keycloak stays -in sync with what oauth2-proxy reads. -*/ -}} -{{- $existingClientSecret := lookup "v1" "Secret" .Release.Namespace "linstor-gui-client" }} -{{- $clientSecret := "" }} -{{- if $existingClientSecret }} - {{- $clientSecret = index $existingClientSecret.data "client-secret-key" | b64dec }} -{{- else }} - {{- $clientSecret = randAlphaNum 32 }} -{{- end }} - -{{- $existingAuthConfig := lookup "v1" "Secret" .Release.Namespace "linstor-gui-auth-config" }} -{{- $cookieSecret := "" }} -{{- if $existingAuthConfig }} - {{- $cookieSecret = index $existingAuthConfig.data "cookieSecret" | b64dec }} -{{- else }} - {{- $cookieSecret = randAlphaNum 16 }} -{{- end }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: linstor-gui-client - labels: - {{- include "linstor-gui.labels" . | nindent 4 }} -type: Opaque -data: - client-secret-key: {{ $clientSecret | b64enc }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: linstor-gui-auth-config - labels: - {{- include "linstor-gui.labels" . | nindent 4 }} -type: Opaque -data: - cookieSecret: {{ $cookieSecret | b64enc }} -{{- if .Capabilities.APIVersions.Has "v1.edp.epam.com/v1" }} ---- -apiVersion: v1.edp.epam.com/v1 -kind: KeycloakClient -metadata: - name: linstor-gui-client - annotations: - # Re-reconcile the Keycloak client if the random secret regenerates. - secret-hash: {{ $clientSecret | sha256sum }} -spec: - realmRef: - name: keycloakrealm-cozy - kind: ClusterKeycloakRealm - secret: $linstor-gui-client:client-secret-key - advancedProtocolMappers: true - name: linstor-gui - clientId: linstor-gui - directAccess: true - public: false - webUrl: "https://linstor-gui.{{ $host }}" - defaultClientScopes: - - groups - optionalClientScopes: - - offline_access - attributes: - post.logout.redirect.uris: "+" - redirectUris: - - "https://linstor-gui.{{ $host }}/oauth2/callback/*" -{{- end }} diff --git a/packages/system/linstor-gui/templates/service.yaml b/packages/system/linstor-gui/templates/service.yaml deleted file mode 100644 index 66ae2b2d..00000000 --- a/packages/system/linstor-gui/templates/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: linstor-gui - labels: - {{- include "linstor-gui.labels" . | nindent 4 }} -spec: - type: ClusterIP - ports: - - name: http - port: 80 - targetPort: http - protocol: TCP - selector: - {{- include "linstor-gui.selectorLabels" . | nindent 4 }} diff --git a/packages/system/linstor-gui/templates/serviceaccount.yaml b/packages/system/linstor-gui/templates/serviceaccount.yaml deleted file mode 100644 index 8e472671..00000000 --- a/packages/system/linstor-gui/templates/serviceaccount.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: linstor-gui - labels: - {{- include "linstor-gui.labels" . | nindent 4 }} -automountServiceAccountToken: false diff --git a/packages/system/linstor-gui/tests/deployment_test.yaml b/packages/system/linstor-gui/tests/deployment_test.yaml deleted file mode 100644 index 50711eb3..00000000 --- a/packages/system/linstor-gui/tests/deployment_test.yaml +++ /dev/null @@ -1,95 +0,0 @@ -suite: linstor-gui deployment -templates: - - templates/deployment.yaml - - templates/service.yaml - - templates/configmap-nginx.yaml - -tests: - - it: renders a ClusterIP service on port 80 -> http - template: templates/service.yaml - release: - name: linstor-gui - namespace: cozy-linstor - asserts: - - isKind: - of: Service - - equal: - path: spec.type - value: ClusterIP - - equal: - path: spec.ports[0].port - value: 80 - - equal: - path: spec.ports[0].targetPort - value: http - - - it: mounts the LINSTOR client TLS secret into the pod - template: templates/deployment.yaml - release: - name: linstor-gui - namespace: cozy-linstor - asserts: - - isKind: - of: Deployment - - contains: - path: spec.template.spec.volumes - content: - name: linstor-client-tls - secret: - secretName: linstor-client-tls - defaultMode: 0444 - - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: linstor-client-tls - mountPath: /etc/linstor/client - readOnly: true - - - it: runs as a non-root user with a read-only root filesystem - template: templates/deployment.yaml - release: - name: linstor-gui - namespace: cozy-linstor - asserts: - - equal: - path: spec.template.spec.containers[0].securityContext.runAsNonRoot - value: true - - equal: - path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem - value: true - - equal: - path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation - value: false - - - it: proxies /v1 to the configured LINSTOR controller with mTLS - template: templates/configmap-nginx.yaml - release: - name: linstor-gui - namespace: cozy-linstor - asserts: - - isKind: - of: ConfigMap - - matchRegex: - path: data["nginx.conf"] - pattern: "location /v1" - - matchRegex: - path: data["nginx.conf"] - pattern: "proxy_pass https://linstor-controller.cozy-linstor.svc:3371" - - matchRegex: - path: data["nginx.conf"] - pattern: "proxy_ssl_certificate\\s+/etc/linstor/client/tls.crt" - - - it: overrides linstor endpoint and client secret - template: templates/configmap-nginx.yaml - release: - name: linstor-gui - namespace: cozy-linstor - set: - linstor.endpoint: https://my-controller.example.svc:3371 - asserts: - - matchRegex: - path: data["nginx.conf"] - pattern: "proxy_pass https://my-controller.example.svc:3371" - - matchRegex: - path: data["nginx.conf"] - pattern: "proxy_ssl_name my-controller.example.svc" diff --git a/packages/system/linstor-gui/tests/ingress_auth_test.yaml b/packages/system/linstor-gui/tests/ingress_auth_test.yaml deleted file mode 100644 index 2f0b1d73..00000000 --- a/packages/system/linstor-gui/tests/ingress_auth_test.yaml +++ /dev/null @@ -1,177 +0,0 @@ -suite: linstor-gui ingress + keycloak auth -templates: - - templates/ingress.yaml - - templates/gatekeeper.yaml - - templates/gatekeeper-svc.yaml - - templates/gatekeeper-sa.yaml - - templates/keycloakclient.yaml - -release: - name: linstor-gui - namespace: cozy-linstor - -tests: - - it: does not render an Ingress when OIDC is disabled cluster-wide - template: templates/ingress.yaml - set: - _cluster: - root-host: example.org - oidc-enabled: "false" - expose-services: "linstor-gui" - expose-ingress: "tenant-root" - issuer-name: "letsencrypt-prod" - solver: "http01" - asserts: - - hasDocuments: - count: 0 - - - it: does not render an Ingress when linstor-gui is not in expose-services - template: templates/ingress.yaml - set: - _cluster: - root-host: example.org - oidc-enabled: "true" - expose-services: "dashboard,api" - expose-ingress: "tenant-root" - issuer-name: "letsencrypt-prod" - solver: "http01" - asserts: - - hasDocuments: - count: 0 - - - it: renders an Ingress to the gatekeeper service when exposed and OIDC enabled - template: templates/ingress.yaml - set: - _cluster: - root-host: dev10.example.org - oidc-enabled: "true" - expose-services: "dashboard,linstor-gui" - expose-ingress: "tenant-root" - issuer-name: "letsencrypt-prod" - solver: "http01" - asserts: - - isKind: - of: Ingress - - equal: - path: spec.ingressClassName - value: tenant-root - - equal: - path: spec.rules[0].host - value: linstor-gui.dev10.example.org - - equal: - path: spec.rules[0].http.paths[0].backend.service.name - value: linstor-gui-gatekeeper - - equal: - path: spec.rules[0].http.paths[0].backend.service.port.number - value: 8000 - - equal: - path: metadata.annotations["cert-manager.io/cluster-issuer"] - value: letsencrypt-prod - - - it: does not render the gatekeeper Deployment when OIDC is disabled - template: templates/gatekeeper.yaml - set: - _cluster: - root-host: example.org - oidc-enabled: "false" - expose-services: "linstor-gui" - asserts: - - hasDocuments: - count: 0 - - - it: renders an oauth2-proxy Deployment pointing at the cluster Keycloak realm - template: templates/gatekeeper.yaml - set: - _cluster: - root-host: dev10.example.org - oidc-enabled: "true" - oidc-insecure-skip-verify: "false" - keycloak-internal-url: "" - expose-services: "linstor-gui" - asserts: - - isKind: - of: Deployment - - equal: - path: metadata.name - value: linstor-gui-gatekeeper - - matchRegex: - path: spec.template.spec.containers[0].image - pattern: "^quay\\.io/oauth2-proxy/oauth2-proxy:" - - contains: - path: spec.template.spec.containers[0].args - content: --provider=oidc - - contains: - path: spec.template.spec.containers[0].args - content: --upstream=http://linstor-gui.cozy-linstor.svc:80 - - contains: - path: spec.template.spec.containers[0].args - content: --redirect-url=https://linstor-gui.dev10.example.org/oauth2/callback - - contains: - path: spec.template.spec.containers[0].args - content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/cozy - - contains: - path: spec.template.spec.containers[0].args - content: --scope=openid email profile groups offline_access - - contains: - path: spec.template.spec.containers[0].args - content: --allowed-group=cozystack-cluster-admin - - contains: - path: spec.template.spec.containers[0].env - content: - name: OAUTH2_PROXY_CLIENT_ID - value: linstor-gui - - equal: - path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem - value: true - - - it: creates client + cookie Secrets and a KeycloakClient CRD - template: templates/keycloakclient.yaml - capabilities: - apiVersions: - - v1.edp.epam.com/v1 - set: - _cluster: - root-host: dev10.example.org - asserts: - - hasDocuments: - count: 3 - - documentIndex: 0 - isKind: - of: Secret - - documentIndex: 0 - equal: - path: metadata.name - value: linstor-gui-client - - documentIndex: 1 - isKind: - of: Secret - - documentIndex: 1 - equal: - path: metadata.name - value: linstor-gui-auth-config - - documentIndex: 2 - isKind: - of: KeycloakClient - - documentIndex: 2 - equal: - path: spec.clientId - value: linstor-gui - - documentIndex: 2 - contains: - path: spec.redirectUris - content: "https://linstor-gui.dev10.example.org/oauth2/callback/*" - - - it: skips the KeycloakClient CRD when the API is absent, still creates Secrets - template: templates/keycloakclient.yaml - set: - _cluster: - root-host: example.org - asserts: - - hasDocuments: - count: 2 - - documentIndex: 0 - isKind: - of: Secret - - documentIndex: 1 - isKind: - of: Secret diff --git a/packages/system/linstor-gui/values.yaml b/packages/system/linstor-gui/values.yaml deleted file mode 100644 index e3c49aea..00000000 --- a/packages/system/linstor-gui/values.yaml +++ /dev/null @@ -1,17 +0,0 @@ -## @section Image -## @param image.repository LINSTOR GUI container image repository -## @param image.tag LINSTOR GUI container image tag (digest recommended) -image: - repository: ghcr.io/cozystack/cozystack/linstor-gui - tag: 2.3.0 - -## @section Deployment -## @param replicas Number of linstor-gui replicas -replicas: 1 - -## @section LINSTOR controller connection -## @param linstor.endpoint In-cluster URL of the LINSTOR controller REST API (HTTPS, mTLS) -## @param linstor.clientSecret Kubernetes Secret with `tls.crt`, `tls.key`, `ca.crt` used as the mTLS client certificate against the LINSTOR controller. Created by the `linstor` package. -linstor: - endpoint: "https://linstor-controller.cozy-linstor.svc:3371" - clientSecret: "linstor-client-tls" diff --git a/packages/system/linstor-scheduler/Makefile b/packages/system/linstor-scheduler/Makefile index d83a2929..f9986c9a 100644 --- a/packages/system/linstor-scheduler/Makefile +++ b/packages/system/linstor-scheduler/Makefile @@ -3,13 +3,9 @@ export NAMESPACE=cozy-linstor include ../../../hack/package.mk -test: - helm unittest . - update: rm -rf charts helm repo add piraeus-charts https://piraeus.io/helm-charts/ helm repo update piraeus-charts helm pull piraeus-charts/linstor-scheduler --untar --untardir charts patch --no-backup-if-mismatch -p4 < patches/disable-ca-key-rotation.patch - patch --no-backup-if-mismatch -p4 < patches/add-scheduler-component-label.patch diff --git a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml index 289021fd..ea43cb83 100644 --- a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml +++ b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml @@ -20,7 +20,6 @@ spec: {{- end }} labels: {{- include "linstor-scheduler.selectorLabels" . | nindent 8 }} - app.kubernetes.io/component: scheduler spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: diff --git a/packages/system/linstor-scheduler/patches/add-scheduler-component-label.patch b/packages/system/linstor-scheduler/patches/add-scheduler-component-label.patch deleted file mode 100644 index 01eed9a8..00000000 --- a/packages/system/linstor-scheduler/patches/add-scheduler-component-label.patch +++ /dev/null @@ -1,9 +0,0 @@ -diff --git a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml ---- a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml -+++ b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/deployment.yaml -@@ -21,4 +21,5 @@ - labels: - {{- include "linstor-scheduler.selectorLabels" . | nindent 8 }} -+ app.kubernetes.io/component: scheduler - spec: - {{- with .Values.imagePullSecrets }} diff --git a/packages/system/linstor-scheduler/templates/extender-service.yaml b/packages/system/linstor-scheduler/templates/extender-service.yaml deleted file mode 100644 index e8148b43..00000000 --- a/packages/system/linstor-scheduler/templates/extender-service.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{/* - Exposes the linstor-scheduler-extender sidecar (port 8099) as a - cluster-internal Service so that other schedulers (e.g. cozystack-scheduler) - can use it as a scheduler extender. - - The selector labels match the subchart's deployment pods. They are - hardcoded here because the subchart helpers expect a subchart rendering - context that is unavailable in the wrapper chart. -*/}} -apiVersion: v1 -kind: Service -metadata: - name: linstor-scheduler-extender - labels: - app.kubernetes.io/component: extender -spec: - type: ClusterIP - ports: - - port: 8099 - targetPort: 8099 - protocol: TCP - name: http - selector: - app.kubernetes.io/name: linstor-scheduler - app.kubernetes.io/instance: linstor-scheduler - app.kubernetes.io/component: scheduler diff --git a/packages/system/linstor-scheduler/tests/extender-service_test.yaml b/packages/system/linstor-scheduler/tests/extender-service_test.yaml deleted file mode 100644 index 60e272c2..00000000 --- a/packages/system/linstor-scheduler/tests/extender-service_test.yaml +++ /dev/null @@ -1,35 +0,0 @@ -suite: extender service targets deployment pods - -templates: - - templates/extender-service.yaml - - charts/linstor-scheduler/templates/deployment.yaml - -release: - name: linstor-scheduler - -tests: - - it: service selector matches deployment pod labels - template: charts/linstor-scheduler/templates/deployment.yaml - asserts: - - equal: - path: spec.template.metadata.labels["app.kubernetes.io/name"] - value: linstor-scheduler - - equal: - path: spec.template.metadata.labels["app.kubernetes.io/instance"] - value: linstor-scheduler - - equal: - path: spec.template.metadata.labels["app.kubernetes.io/component"] - value: scheduler - - - it: service selector uses the same values - template: templates/extender-service.yaml - asserts: - - equal: - path: spec.selector["app.kubernetes.io/name"] - value: linstor-scheduler - - equal: - path: spec.selector["app.kubernetes.io/instance"] - value: linstor-scheduler - - equal: - path: spec.selector["app.kubernetes.io/component"] - value: scheduler diff --git a/packages/system/linstor/Makefile b/packages/system/linstor/Makefile index 8d566678..b211baec 100644 --- a/packages/system/linstor/Makefile +++ b/packages/system/linstor/Makefile @@ -4,8 +4,8 @@ export NAMESPACE=cozy-$(NAME) include ../../../hack/common-envs.mk include ../../../hack/package.mk -LINSTOR_VERSION ?= 1.33.2 -LINSTOR_CSI_VERSION ?= v1.10.6 +LINSTOR_VERSION ?= 1.32.3 +LINSTOR_CSI_VERSION ?= v1.10.5 image: image-piraeus-server image-linstor-csi diff --git a/packages/system/linstor/images/linstor-csi/Dockerfile b/packages/system/linstor/images/linstor-csi/Dockerfile index df5d179d..6cfd44aa 100644 --- a/packages/system/linstor/images/linstor-csi/Dockerfile +++ b/packages/system/linstor/images/linstor-csi/Dockerfile @@ -1,6 +1,6 @@ FROM golang:1.25 AS builder -ARG VERSION=v1.10.6 +ARG VERSION=v1.10.5 ARG LINSTOR_WAIT_UNTIL_VERSION=v0.3.1 ARG TARGETARCH ARG TARGETOS diff --git a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff deleted file mode 100644 index 0e272670..00000000 --- a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff +++ /dev/null @@ -1,308 +0,0 @@ -diff --git a/pkg/client/linstor.go b/pkg/client/linstor.go -index ac4651d..46d565d 100644 ---- a/pkg/client/linstor.go -+++ b/pkg/client/linstor.go -@@ -462,6 +462,14 @@ func (s *Linstor) Clone(ctx context.Context, vol, src *volume.Info, params *volu - return err - } - -+ if params.RelocateAfterClone { -+ logger.Debug("relocate resources to optimal nodes") -+ -+ if err := s.relocateResources(ctx, vol.ID, rGroup.Name); err != nil { -+ logger.WithError(err).Warn("resource relocation failed, volume is still usable") -+ } -+ } -+ - logger.Debug("reconcile extra properties") - - err = s.client.ResourceDefinitions.Modify(ctx, vol.ID, lapi.GenericPropsModify{OverrideProps: vol.Properties}) -@@ -1297,6 +1305,14 @@ func (s *Linstor) VolFromSnap(ctx context.Context, snap *volume.Snapshot, vol *v - return err - } - -+ if snapParams != nil && snapParams.RelocateAfterRestore { -+ logger.Debug("relocate resources to optimal nodes") -+ -+ if err := s.relocateResources(ctx, vol.ID, rGroup.Name); err != nil { -+ logger.WithError(err).Warn("resource relocation failed, volume is still usable") -+ } -+ } -+ - logger.Debug("reconcile extra properties") - - err = s.client.ResourceDefinitions.Modify(ctx, vol.ID, lapi.GenericPropsModify{OverrideProps: vol.Properties}) -@@ -1487,9 +1503,8 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu - return fmt.Errorf("snapshot '%s' not deployed on any node", snap.Name) - } - -- // Optimize the node we use to restore. It should be one of the preferred nodes, or just the first with a snapshot -- // if no preferred nodes match. -- var selectedNode string -+ // Collect available snapshot nodes, preferring those matching the topology hints. -+ var preferred, available []string - for _, snapNode := range snap.Nodes { - if err := s.NodeAvailable(ctx, snapNode); err != nil { - logger.WithField("selected node candidate", snapNode).WithError(err).Debug("node is not available") -@@ -1497,13 +1512,23 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu - } - - if slices.Contains(preferredNodes, snapNode) { -- // We found a perfect candidate. -- selectedNode = snapNode -- break -- } else if selectedNode == "" { -- // Set a fallback if we have no candidate yet. -- selectedNode = snapNode -+ preferred = append(preferred, snapNode) - } -+ -+ available = append(available, snapNode) -+ } -+ -+ // Pick a random node from preferred candidates, falling back to any available node. -+ // Randomization distributes restore load across snapshot nodes, preventing all -+ // clones of the same source from concentrating on a single node. -+ candidates := preferred -+ if len(candidates) == 0 { -+ candidates = available -+ } -+ -+ var selectedNode string -+ if len(candidates) > 0 { -+ selectedNode = candidates[rand.Intn(len(candidates))] - } - - if selectedNode == "" { -@@ -1696,6 +1721,114 @@ func (s *Linstor) reconcileResourcePlacement(ctx context.Context, vol *volume.In - return nil - } - -+const propertyRelocationTriggered = "Aux/csi-relocation-triggered" -+ -+// relocateResources migrates replicas from their current nodes to the nodes that -+// LINSTOR's autoplacer considers optimal. This is a best-effort, fire-and-forget -+// operation: migrate-disk API is asynchronous and the volume remains usable on its -+// current nodes even if relocation fails. -+func (s *Linstor) relocateResources(ctx context.Context, volID, rgName string) error { -+ logger := s.log.WithFields(logrus.Fields{ -+ "volume": volID, -+ "resourceGroup": rgName, -+ }) -+ -+ // Check if relocation was already triggered (idempotency guard). -+ rd, err := s.client.ResourceDefinitions.Get(ctx, volID) -+ if err != nil { -+ return fmt.Errorf("failed to get resource definition: %w", err) -+ } -+ -+ if rd.Props[propertyRelocationTriggered] != "" { -+ logger.Debug("relocation already triggered, skipping") -+ return nil -+ } -+ -+ // Get current diskful nodes. -+ resources, err := s.client.Resources.GetAll(ctx, volID) -+ if err != nil { -+ return fmt.Errorf("failed to list resources: %w", err) -+ } -+ -+ currentNodes := util.DeployedDiskfullyNodes(resources) -+ -+ // Query optimal placement from LINSTOR autoplacer. -+ sizeInfo, err := s.client.ResourceGroups.QuerySizeInfo(ctx, rgName, lapi.QuerySizeInfoRequest{}) -+ if err != nil { -+ return fmt.Errorf("failed to query size info: %w", err) -+ } -+ -+ if sizeInfo.SpaceInfo == nil || len(sizeInfo.SpaceInfo.NextSpawnResult) == 0 { -+ logger.Debug("no spawn result from query-size-info, skipping relocation") -+ return nil -+ } -+ -+ // Build a map of optimal node -> storage pool. -+ optimalPools := make(map[string]string, len(sizeInfo.SpaceInfo.NextSpawnResult)) -+ for _, r := range sizeInfo.SpaceInfo.NextSpawnResult { -+ optimalPools[r.NodeName] = r.StorPoolName -+ } -+ -+ // Compute nodes to remove (current but not optimal) and nodes to add (optimal but not current). -+ var nodesToRemove, nodesToAdd []string -+ -+ for _, node := range currentNodes { -+ if _, ok := optimalPools[node]; !ok { -+ nodesToRemove = append(nodesToRemove, node) -+ } -+ } -+ -+ for _, r := range sizeInfo.SpaceInfo.NextSpawnResult { -+ if !slices.Contains(currentNodes, r.NodeName) { -+ nodesToAdd = append(nodesToAdd, r.NodeName) -+ } -+ } -+ -+ // Only migrate min(remove, add) pairs. -+ pairs := min(len(nodesToRemove), len(nodesToAdd)) -+ if pairs == 0 { -+ logger.Debug("no relocation needed, placement is already optimal") -+ return nil -+ } -+ -+ logger.Infof("relocating %d replica(s): %v -> %v", pairs, nodesToRemove[:pairs], nodesToAdd[:pairs]) -+ -+ // Mark relocation as triggered before starting migrations. -+ err = s.client.ResourceDefinitions.Modify(ctx, volID, lapi.GenericPropsModify{ -+ OverrideProps: map[string]string{propertyRelocationTriggered: "true"}, -+ }) -+ if err != nil { -+ return fmt.Errorf("failed to set relocation property: %w", err) -+ } -+ -+ // Migrate each pair sequentially (LINSTOR serializes at the RD level anyway). -+ for i := range pairs { -+ fromNode := nodesToRemove[i] -+ toNode := nodesToAdd[i] -+ storPool := optimalPools[toNode] -+ -+ logger := logger.WithFields(logrus.Fields{"from": fromNode, "to": toNode, "storagePool": storPool}) -+ -+ logger.Info("creating diskless resource on target node") -+ -+ err := s.client.Resources.MakeAvailable(ctx, volID, toNode, lapi.ResourceMakeAvailable{}) -+ if err != nil { -+ logger.WithError(err).Warn("failed to create diskless on target, skipping this pair") -+ continue -+ } -+ -+ logger.Info("initiating migrate-disk") -+ -+ err = s.client.Resources.Migrate(ctx, volID, fromNode, toNode, storPool) -+ if err != nil { -+ logger.WithError(err).Warn("migrate-disk failed, skipping this pair") -+ continue -+ } -+ } -+ -+ return nil -+} -+ - // FindSnapsByID searches the snapshot in the backend - func (s *Linstor) FindSnapsByID(ctx context.Context, id string) ([]*volume.Snapshot, error) { - snapshotId, err := volume.ParseSnapshotId(id) -diff --git a/pkg/volume/parameter.go b/pkg/volume/parameter.go -index 39acd95..54d1dfb 100644 ---- a/pkg/volume/parameter.go -+++ b/pkg/volume/parameter.go -@@ -50,6 +50,7 @@ const ( - nfsservicename - nfssquash - nfsrecoveryvolumesize -+ relocateafterclone - ) - - // Parameters configuration for linstor volumes. -@@ -118,6 +119,8 @@ type Parameters struct { - // NfsRecoveryVolumeSize sets the volume size (in bytes) of the recovery volume used by the NFS server. - // Defaults to 300MiB. - NfsRecoveryVolumeBytes int64 -+ // RelocateAfterClone triggers asynchronous relocation of replicas to optimal nodes after cloning. -+ RelocateAfterClone bool - } - - const DefaultDisklessStoragePoolName = "DfltDisklessStorPool" -@@ -140,6 +143,7 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters, - NfsServiceName: "linstor-csi-nfs", - NfsSquash: "no_root_squash", - NfsRecoveryVolumeBytes: 300 * 1024 * 1024, -+ RelocateAfterClone: true, - } - - for k, v := range params { -@@ -287,6 +291,13 @@ func NewParameters(params map[string]string, topologyPrefix string) (Parameters, - } - - p.NfsRecoveryVolumeBytes = s.Value() -+ case relocateafterclone: -+ val, err := strconv.ParseBool(v) -+ if err != nil { -+ return p, err -+ } -+ -+ p.RelocateAfterClone = val - } - } - -diff --git a/pkg/volume/paramkey_enumer.go b/pkg/volume/paramkey_enumer.go -index 5474963..2eb8a7c 100644 ---- a/pkg/volume/paramkey_enumer.go -+++ b/pkg/volume/paramkey_enumer.go -@@ -7,11 +7,11 @@ import ( - "strings" - ) - --const _paramKeyName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesize" -+const _paramKeyName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesizerelocateafterclone" - --var _paramKeyIndex = [...]uint16{0, 23, 32, 42, 61, 80, 99, 109, 115, 124, 133, 141, 155, 170, 189, 203, 210, 221, 237, 250, 260, 273, 293, 310, 324, 333, 354} -+var _paramKeyIndex = [...]uint16{0, 23, 32, 42, 61, 80, 99, 109, 115, 124, 133, 141, 155, 170, 189, 203, 210, 221, 237, 250, 260, 273, 293, 310, 324, 333, 354, 372} - --const _paramKeyLowerName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesize" -+const _paramKeyLowerName = "allowremotevolumeaccessautoplaceclientlistdisklessonremainingdisklessstoragepooldonotplacewithregexencryptionfsoptslayerlistmountoptsnodelistplacementcountplacementpolicyreplicasondifferentreplicasonsamesizekibstoragepoolpostmountxfsoptsresourcegroupusepvcnameoverprovisionxreplicasondifferentnfsconfigtemplatenfsservicenamenfssquashnfsrecoveryvolumesizerelocateafterclone" - - func (i paramKey) String() string { - if i < 0 || i >= paramKey(len(_paramKeyIndex)-1) { -@@ -50,9 +50,10 @@ func _paramKeyNoOp() { - _ = x[nfsservicename-(23)] - _ = x[nfssquash-(24)] - _ = x[nfsrecoveryvolumesize-(25)] -+ _ = x[relocateafterclone-(26)] - } - --var _paramKeyValues = []paramKey{allowremotevolumeaccess, autoplace, clientlist, disklessonremaining, disklessstoragepool, donotplacewithregex, encryption, fsopts, layerlist, mountopts, nodelist, placementcount, placementpolicy, replicasondifferent, replicasonsame, sizekib, storagepool, postmountxfsopts, resourcegroup, usepvcname, overprovision, xreplicasondifferent, nfsconfigtemplate, nfsservicename, nfssquash, nfsrecoveryvolumesize} -+var _paramKeyValues = []paramKey{allowremotevolumeaccess, autoplace, clientlist, disklessonremaining, disklessstoragepool, donotplacewithregex, encryption, fsopts, layerlist, mountopts, nodelist, placementcount, placementpolicy, replicasondifferent, replicasonsame, sizekib, storagepool, postmountxfsopts, resourcegroup, usepvcname, overprovision, xreplicasondifferent, nfsconfigtemplate, nfsservicename, nfssquash, nfsrecoveryvolumesize, relocateafterclone} - - var _paramKeyNameToValueMap = map[string]paramKey{ - _paramKeyName[0:23]: allowremotevolumeaccess, -@@ -107,6 +108,8 @@ var _paramKeyNameToValueMap = map[string]paramKey{ - _paramKeyLowerName[324:333]: nfssquash, - _paramKeyName[333:354]: nfsrecoveryvolumesize, - _paramKeyLowerName[333:354]: nfsrecoveryvolumesize, -+ _paramKeyName[354:372]: relocateafterclone, -+ _paramKeyLowerName[354:372]: relocateafterclone, - } - - var _paramKeyNames = []string{ -@@ -136,6 +139,7 @@ var _paramKeyNames = []string{ - _paramKeyName[310:324], - _paramKeyName[324:333], - _paramKeyName[333:354], -+ _paramKeyName[354:372], - } - - // paramKeyString retrieves an enum value from the enum constants string name. -diff --git a/pkg/volume/snapshot_params.go b/pkg/volume/snapshot_params.go -index d167cb8..50b70fb 100644 ---- a/pkg/volume/snapshot_params.go -+++ b/pkg/volume/snapshot_params.go -@@ -35,6 +35,7 @@ type SnapshotParameters struct { - LinstorTargetUrl string `json:"linstor-target-url,omitempty"` - LinstorTargetClusterID string `json:"linstor-target-cluster-id,omitempty"` - LinstorTargetStoragePool string `json:"linstor-target-storage-pool,omitempty"` -+ RelocateAfterRestore bool `json:"relocate-after-restore,omitempty"` - } - - func NewSnapshotParameters(params, secrets map[string]string) (*SnapshotParameters, error) { -@@ -91,6 +92,13 @@ func NewSnapshotParameters(params, secrets map[string]string) (*SnapshotParamete - p.LinstorTargetClusterID = v - case "/linstor-target-storage-pool": - p.LinstorTargetStoragePool = v -+ case "/relocateAfterRestore": -+ b, err := strconv.ParseBool(v) -+ if err != nil { -+ return nil, err -+ } -+ -+ p.RelocateAfterRestore = b - default: - log.WithField("key", k).Warn("ignoring unknown snapshot parameter key") - } diff --git a/packages/system/linstor/images/linstor-csi/patches/001-rwx-validation.diff b/packages/system/linstor/images/linstor-csi/patches/001-rwx-validation.diff new file mode 100644 index 00000000..7da0f137 --- /dev/null +++ b/packages/system/linstor/images/linstor-csi/patches/001-rwx-validation.diff @@ -0,0 +1,718 @@ +diff --git a/cmd/linstor-csi/linstor-csi.go b/cmd/linstor-csi/linstor-csi.go +index 143f6cee..bd28e06e 100644 +--- a/cmd/linstor-csi/linstor-csi.go ++++ b/cmd/linstor-csi/linstor-csi.go +@@ -41,22 +41,23 @@ import ( + + func main() { + var ( +- lsEndpoint = flag.String("linstor-endpoint", "", "Controller API endpoint for LINSTOR") +- lsSkipTLSVerification = flag.Bool("linstor-skip-tls-verification", false, "If true, do not verify tls") +- csiEndpoint = flag.String("csi-endpoint", "unix:///var/lib/kubelet/plugins/linstor.csi.linbit.com/csi.sock", "CSI endpoint") +- node = flag.String("node", "", "Node ID to pass to node service") +- logLevel = flag.String("log-level", "info", "Enable debug log output. Choose from: panic, fatal, error, warn, info, debug") +- rps = flag.Float64("linstor-api-requests-per-second", 0, "Maximum allowed number of LINSTOR API requests per second. Default: Unlimited") +- burst = flag.Int("linstor-api-burst", 1, "Maximum number of API requests allowed before being limited by requests-per-second. Default: 1 (no bursting)") +- bearerTokenFile = flag.String("bearer-token", "", "Read the bearer token from the given file and use it for authentication.") +- propNs = flag.String("property-namespace", linstor.NamespcAuxiliary, "Limit the reported topology keys to properties from the given namespace.") +- labelBySP = flag.Bool("label-by-storage-pool", true, "Set to false to disable labeling of nodes based on their configured storage pools.") +- nodeCacheTimeout = flag.Duration("node-cache-timeout", 1*time.Minute, "Duration for which the results of node and storage pool related API responses should be cached.") +- resourceCacheTimeout = flag.Duration("resource-cache-timeout", 30*time.Second, "Duration for which the results of resource related API responses should be cached.") +- resyncAfter = flag.Duration("resync-after", 5*time.Minute, "Duration after which reconciliations (such as for VolumeSnapshotClasses) should be rerun. Set to 0 to disable.") +- enableRWX = flag.Bool("enable-rwx", false, "Enable RWX support via NFS (requires running in Kubernetes).") +- namespace = flag.String("nfs-service-namespace", "", "The namespace the NFS service is running in.") +- reactorConfigMapName = flag.String("nfs-reactor-config-map-name", "linstor-csi-nfs-reactor-config", "Name of the config map used to store promoter configuration") ++ lsEndpoint = flag.String("linstor-endpoint", "", "Controller API endpoint for LINSTOR") ++ lsSkipTLSVerification = flag.Bool("linstor-skip-tls-verification", false, "If true, do not verify tls") ++ csiEndpoint = flag.String("csi-endpoint", "unix:///var/lib/kubelet/plugins/linstor.csi.linbit.com/csi.sock", "CSI endpoint") ++ node = flag.String("node", "", "Node ID to pass to node service") ++ logLevel = flag.String("log-level", "info", "Enable debug log output. Choose from: panic, fatal, error, warn, info, debug") ++ rps = flag.Float64("linstor-api-requests-per-second", 0, "Maximum allowed number of LINSTOR API requests per second. Default: Unlimited") ++ burst = flag.Int("linstor-api-burst", 1, "Maximum number of API requests allowed before being limited by requests-per-second. Default: 1 (no bursting)") ++ bearerTokenFile = flag.String("bearer-token", "", "Read the bearer token from the given file and use it for authentication.") ++ propNs = flag.String("property-namespace", linstor.NamespcAuxiliary, "Limit the reported topology keys to properties from the given namespace.") ++ labelBySP = flag.Bool("label-by-storage-pool", true, "Set to false to disable labeling of nodes based on their configured storage pools.") ++ nodeCacheTimeout = flag.Duration("node-cache-timeout", 1*time.Minute, "Duration for which the results of node and storage pool related API responses should be cached.") ++ resourceCacheTimeout = flag.Duration("resource-cache-timeout", 30*time.Second, "Duration for which the results of resource related API responses should be cached.") ++ resyncAfter = flag.Duration("resync-after", 5*time.Minute, "Duration after which reconciliations (such as for VolumeSnapshotClasses) should be rerun. Set to 0 to disable.") ++ enableRWX = flag.Bool("enable-rwx", false, "Enable RWX support via NFS (requires running in Kubernetes).") ++ namespace = flag.String("nfs-service-namespace", "", "The namespace the NFS service is running in.") ++ reactorConfigMapName = flag.String("nfs-reactor-config-map-name", "linstor-csi-nfs-reactor-config", "Name of the config map used to store promoter configuration") ++ disableRWXBlockValidation = flag.Bool("disable-rwx-block-validation", false, "Disable KubeVirt VM ownership validation for RWX block volumes.") + ) + + flag.Var(&volume.DefaultRemoteAccessPolicy, "default-remote-access-policy", "") +@@ -169,6 +170,10 @@ func main() { + opts = append(opts, driver.ConfigureRWX(*namespace, *reactorConfigMapName)) + } + ++ if *disableRWXBlockValidation { ++ opts = append(opts, driver.DisableRWXBlockValidation()) ++ } ++ + drv, err := driver.NewDriver(opts...) + if err != nil { + log.Fatal(err) +diff --git a/pkg/driver/driver.go b/pkg/driver/driver.go +index bea69a8b..a39674b6 100644 +--- a/pkg/driver/driver.go ++++ b/pkg/driver/driver.go +@@ -83,6 +83,8 @@ type Driver struct { + topologyPrefix string + // resyncAfter is the interval after which reconciliations should be retried + resyncAfter time.Duration ++ // disableRWXBlockValidation disables KubeVirt VM ownership validation for RWX block volumes ++ disableRWXBlockValidation bool + + // Embed for forward compatibility. + csi.UnimplementedIdentityServer +@@ -300,6 +302,17 @@ func ResyncAfter(resyncAfter time.Duration) func(*Driver) error { + } + } + ++// DisableRWXBlockValidation disables the KubeVirt VM ownership validation for RWX block volumes. ++// When disabled, the driver will not check if multiple pods using the same RWX block volume ++// belong to the same VM. This may be needed in environments where the validation causes issues ++// or when using RWX block volumes outside of KubeVirt. ++func DisableRWXBlockValidation() func(*Driver) error { ++ return func(d *Driver) error { ++ d.disableRWXBlockValidation = true ++ return nil ++ } ++} ++ + // GetPluginInfo https://github.com/container-storage-interface/spec/blob/v1.9.0/spec.md#getplugininfo + func (d Driver) GetPluginInfo(ctx context.Context, req *csi.GetPluginInfoRequest) (*csi.GetPluginInfoResponse, error) { + return &csi.GetPluginInfoResponse{ +@@ -751,6 +764,14 @@ func (d Driver) ControllerPublishVolume(ctx context.Context, req *csi.Controller + // ReadWriteMany block volume + rwxBlock := req.VolumeCapability.AccessMode.GetMode() == csi.VolumeCapability_AccessMode_MULTI_NODE_MULTI_WRITER && req.VolumeCapability.GetBlock() != nil + ++ // Validate RWX block attachment to prevent misuse of allow-two-primaries ++ if rwxBlock && !d.disableRWXBlockValidation { ++ if _, err := utils.ValidateRWXBlockAttachment(ctx, d.kubeClient, d.log, req.GetVolumeId()); err != nil { ++ return nil, status.Errorf(codes.FailedPrecondition, ++ "ControllerPublishVolume failed for %s: %v", req.GetVolumeId(), err) ++ } ++ } ++ + devPath, err := d.Assignments.Attach(ctx, req.GetVolumeId(), req.GetNodeId(), rwxBlock) + if err != nil { + return nil, status.Errorf(codes.Internal, +diff --git a/pkg/utils/rwx_validation.go b/pkg/utils/rwx_validation.go +new file mode 100644 +index 00000000..9fe82768 +--- /dev/null ++++ b/pkg/utils/rwx_validation.go +@@ -0,0 +1,263 @@ ++/* ++CSI Driver for Linstor ++Copyright © 2018 LINBIT USA, LLC ++ ++This program is free software; you can redistribute it and/or modify ++it under the terms of the GNU General Public License as published by ++the Free Software Foundation; either version 2 of the License, or ++(at your option) any later version. ++ ++This program is distributed in the hope that it will be useful, ++but WITHOUT ANY WARRANTY; without even the implied warranty of ++MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++GNU General Public License for more details. ++ ++You should have received a copy of the GNU General Public License ++along with this program; if not, see . ++*/ ++ ++package utils ++ ++import ( ++ "context" ++ "fmt" ++ ++ "github.com/sirupsen/logrus" ++ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ++ "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" ++ "k8s.io/apimachinery/pkg/runtime/schema" ++ "k8s.io/client-go/dynamic" ++) ++ ++// KubeVirtVMLabel is the label that KubeVirt adds to pods to identify the VM they belong to. ++const KubeVirtVMLabel = "vm.kubevirt.io/name" ++ ++// KubeVirtHotplugDiskLabel is the label that KubeVirt adds to hotplug disk pods. ++const KubeVirtHotplugDiskLabel = "kubevirt.io" ++ ++// PodGVR is the GroupVersionResource for pods. ++var PodGVR = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"} ++ ++// PVGVR is the GroupVersionResource for persistent volumes. ++var PVGVR = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "persistentvolumes"} ++ ++// ValidateRWXBlockAttachment checks that RWX block volumes are only used by pods belonging to the same VM. ++// This prevents misuse of allow-two-primaries while still permitting live migration. ++// Returns the VM name if validation passes, or an error if: ++// - Multiple pods from different VMs are trying to use the same volume ++// - A pod without the KubeVirt VM label is trying to use a volume already attached elsewhere (strict mode) ++// Returns empty string for VM name when no pods are using the volume or validation is skipped. ++func ValidateRWXBlockAttachment(ctx context.Context, kubeClient dynamic.Interface, log *logrus.Entry, volumeID string) (string, error) { ++ log.WithField("volumeID", volumeID).Info("validateRWXBlockAttachment called") ++ ++ if kubeClient == nil { ++ // Not running in Kubernetes, skip validation ++ log.Warn("validateRWXBlockAttachment: kubeClient is nil, skipping validation") ++ return "", nil ++ } ++ ++ // Get PV to find PVC reference ++ pv, err := kubeClient.Resource(PVGVR).Get(ctx, volumeID, metav1.GetOptions{}) ++ if err != nil { ++ log.WithError(err).Warn("cannot validate RWX attachment: failed to get PV") ++ return "", nil ++ } ++ ++ // Verify that PV's volumeHandle matches the volumeID ++ volumeHandle, found, err := unstructured.NestedString(pv.Object, "spec", "csi", "volumeHandle") ++ if err != nil { ++ log.WithError(err).Warnf("cannot validate RWX attachment: failed to read volumeHandle for PV %s", volumeID) ++ ++ return "", nil ++ } ++ ++ if !found { ++ log.Warnf("cannot validate RWX attachment: volumeHandle not found for PV %s", volumeID) ++ ++ return "", nil ++ } ++ ++ if volumeHandle != volumeID { ++ log.WithFields(logrus.Fields{ ++ "volumeID": volumeID, ++ "volumeHandle": volumeHandle, ++ }).Warn("cannot validate RWX attachment: PV volumeHandle does not match volumeID") ++ ++ return "", nil ++ } ++ ++ // Extract claimRef from PV ++ claimRef, found, _ := unstructured.NestedMap(pv.Object, "spec", "claimRef") ++ if !found { ++ log.Warn("cannot validate RWX attachment: PV has no claimRef") ++ return "", nil ++ } ++ ++ pvcName, _, _ := unstructured.NestedString(claimRef, "name") ++ pvcNamespace, _, _ := unstructured.NestedString(claimRef, "namespace") ++ ++ if pvcNamespace == "" || pvcName == "" { ++ log.Warn("cannot validate RWX attachment: PVC name or namespace is empty in claimRef") ++ return "", nil ++ } ++ ++ // List all pods in the namespace ++ podList, err := kubeClient.Resource(PodGVR).Namespace(pvcNamespace).List(ctx, metav1.ListOptions{}) ++ if err != nil { ++ return "", fmt.Errorf("failed to list pods in namespace %s: %w", pvcNamespace, err) ++ } ++ ++ // Filter pods that use this PVC and are in a running/pending state ++ type podInfo struct { ++ name string ++ vmName string ++ } ++ ++ var podsUsingPVC []podInfo ++ ++ for _, item := range podList.Items { ++ // Get pod phase from status ++ phase, _, _ := unstructured.NestedString(item.Object, "status", "phase") ++ if phase == "Succeeded" || phase == "Failed" { ++ continue ++ } ++ ++ // Check if pod uses the PVC ++ volumes, found, _ := unstructured.NestedSlice(item.Object, "spec", "volumes") ++ if !found { ++ continue ++ } ++ ++ for _, vol := range volumes { ++ volMap, ok := vol.(map[string]interface{}) ++ if !ok { ++ continue ++ } ++ ++ claimName, found, _ := unstructured.NestedString(volMap, "persistentVolumeClaim", "claimName") ++ if !found || claimName != pvcName { ++ continue ++ } ++ ++ // Extract VM name, handling both regular and hotplug disk pods ++ vmName, err := GetVMNameFromPod(ctx, kubeClient, log, &item) ++ if err != nil { ++ log.WithError(err).WithField("pod", item.GetName()).Warn("failed to get VM name from pod") ++ // Continue with empty vmName - will be caught by strict mode check ++ vmName = "" ++ } ++ ++ podsUsingPVC = append(podsUsingPVC, podInfo{ ++ name: item.GetName(), ++ vmName: vmName, ++ }) ++ ++ break ++ } ++ } ++ ++ // If 0 or 1 pod uses the PVC, no conflict possible ++ if len(podsUsingPVC) <= 1 { ++ // Return VM name if there's exactly one pod ++ if len(podsUsingPVC) == 1 { ++ log.WithFields(logrus.Fields{ ++ "volumeID": volumeID, ++ "vmName": podsUsingPVC[0].vmName, ++ "podCount": 1, ++ "pvcNamespace": pvcNamespace, ++ "pvcName": pvcName, ++ }).Info("validateRWXBlockAttachment: single pod found, returning VM name") ++ ++ return podsUsingPVC[0].vmName, nil ++ } ++ ++ log.WithFields(logrus.Fields{ ++ "volumeID": volumeID, ++ "pvcNamespace": pvcNamespace, ++ "pvcName": pvcName, ++ }).Info("validateRWXBlockAttachment: no pods found using PVC") ++ ++ return "", nil ++ } ++ ++ // Check that all pods belong to the same VM ++ var vmName string ++ for _, pod := range podsUsingPVC { ++ if pod.vmName == "" { ++ // Strict mode: if any pod doesn't have the KubeVirt label and there are multiple pods, ++ // deny the attachment ++ return "", fmt.Errorf("RWX block volume %s/%s is used by multiple pods but pod %s does not have the %s label; "+ ++ "RWX block volumes with allow-two-primaries are only supported for KubeVirt live migration", ++ pvcNamespace, pvcName, pod.name, KubeVirtVMLabel) ++ } ++ ++ if vmName == "" { ++ vmName = pod.vmName ++ } else if vmName != pod.vmName { ++ // Different VMs are trying to use the same volume ++ return "", fmt.Errorf("RWX block volume %s/%s is being used by pods from different VMs (%s and %s); "+ ++ "this is not supported - RWX block volumes with allow-two-primaries are only for live migration of a single VM", ++ pvcNamespace, pvcName, vmName, pod.vmName) ++ } ++ } ++ ++ log.WithFields(logrus.Fields{ ++ "pvcNamespace": pvcNamespace, ++ "pvcName": pvcName, ++ "vmName": vmName, ++ "podCount": len(podsUsingPVC), ++ }).Debug("RWX block attachment validated: all pods belong to the same VM (likely live migration)") ++ ++ return vmName, nil ++} ++ ++// GetVMNameFromPod extracts the VM name from a pod, handling both regular virt-launcher pods ++// and hotplug disk pods (which reference the virt-launcher pod via ownerReferences). ++func GetVMNameFromPod(ctx context.Context, kubeClient dynamic.Interface, log *logrus.Entry, pod *unstructured.Unstructured) (string, error) { ++ labels := pod.GetLabels() ++ if labels == nil { ++ return "", nil ++ } ++ ++ // Direct case: pod has vm.kubevirt.io/name label (virt-launcher pod) ++ if vmName, ok := labels[KubeVirtVMLabel]; ok && vmName != "" { ++ return vmName, nil ++ } ++ ++ // Hotplug disk case: pod has kubevirt.io: hotplug-disk label ++ // Follow ownerReferences to find the virt-launcher pod ++ if hotplugValue, ok := labels[KubeVirtHotplugDiskLabel]; ok && hotplugValue == "hotplug-disk" { ++ ownerRefs := pod.GetOwnerReferences() ++ for _, owner := range ownerRefs { ++ if owner.Kind != "Pod" || owner.Controller == nil || !*owner.Controller { ++ continue ++ } ++ ++ // Get the owner pod (virt-launcher) ++ ownerPod, err := kubeClient.Resource(PodGVR).Namespace(pod.GetNamespace()).Get(ctx, owner.Name, metav1.GetOptions{}) ++ if err != nil { ++ return "", fmt.Errorf("failed to get owner pod %s: %w", owner.Name, err) ++ } ++ ++ // Extract VM name from owner pod ++ ownerLabels := ownerPod.GetLabels() ++ if ownerLabels != nil { ++ if vmName, ok := ownerLabels[KubeVirtVMLabel]; ok && vmName != "" { ++ log.WithFields(logrus.Fields{ ++ "hotplugPod": pod.GetName(), ++ "virtLauncher": owner.Name, ++ "vmName": vmName, ++ }).Debug("resolved VM name from hotplug disk pod via owner reference") ++ ++ return vmName, nil ++ } ++ } ++ ++ return "", fmt.Errorf("owner pod %s does not have %s label", owner.Name, KubeVirtVMLabel) ++ } ++ ++ return "", fmt.Errorf("hotplug disk pod %s has no controller owner reference", pod.GetName()) ++ } ++ ++ return "", nil ++} +diff --git a/pkg/utils/rwx_validation_test.go b/pkg/utils/rwx_validation_test.go +new file mode 100644 +index 00000000..d75690f9 +--- /dev/null ++++ b/pkg/utils/rwx_validation_test.go +@@ -0,0 +1,342 @@ ++/* ++CSI Driver for Linstor ++Copyright © 2018 LINBIT USA, LLC ++ ++This program is free software; you can redistribute it and/or modify ++it under the terms of the GNU General Public License as published by ++the Free Software Foundation; either version 2 of the License, or ++(at your option) any later version. ++ ++This program is distributed in the hope that it will be useful, ++but WITHOUT ANY WARRANTY; without even the implied warranty of ++MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++GNU General Public License for more details. ++ ++You should have received a copy of the GNU General Public License ++along with this program; if not, see . ++*/ ++ ++package utils ++ ++import ( ++ "context" ++ "testing" ++ ++ "github.com/sirupsen/logrus" ++ "github.com/stretchr/testify/assert" ++ "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" ++ "k8s.io/apimachinery/pkg/runtime" ++ "k8s.io/apimachinery/pkg/runtime/schema" ++ dynamicfake "k8s.io/client-go/dynamic/fake" ++) ++ ++func TestValidateRWXBlockAttachment(t *testing.T) { ++ testCases := []struct { ++ name string ++ pods []*unstructured.Unstructured ++ pvcName string ++ namespace string ++ expectError bool ++ errorMsg string ++ }{ ++ { ++ name: "no pods using PVC", ++ pods: []*unstructured.Unstructured{}, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: false, ++ }, ++ { ++ name: "single pod using PVC", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: false, ++ }, ++ { ++ name: "two pods same VM (live migration)", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("virt-launcher-vm1-abc", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createUnstructuredPod("virt-launcher-vm1-xyz", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: false, ++ }, ++ { ++ name: "two pods different VMs (should fail)", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("virt-launcher-vm1-abc", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createUnstructuredPod("virt-launcher-vm2-xyz", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Running"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: true, ++ errorMsg: "different VMs", ++ }, ++ { ++ name: "pod without KubeVirt label when multiple pods exist (strict mode)", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createUnstructuredPod("pod2", "default", "test-pvc", map[string]string{}, "Running"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: true, ++ errorMsg: "does not have the vm.kubevirt.io/name label", ++ }, ++ { ++ name: "completed pods should be ignored", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createUnstructuredPod("pod2", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Succeeded"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: false, ++ }, ++ { ++ name: "failed pods should be ignored", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createUnstructuredPod("pod2", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Failed"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: false, ++ }, ++ { ++ name: "pods in different namespace should not conflict", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createUnstructuredPod("pod2", "other", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Running"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: false, ++ }, ++ { ++ name: "pods using different PVCs should not conflict", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("pod1", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createUnstructuredPod("pod2", "default", "other-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Running"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: false, ++ }, ++ { ++ name: "three pods from same VM (multi-node live migration scenario)", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("virt-launcher-vm1-a", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createUnstructuredPod("virt-launcher-vm1-b", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createUnstructuredPod("virt-launcher-vm1-c", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Pending"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: false, ++ }, ++ { ++ name: "hotplug disk pod with virt-launcher (should succeed)", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("virt-launcher-vm1-abc", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createHotplugDiskPod("hp-volume-xyz", "default", "test-pvc", "virt-launcher-vm1-abc", "Running"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: false, ++ }, ++ { ++ name: "hotplug disks from different VMs (should fail)", ++ pods: []*unstructured.Unstructured{ ++ createUnstructuredPod("virt-launcher-vm1-abc", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm1"}, "Running"), ++ createHotplugDiskPod("hp-volume-vm1", "default", "test-pvc", "virt-launcher-vm1-abc", "Running"), ++ createUnstructuredPod("virt-launcher-vm2-xyz", "default", "test-pvc", map[string]string{KubeVirtVMLabel: "vm2"}, "Running"), ++ createHotplugDiskPod("hp-volume-vm2", "default", "test-pvc", "virt-launcher-vm2-xyz", "Running"), ++ }, ++ pvcName: "test-pvc", ++ namespace: "default", ++ expectError: true, ++ errorMsg: "different VMs", ++ }, ++ } ++ ++ for _, tc := range testCases { ++ t.Run(tc.name, func(t *testing.T) { ++ // Create fake dynamic client with test pods and PV ++ scheme := runtime.NewScheme() ++ ++ // Create PV object that references the PVC ++ pv := createUnstructuredPV("test-volume-id", tc.namespace, tc.pvcName) ++ ++ objects := make([]runtime.Object, 0, len(tc.pods)+1) ++ objects = append(objects, pv) ++ ++ for _, pod := range tc.pods { ++ objects = append(objects, pod) ++ } ++ ++ gvrToListKind := map[schema.GroupVersionResource]string{ ++ PodGVR: "PodList", ++ PVGVR: "PersistentVolumeList", ++ } ++ client := dynamicfake.NewSimpleDynamicClientWithCustomListKinds(scheme, gvrToListKind, objects...) ++ ++ // Create logger ++ logger := logrus.NewEntry(logrus.New()) ++ logger.Logger.SetLevel(logrus.DebugLevel) ++ ++ // Run validation ++ vmName, err := ValidateRWXBlockAttachment(context.Background(), client, logger, "test-volume-id") ++ ++ if tc.expectError { ++ assert.Error(t, err) ++ ++ if tc.errorMsg != "" { ++ assert.Contains(t, err.Error(), tc.errorMsg) ++ } ++ } else { ++ assert.NoError(t, err) ++ // VM name is returned when there are pods using the volume ++ if len(tc.pods) > 0 { ++ assert.NotEmpty(t, vmName) ++ } ++ } ++ }) ++ } ++} ++ ++func TestValidateRWXBlockAttachmentNoKubeClient(t *testing.T) { ++ // When not running in Kubernetes (no client), validation should be skipped ++ logger := logrus.NewEntry(logrus.New()) ++ ++ vmName, err := ValidateRWXBlockAttachment(context.Background(), nil, logger, "test-volume-id") ++ assert.NoError(t, err) ++ assert.Empty(t, vmName) ++} ++ ++func TestValidateRWXBlockAttachmentPVNotFound(t *testing.T) { ++ // When PV is not found, validation should be skipped with warning ++ scheme := runtime.NewScheme() ++ ++ gvrToListKind := map[schema.GroupVersionResource]string{ ++ PodGVR: "PodList", ++ PVGVR: "PersistentVolumeList", ++ } ++ client := dynamicfake.NewSimpleDynamicClientWithCustomListKinds(scheme, gvrToListKind) ++ ++ logger := logrus.NewEntry(logrus.New()) ++ logger.Logger.SetLevel(logrus.DebugLevel) ++ ++ vmName, err := ValidateRWXBlockAttachment(context.Background(), client, logger, "non-existent-pv") ++ assert.NoError(t, err) ++ assert.Empty(t, vmName) ++} ++ ++// createUnstructuredPod creates an unstructured pod object for testing. ++func createUnstructuredPod(name, namespace, pvcName string, labels map[string]string, phase string) *unstructured.Unstructured { ++ pod := &unstructured.Unstructured{ ++ Object: map[string]interface{}{ ++ "apiVersion": "v1", ++ "kind": "Pod", ++ "metadata": map[string]interface{}{ ++ "name": name, ++ "namespace": namespace, ++ "labels": toStringInterfaceMap(labels), ++ }, ++ "spec": map[string]interface{}{ ++ "volumes": []interface{}{ ++ map[string]interface{}{ ++ "name": "data", ++ "persistentVolumeClaim": map[string]interface{}{ ++ "claimName": pvcName, ++ }, ++ }, ++ }, ++ }, ++ "status": map[string]interface{}{ ++ "phase": phase, ++ }, ++ }, ++ } ++ ++ return pod ++} ++ ++// createUnstructuredPV creates an unstructured PersistentVolume object for testing. ++func createUnstructuredPV(name, pvcNamespace, pvcName string) *unstructured.Unstructured { ++ pv := &unstructured.Unstructured{ ++ Object: map[string]interface{}{ ++ "apiVersion": "v1", ++ "kind": "PersistentVolume", ++ "metadata": map[string]interface{}{ ++ "name": name, ++ }, ++ "spec": map[string]interface{}{ ++ "claimRef": map[string]interface{}{ ++ "name": pvcName, ++ "namespace": pvcNamespace, ++ }, ++ "csi": map[string]interface{}{ ++ "volumeHandle": name, ++ }, ++ }, ++ }, ++ } ++ ++ return pv ++} ++ ++// toStringInterfaceMap converts map[string]string to map[string]interface{}. ++func toStringInterfaceMap(m map[string]string) map[string]interface{} { ++ result := make(map[string]interface{}) ++ ++ for k, v := range m { ++ result[k] = v ++ } ++ ++ return result ++} ++ ++// createHotplugDiskPod creates a hotplug disk pod that references a virt-launcher pod via ownerReferences. ++func createHotplugDiskPod(name, namespace, pvcName, ownerPodName, phase string) *unstructured.Unstructured { ++ pod := &unstructured.Unstructured{ ++ Object: map[string]interface{}{ ++ "apiVersion": "v1", ++ "kind": "Pod", ++ "metadata": map[string]interface{}{ ++ "name": name, ++ "namespace": namespace, ++ "labels": map[string]interface{}{ ++ "kubevirt.io": "hotplug-disk", ++ }, ++ "ownerReferences": []interface{}{ ++ map[string]interface{}{ ++ "apiVersion": "v1", ++ "kind": "Pod", ++ "name": ownerPodName, ++ "controller": true, ++ "blockOwnerDeletion": true, ++ }, ++ }, ++ }, ++ "spec": map[string]interface{}{ ++ "volumes": []interface{}{ ++ map[string]interface{}{ ++ "name": "data", ++ "persistentVolumeClaim": map[string]interface{}{ ++ "claimName": pvcName, ++ }, ++ }, ++ }, ++ }, ++ "status": map[string]interface{}{ ++ "phase": phase, ++ }, ++ }, ++ } ++ ++ return pod ++} diff --git a/packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff b/packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff deleted file mode 100644 index 279c636b..00000000 --- a/packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff +++ /dev/null @@ -1,132 +0,0 @@ -diff --git a/pkg/client/linstor.go b/pkg/client/linstor.go -index ac4651d..9d75c79 100644 ---- a/pkg/client/linstor.go -+++ b/pkg/client/linstor.go -@@ -653,11 +653,35 @@ func (s *Linstor) Attach(ctx context.Context, volId, node string, rwxBlock bool) - } - - if otherResInUse > 0 && rwxBlock { -- rdPropsModify := lapi.GenericPropsModify{OverrideProps: map[string]string{ -+ rdProps := map[string]string{ - linstor.PropertyAllowTwoPrimaries: "yes", -- }} -+ } - -- err = s.client.ResourceDefinitions.Modify(ctx, volId, rdPropsModify) -+ // DRBD requires Protocol C whenever allow-two-primaries is enabled. -+ // If the resource is configured with Protocol A or B (typically -+ // through its resource-group), drbdadm adjust on the satellites -+ // fails with "Protocol C required" (errno 139) and live migration -+ // cannot proceed. Override Protocol to C on the resource-definition -+ // itself so it applies to every connection (including diskless -+ // peers, e.g. a TieBreaker). The marker lets Detach revert exactly -+ // the override we installed without disturbing operator-set props. -+ proto, protoErr := s.getEffectiveDrbdProtocol(ctx, volId) -+ if protoErr != nil { -+ s.log.WithError(protoErr).WithField("volume", volId). -+ Warn("failed to determine effective DRBD protocol; skipping Protocol=C override for dual-attach") -+ } else if proto == "A" || proto == "B" { -+ s.log.WithFields(logrus.Fields{ -+ "volume": volId, -+ "protocol": proto, -+ }).Info("installing Protocol=C override on resource-definition for dual-attach") -+ -+ rdProps[linstor.PropertyDrbdNetProtocol] = "C" -+ rdProps[linstor.PropertyCsiProtocolOverride] = "yes" -+ } -+ -+ err = s.client.ResourceDefinitions.Modify(ctx, volId, lapi.GenericPropsModify{ -+ OverrideProps: rdProps, -+ }) - if err != nil { - return "", err - } -@@ -774,11 +798,26 @@ func (s *Linstor) Detach(ctx context.Context, volId, node string) error { - } - - if resInUse == 1 { -- rdPropsModify := lapi.GenericPropsModify{DeleteProps: []string{ -- linstor.PropertyAllowTwoPrimaries, -- }} -+ deleteProps := []string{linstor.PropertyAllowTwoPrimaries} -+ -+ // Drop the Protocol=C override only if Attach installed it (gated by -+ // our marker), so an operator-set Protocol property on the -+ // resource-definition is preserved. -+ rd, getErr := s.client.ResourceDefinitions.Get(ctx, volId) -+ if getErr != nil { -+ log.WithError(getErr).Warn("failed to fetch resource-definition props; skipping Protocol=C override removal") -+ } else if rd.Props[linstor.PropertyCsiProtocolOverride] != "" { -+ log.Info("removing Protocol=C override from resource-definition") - -- err = s.client.ResourceDefinitions.Modify(ctx, volId, rdPropsModify) -+ deleteProps = append(deleteProps, -+ linstor.PropertyDrbdNetProtocol, -+ linstor.PropertyCsiProtocolOverride, -+ ) -+ } -+ -+ err = s.client.ResourceDefinitions.Modify(ctx, volId, lapi.GenericPropsModify{ -+ DeleteProps: deleteProps, -+ }) - if err != nil { - return nil404(err) - } -@@ -805,6 +844,33 @@ func (s *Linstor) Detach(ctx context.Context, volId, node string) error { - return nil404(s.client.Resources.Delete(ctx, volId, node)) - } - -+// getEffectiveDrbdProtocol returns the DRBD network protocol ("A", "B" or "C") -+// that LINSTOR will hand to drbdadm for the given resource. Resource-definition -+// properties take precedence; otherwise the value is inherited from the -+// resource-group. An empty string is returned when neither level sets the -+// property (LINSTOR's compiled-in default is "C"). -+func (s *Linstor) getEffectiveDrbdProtocol(ctx context.Context, volId string) (string, error) { -+ rd, err := s.client.ResourceDefinitions.Get(ctx, volId) -+ if err != nil { -+ return "", err -+ } -+ -+ if v, ok := rd.Props[linstor.PropertyDrbdNetProtocol]; ok { -+ return v, nil -+ } -+ -+ if rd.ResourceGroupName == "" { -+ return "", nil -+ } -+ -+ rg, err := s.client.ResourceGroups.Get(ctx, rd.ResourceGroupName) -+ if err != nil { -+ return "", err -+ } -+ -+ return rg.Props[linstor.PropertyDrbdNetProtocol], nil -+} -+ - // CapacityBytes returns the amount of free space in the storage pool specified by the params and topology. - func (s *Linstor) CapacityBytes(ctx context.Context, storagePools []string, overProvision *float64, segments map[string]string) (int64, error) { - log := s.log.WithField("storage-pools", storagePools).WithField("segments", segments) -diff --git a/pkg/linstor/const.go b/pkg/linstor/const.go -index 9a5f79c..c8bc9c3 100644 ---- a/pkg/linstor/const.go -+++ b/pkg/linstor/const.go -@@ -44,6 +44,19 @@ const ( - // PropertyAllowTwoPrimaries is DRBD option to allow second primary. Mainly used for live-migration. - PropertyAllowTwoPrimaries = lc.NamespcDrbdNetOptions + "/allow-two-primaries" - -+ // PropertyDrbdNetProtocol is the DRBD network replication protocol option -+ // (A = async, B = semi-sync, C = sync). DRBD requires Protocol C whenever -+ // allow-two-primaries is enabled, otherwise drbdadm adjust fails with -+ // "Protocol C required" (errno 139). -+ PropertyDrbdNetProtocol = lc.NamespcDrbdNetOptions + "/protocol" -+ -+ // PropertyCsiProtocolOverride marks a resource-connection where this driver -+ // has installed a temporary Protocol=C override to make a Protocol-A/B -+ // resource compatible with allow-two-primaries during live migration. The -+ // marker lets us safely remove only the overrides we set, without touching -+ // connection-level overrides installed by the operator. -+ PropertyCsiProtocolOverride = lc.NamespcAuxiliary + "/csi-protocol-override" -+ - // CreatedForTemporaryDisklessAttach marks a resource as temporary, i.e. it should be removed after it is no longer - // needed. - CreatedForTemporaryDisklessAttach = "temporary-diskless-attach" diff --git a/packages/system/linstor/images/piraeus-server/patches/README.md b/packages/system/linstor/images/piraeus-server/patches/README.md index dfe75c2e..558fdfeb 100644 --- a/packages/system/linstor/images/piraeus-server/patches/README.md +++ b/packages/system/linstor/images/piraeus-server/patches/README.md @@ -1,17 +1,14 @@ # LINSTOR Server Patches -Custom patches for piraeus-server (linstor-server) v1.33.2. +Custom patches for piraeus-server (linstor-server) v1.32.3. -- **allow-toggle-disk-retry.diff** — Backport maintainer implementation of toggle-disk retry/abort - - Source PR/comment: [#475](https://github.com/LINBIT/linstor-server/pull/475), [maintainer note](https://github.com/LINBIT/linstor-server/pull/475#issuecomment-3949630419) - - Backported from upstream commit: [`3d97f71c9`](https://github.com/LINBIT/linstor-server/commit/3d97f71c95a493588d3d521c63eac4d846935fb3) -- **fix-duplicate-tcp-ports.diff** — Preserve DRBD TCP ports during toggle-disk and avoid redundant `ensureStackDataExists()` - - Source PR/review: [#476](https://github.com/LINBIT/linstor-server/pull/476), [review suggestion](https://github.com/LINBIT/linstor-server/pull/476#discussion_r3007725079) - - Backported from commits: [`79d6375c5`](https://github.com/kvaps/linstor-server/commit/79d6375c55d6181b35a7b7f0fe8dbdfb86e126cd), [`bcc89902f`](https://github.com/kvaps/linstor-server/commit/bcc89902f4f61ac1589dd07ebb7f5aae1935370d) -- **fix-luks-header-size.diff** — Account for LUKS2 `--offset`, metadata/keyslots sizing, and device `optimal_io_size` - - Source PR/comment: [#472](https://github.com/LINBIT/linstor-server/pull/472), [maintainer note](https://github.com/LINBIT/linstor-server/pull/472#issuecomment-3949687603) - - Backported from commits: [`ccc85fbd2`](https://github.com/LINBIT/linstor-server/commit/ccc85fbd2c65f0b97c52403fa80f1efdb886ec4e), [`71b601554`](https://github.com/LINBIT/linstor-server/commit/71b601554f41bcb50cd5bd06989c5b0d3a814acd) - - Note: upstream commit [`3d0402a0c`](https://github.com/LINBIT/linstor-server/commit/3d0402a0c25f0a4b57b380321f10e89982f26e7a) is already included in `v1.33.1` -- **retry-adjust-after-stale-bitmap.diff** — Retry `drbdadm adjust` after detaching a stale local bitmap state - - Source PR: [#491](https://github.com/LINBIT/linstor-server/pull/491) - - Backported from commit: [`51ae50a84`](https://github.com/kvaps/linstor-server/commit/51ae50a84dcb98093f543b819652c750a94d96c9) +- **adjust-on-resfile-change.diff** — Use actual device path in res file during toggle-disk; fix LUKS data offset + - Upstream: [#473](https://github.com/LINBIT/linstor-server/pull/473), [#472](https://github.com/LINBIT/linstor-server/pull/472) +- **allow-toggle-disk-retry.diff** — Allow retry and cancellation of failed toggle-disk operations + - Upstream: [#475](https://github.com/LINBIT/linstor-server/pull/475) +- **force-metadata-check-on-disk-add.diff** — Create metadata during toggle-disk from diskless to diskful + - Upstream: [#474](https://github.com/LINBIT/linstor-server/pull/474) +- **fix-duplicate-tcp-ports.diff** — Preserve TCP ports during toggle-disk to prevent port mismatch between controller and satellites + - Upstream: [#476](https://github.com/LINBIT/linstor-server/pull/476) (superseded by this expanded fix) +- **skip-adjust-when-device-inaccessible.diff** — Fix resources stuck in StandAlone after reboot, Unknown state race condition, and encrypted resource deletion + - Upstream: [#477](https://github.com/LINBIT/linstor-server/pull/477) diff --git a/packages/system/linstor/images/piraeus-server/patches/adjust-on-resfile-change.diff b/packages/system/linstor/images/piraeus-server/patches/adjust-on-resfile-change.diff new file mode 100644 index 00000000..6788efaf --- /dev/null +++ b/packages/system/linstor/images/piraeus-server/patches/adjust-on-resfile-change.diff @@ -0,0 +1,48 @@ +diff --git a/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/ConfFileBuilder.java b/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/ConfFileBuilder.java +index 36c52ccf8..c0bb7b967 100644 +--- a/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/ConfFileBuilder.java ++++ b/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/ConfFileBuilder.java +@@ -894,12 +894,16 @@ public class ConfFileBuilder + if (((Volume) vlmData.getVolume()).getFlags().isUnset(localAccCtx, Volume.Flags.DELETE)) + { + final String disk; ++ // Check if we're in toggle-disk operation (adding disk to diskless resource) ++ boolean isDiskAdding = vlmData.getVolume().getAbsResource().getStateFlags().isSomeSet( ++ localAccCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING); + if ((!isPeerRsc && vlmData.getDataDevice() == null) || + (isPeerRsc && + // FIXME: vlmData.getRscLayerObject().getFlags should be used here + vlmData.getVolume().getAbsResource().disklessForDrbdPeers(accCtx) + ) || +- (!isPeerRsc && ++ // For toggle-disk: if dataDevice is set and we're adding disk, use the actual device ++ (!isPeerRsc && !isDiskAdding && + // FIXME: vlmData.getRscLayerObject().getFlags should be used here + vlmData.getVolume().getAbsResource().isDrbdDiskless(accCtx) + ) +diff --git a/satellite/src/main/java/com/linbit/linstor/layer/luks/CryptSetupCommands.java b/satellite/src/main/java/com/linbit/linstor/layer/luks/CryptSetupCommands.java +index 54dd5c19f..018de58cf 100644 +--- a/satellite/src/main/java/com/linbit/linstor/layer/luks/CryptSetupCommands.java ++++ b/satellite/src/main/java/com/linbit/linstor/layer/luks/CryptSetupCommands.java +@@ -34,6 +34,9 @@ public class CryptSetupCommands implements Luks + private static final Version V2_1_0 = new Version(2, 1, 0); + private static final Version V2_0_0 = new Version(2, 0, 0); + private static final String PBDKF_MAX_MEMORY_KIB = "262144"; // 256 MiB ++ // Fixed LUKS2 data offset in 512-byte sectors (16 MiB = 32768 sectors) ++ // This ensures consistent LUKS header size across all nodes regardless of system defaults ++ private static final String LUKS2_DATA_OFFSET_SECTORS = "32768"; + + @SuppressWarnings("unused") + private final ErrorReporter errorReporter; +@@ -78,6 +81,11 @@ public class CryptSetupCommands implements Luks + command.add(CRYPTSETUP); + command.add("-q"); + command.add("luksFormat"); ++ // Always specify explicit offset to ensure consistent LUKS header size across all nodes ++ // Without this, different systems may create LUKS with different header sizes (16MiB vs 32MiB) ++ // which causes "Low.dev. smaller than requested DRBD-dev. size" errors during toggle-disk ++ command.add("--offset"); ++ command.add(LUKS2_DATA_OFFSET_SECTORS); + if (version.greaterOrEqual(V2_0_0)) + { + command.add("--pbkdf-memory"); diff --git a/packages/system/linstor/images/piraeus-server/patches/allow-toggle-disk-retry.diff b/packages/system/linstor/images/piraeus-server/patches/allow-toggle-disk-retry.diff index 952ba16c..264e0221 100644 --- a/packages/system/linstor/images/piraeus-server/patches/allow-toggle-disk-retry.diff +++ b/packages/system/linstor/images/piraeus-server/patches/allow-toggle-disk-retry.diff @@ -1,232 +1,168 @@ diff --git a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java -index d93a18014..a944cb809 100644 +index d93a18014..cc8ce4f04 100644 --- a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java +++ b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java -@@ -111,6 +111,14 @@ import reactor.util.function.Tuple2; - @Singleton - public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionListener - { -+ private enum ToggleDiskAction -+ { -+ NOOP, -+ NORMAL, -+ ABORT, -+ RETRY -+ } -+ - private final AccessContext apiCtx; - private final ScopeRunner scopeRunner; - private final BackgroundRunner backgroundRunner; -@@ -386,69 +394,33 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL - "Toggle Disk on %s/%s %s", nodeNameStr, rscNameStr, removeDisk ? "removing disk" : "adding disk"); +@@ -57,7 +57,9 @@ import com.linbit.linstor.stateflags.StateFlags; + import com.linbit.linstor.storage.StorageException; + import com.linbit.linstor.storage.data.adapter.drbd.DrbdRscData; + import com.linbit.linstor.storage.interfaces.categories.resource.AbsRscLayerObject; ++import com.linbit.linstor.storage.interfaces.categories.resource.VlmProviderObject; + import com.linbit.linstor.storage.kinds.DeviceLayerKind; ++import com.linbit.linstor.storage.kinds.DeviceProviderKind; + import com.linbit.linstor.storage.utils.LayerUtils; + import com.linbit.linstor.tasks.AutoDiskfulTask; + import com.linbit.linstor.utils.layer.LayerRscUtils; +@@ -387,21 +389,84 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL Resource rsc = ctrlApiDataLoader.loadRsc(nodeName, rscName, true); -+ ResourceDefinition rscDfn = rsc.getResourceDefinition(); -- if (hasDiskAddRequested(rsc)) -- { ++ // Allow retry of the same operation if the previous attempt failed ++ // (the requested flag remains set for retry on reconnection, but we should also allow manual retry) ++ // Also allow cancellation of a failed operation by requesting the opposite operation + if (hasDiskAddRequested(rsc)) + { - throw new ApiRcException(ApiCallRcImpl.simpleEntry( - ApiConsts.FAIL_RSC_BUSY, - "Addition of disk to resource already requested", - true - )); -- } -- if (hasDiskRemoveRequested(rsc)) -- { ++ if (removeDisk) ++ { ++ // User wants to cancel the failed add-disk operation and go back to diskless ++ // Use the existing disk removal flow to properly cleanup storage on satellite ++ errorReporter.logInfo( ++ "Toggle Disk cancel on %s/%s - cancelling failed DISK_ADD_REQUESTED, reverting to diskless", ++ nodeNameStr, rscNameStr); ++ unmarkDiskAddRequested(rsc); ++ // Also clear DISK_ADDING if it was set ++ unmarkDiskAdding(rsc); ++ ++ // Set storage pool to diskless pool (overwrite the diskful pool that was set) ++ Props rscProps = ctrlPropsHelper.getProps(rsc); ++ rscProps.map().put(ApiConsts.KEY_STOR_POOL_NAME, LinStor.DISKLESS_STOR_POOL_NAME); ++ ++ // Set DISK_REMOVE_REQUESTED to use the existing disk removal flow ++ // This will: ++ // 1. updateAndAdjustDisk sets DISK_REMOVING flag ++ // 2. Satellite sees DISK_REMOVING and deletes LUKS/storage devices ++ // 3. finishOperation rebuilds layer stack as diskless ++ // We keep the existing layer data so satellite can properly cleanup ++ markDiskRemoveRequested(rsc); ++ ++ ctrlTransactionHelper.commit(); ++ ++ // Use existing disk removal flow - this will properly cleanup storage on satellite ++ return Flux ++ .just(ApiCallRcImpl.singleApiCallRc( ++ ApiConsts.MODIFIED, ++ "Cancelling disk addition, reverting to diskless" ++ )) ++ .concatWith(updateAndAdjustDisk(nodeName, rscName, true, toggleIntoTiebreakerRef, context)) ++ .concatWith(ctrlRscDfnApiCallHandler.get().updateProps(rsc.getResourceDefinition())); ++ } ++ // If adding disk and DISK_ADD_REQUESTED is already set, treat as retry ++ // Simply retry the operation with existing layer data - satellite will handle it idempotently ++ // NOTE: We don't remove/recreate layer data here because removeLayerData() only deletes ++ // from controller DB without calling drbdadm down on satellite, leaving orphaned DRBD devices ++ errorReporter.logInfo( ++ "Toggle Disk retry on %s/%s - DISK_ADD_REQUESTED already set, retrying operation", ++ nodeNameStr, rscNameStr); ++ ctrlTransactionHelper.commit(); ++ return Flux ++ .just(new ApiCallRcImpl()) ++ .concatWith(updateAndAdjustDisk(nodeName, rscName, false, toggleIntoTiebreakerRef, context)) ++ .concatWith(ctrlRscDfnApiCallHandler.get().updateProps(rsc.getResourceDefinition())); + } + if (hasDiskRemoveRequested(rsc)) + { - throw new ApiRcException(ApiCallRcImpl.simpleEntry( - ApiConsts.FAIL_RSC_BUSY, - "Removal of disk from resource already requested", - true - )); -- } -+ ToggleDiskAction action = determineToggleDiskAction(rsc, removeDisk); -+ errorReporter.logDebug("Toggle Disk action: %s", action); - -- if (!removeDisk && !ctrlVlmCrtApiHelper.isDiskless(rsc)) -+ switch (action) - { -- throw new ApiRcException(ApiCallRcImpl.simpleEntry( -- ApiConsts.WARN_RSC_ALREADY_HAS_DISK, -- "Resource already has disk", -- true -- )); -- } -- if (removeDisk && ctrlVlmCrtApiHelper.isDiskless(rsc)) -- { -- throw new ApiRcException(ApiCallRcImpl.simpleEntry( -- ApiConsts.WARN_RSC_ALREADY_DISKLESS, -- "Resource already diskless", -- true -- )); -+ case NOOP: -+ return handleNoopAction(rsc, removeDisk); -+ case RETRY: -+ return handleRetryAction(rsc, removeDisk, toggleIntoTiebreakerRef, context); -+ case ABORT: -+ clearToggleDiskFlags(rsc); ++ if (!removeDisk) ++ { ++ // User wants to cancel the failed remove-disk operation + errorReporter.logInfo( -+ "Aborting previous toggle disk transition, starting new transition to %s", -+ removeDisk ? "diskless" : "diskful" ++ "Toggle Disk cancel on %s/%s - cancelling failed DISK_REMOVE_REQUESTED", ++ nodeNameStr, rscNameStr); ++ unmarkDiskRemoveRequested(rsc); ++ ctrlTransactionHelper.commit(); ++ return Flux.just( ++ ApiCallRcImpl.singleApiCallRc( ++ ApiConsts.MODIFIED, ++ "Cancelled disk removal request" ++ ) + ); -+ break; -+ case NORMAL: -+ break; -+ default: -+ throw new ImplementationError("Unhandled case: " + action); ++ } ++ // If removing disk and DISK_REMOVE_REQUESTED is already set, treat as retry ++ errorReporter.logInfo( ++ "Toggle Disk retry on %s/%s - DISK_REMOVE_REQUESTED already set, continuing operation", ++ nodeNameStr, rscNameStr); ++ ctrlTransactionHelper.commit(); ++ return Flux ++ .just(new ApiCallRcImpl()) ++ .concatWith(updateAndAdjustDisk(nodeName, rscName, true, toggleIntoTiebreakerRef, context)) ++ .concatWith(ctrlRscDfnApiCallHandler.get().updateProps(rsc.getResourceDefinition())); } + if (!removeDisk && !ctrlVlmCrtApiHelper.isDiskless(rsc)) +@@ -412,17 +477,43 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL + true + )); + } ++ ResourceDefinition rscDfn = rsc.getResourceDefinition(); ++ AccessContext peerCtx = peerAccCtx.get(); ++ + if (removeDisk && ctrlVlmCrtApiHelper.isDiskless(rsc)) + { ++ // Resource is marked as diskless - check if it has orphaned storage layers that need cleanup ++ AbsRscLayerObject layerData = getLayerData(peerCtx, rsc); ++ if (layerData != null && (LayerUtils.hasLayer(layerData, DeviceLayerKind.LUKS) || ++ hasNonDisklessStorageLayer(layerData))) ++ { ++ // Resource is marked as diskless but has orphaned storage layers - need cleanup ++ // Use the existing disk removal flow to properly cleanup storage on satellite ++ errorReporter.logInfo( ++ "Toggle Disk cleanup on %s/%s - resource is diskless but has orphaned storage layers, cleaning up", ++ nodeNameStr, rscNameStr); ++ ++ // Set DISK_REMOVE_REQUESTED to use the existing disk removal flow ++ // This will trigger proper satellite cleanup via DISK_REMOVING flag ++ markDiskRemoveRequested(rsc); ++ ++ ctrlTransactionHelper.commit(); ++ ++ // Use existing disk removal flow - this will properly cleanup storage on satellite ++ return Flux ++ .just(ApiCallRcImpl.singleApiCallRc( ++ ApiConsts.MODIFIED, ++ "Cleaning up orphaned storage layers" ++ )) ++ .concatWith(updateAndAdjustDisk(nodeName, rscName, true, toggleIntoTiebreakerRef, context)) ++ .concatWith(ctrlRscDfnApiCallHandler.get().updateProps(rsc.getResourceDefinition())); ++ } + throw new ApiRcException(ApiCallRcImpl.simpleEntry( + ApiConsts.WARN_RSC_ALREADY_DISKLESS, + "Resource already diskless", + true + )); + } +- - ResourceDefinition rscDfn = rsc.getResourceDefinition(); - AccessContext peerCtx = peerAccCtx.get(); -- if (removeDisk) -- { -- // Prevent removal of the last disk -- int haveDiskCount = countDisksAndIsOnline(rscDfn); -- if (haveDiskCount <= 1) -- { -- throw new ApiRcException(ApiCallRcImpl.simpleEntry( -- ApiConsts.FAIL_INSUFFICIENT_REPLICA_COUNT, -- "Cannot remove the disk from the only online resource with a disk", -- true -- )); -- } -+ validateToggleDiskPreconditions(rsc, removeDisk); - -- if (!LayerUtils.hasLayer(getLayerData(peerCtx, rsc), DeviceLayerKind.DRBD)) -- { -- throw new ApiRcException(ApiCallRcImpl.simpleEntry( -- ApiConsts.FAIL_INVLD_LAYER_STACK, -- "Toggle disk is only supported in combination with DRBD", -- true -- )); -- } -- } -- else -- { -- ensureAllPeersHavePeerSlotLeft(rscDfn); -- } -+ AccessContext peerCtx = peerAccCtx.get(); - - // Save the requested storage pool in the resource properties. - // This does not cause the storage pool to be used automatically. -@@ -628,10 +600,10 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL - - ctrlTransactionHelper.commit(); - -- String action = removeDisk ? "Removal of disk from" : "Addition of disk to"; -+ String actionStr = removeDisk ? "Removal of disk from" : "Addition of disk to"; - responses.addEntry(ApiCallRcImpl.simpleEntry( - ApiConsts.MODIFIED, -- action + " resource '" + rscDfn.getName().displayValue + "' " + -+ actionStr + " resource '" + rscDfn.getName().displayValue + "' " + - "on node '" + rsc.getNode().getName().displayValue + "' registered" - )); - -@@ -651,6 +623,40 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL - ); - } - -+ private Flux handleNoopAction(Resource rscRef, boolean removeDiskRef) -+ { -+ String state = removeDiskRef ? "diskless" : "diskful"; -+ ApiCallRcImpl responses = new ApiCallRcImpl(); -+ responses.addEntry(ApiCallRcImpl.simpleEntry( -+ ApiConsts.INFO_NOOP, -+ "Resource '" + rscRef.getResourceDefinition().getName().displayValue + "' on node '" + -+ rscRef.getNode().getName().displayValue + "' is already " + state -+ )); -+ return Flux.just(responses); -+ } -+ -+ private Flux handleRetryAction( -+ Resource rscRef, -+ boolean removeDisk, -+ boolean toggleIntoTiebreakerRef, -+ ResponseContext context -+ ) -+ { -+ String direction = removeDisk ? "diskless" : "diskful"; -+ ApiCallRcImpl responses = new ApiCallRcImpl(); -+ NodeName nodeName = rscRef.getNode().getName(); -+ ResourceName rscName = rscRef.getResourceDefinition().getName(); -+ responses.addEntry(ApiCallRcImpl.simpleEntry( -+ ApiConsts.INFO_NOOP, -+ "Retrying toggle disk to " + direction + " for resource '" + rscName.displayValue + -+ "' on node '" + nodeName.displayValue + "'" -+ )); -+ -+ return Flux -+ .just(responses) -+ .concatWith(updateAndAdjustDisk(nodeName, rscName, removeDisk, toggleIntoTiebreakerRef, context)); -+ } -+ - private long getVlmDfnSizePrivileged(VolumeDefinition vlmDfnRef) - { - try -@@ -781,6 +787,96 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL + if (removeDisk) + { + // Prevent removal of the last disk +@@ -1446,6 +1537,30 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL } } -+ private ToggleDiskAction determineToggleDiskAction(Resource rsc, boolean removeDisk) -+ { -+ boolean isDiskless = ctrlVlmCrtApiHelper.isDiskless(rsc); -+ boolean diskAddRequested = hasDiskAddRequested(rsc); -+ boolean diskRemoveRequested = hasDiskRemoveRequested(rsc); -+ -+ ToggleDiskAction action; -+ if (isDiskless) -+ { -+ if (diskAddRequested) -+ { -+ action = removeDisk ? ToggleDiskAction.ABORT : ToggleDiskAction.RETRY; -+ } -+ else if (diskRemoveRequested) -+ { -+ action = removeDisk ? ToggleDiskAction.RETRY : ToggleDiskAction.ABORT; -+ } -+ else -+ { -+ action = removeDisk ? ToggleDiskAction.NOOP : ToggleDiskAction.NORMAL; -+ } -+ } -+ else -+ { -+ if (diskRemoveRequested) -+ { -+ action = removeDisk ? ToggleDiskAction.RETRY : ToggleDiskAction.ABORT; -+ } -+ else -+ { -+ action = removeDisk ? ToggleDiskAction.NORMAL : ToggleDiskAction.NOOP; -+ } -+ } -+ -+ return action; -+ } -+ -+ private void validateToggleDiskPreconditions(Resource rsc, boolean removeDisk) -+ { -+ ResourceDefinition rscDfn = rsc.getResourceDefinition(); -+ if (removeDisk) -+ { -+ validateDiskRemovalAllowed(rsc, rscDfn); -+ } -+ else -+ { -+ ensureAllPeersHavePeerSlotLeft(rscDfn); -+ } -+ } -+ -+ private void clearToggleDiskFlags(Resource rsc) ++ private void unmarkDiskAddRequested(Resource rsc) + { + try + { -+ rsc.getStateFlags().disableFlags( -+ apiCtx, -+ Resource.Flags.DISK_ADD_REQUESTED, -+ Resource.Flags.DISK_ADDING, -+ Resource.Flags.DISK_REMOVE_REQUESTED, -+ Resource.Flags.DISK_REMOVING -+ ); ++ rsc.getStateFlags().disableFlags(apiCtx, Resource.Flags.DISK_ADD_REQUESTED); + } + catch (AccessDeniedException | DatabaseException exc) + { @@ -234,28 +170,60 @@ index d93a18014..a944cb809 100644 + } + } + -+ private void validateDiskRemovalAllowed(Resource rsc, ResourceDefinition rscDfn) ++ private void unmarkDiskRemoveRequested(Resource rsc) + { -+ int haveDiskCount = countDisksAndIsOnline(rscDfn); -+ if (haveDiskCount <= 1) ++ try + { -+ throw new ApiRcException(ApiCallRcImpl.simpleEntry( -+ ApiConsts.FAIL_INSUFFICIENT_REPLICA_COUNT, -+ "Cannot remove the disk from the only online resource with a disk", -+ true -+ )); ++ rsc.getStateFlags().disableFlags(apiCtx, Resource.Flags.DISK_REMOVE_REQUESTED); + } -+ -+ if (!LayerUtils.hasLayer(getLayerData(peerAccCtx.get(), rsc), DeviceLayerKind.DRBD)) ++ catch (AccessDeniedException | DatabaseException exc) + { -+ throw new ApiRcException(ApiCallRcImpl.simpleEntry( -+ ApiConsts.FAIL_INVLD_LAYER_STACK, -+ "Toggle disk is only supported in combination with DRBD", -+ true -+ )); ++ throw new ImplementationError(exc); + } + } + - /** - * Although we need to rebuild the layerData as the layerList might have changed, if we do not - * deactivate (i.e. down) the current resource, we need to make sure that deleting DrbdRscData + private void markDiskAdded(Resource rscData) + { + try +@@ -1511,6 +1626,41 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL + return layerData; + } + ++ /** ++ * Check if the layer stack has a non-diskless STORAGE layer. ++ * This is used to detect orphaned storage layers that need cleanup. ++ */ ++ private boolean hasNonDisklessStorageLayer(AbsRscLayerObject layerDataRef) ++ { ++ boolean hasNonDiskless = false; ++ if (layerDataRef != null) ++ { ++ if (layerDataRef.getLayerKind() == DeviceLayerKind.STORAGE) ++ { ++ for (VlmProviderObject vlmData : layerDataRef.getVlmLayerObjects().values()) ++ { ++ if (vlmData.getProviderKind() != DeviceProviderKind.DISKLESS) ++ { ++ hasNonDiskless = true; ++ break; ++ } ++ } ++ } ++ if (!hasNonDiskless) ++ { ++ for (AbsRscLayerObject child : layerDataRef.getChildren()) ++ { ++ if (hasNonDisklessStorageLayer(child)) ++ { ++ hasNonDiskless = true; ++ break; ++ } ++ } ++ } ++ } ++ return hasNonDiskless; ++ } ++ + private LockGuard createLockGuard() + { + return lockGuardFactory.buildDeferred(LockType.WRITE, LockObj.NODES_MAP, LockObj.RSC_DFN_MAP); diff --git a/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff b/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff index ed106f98..b34a2500 100644 --- a/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff +++ b/packages/system/linstor/images/piraeus-server/patches/fix-duplicate-tcp-ports.diff @@ -1,25 +1,69 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Andrei Kvapil +Date: Fri, 28 Mar 2026 13:00:00 +0100 +Subject: [PATCH] fix(drbd): preserve TCP ports during toggle-disk operations + +Prevent TCP port mismatches after toggle-disk operations by preserving +existing TCP ports when rebuilding DrbdRscData. + +Root Cause: +----------- +During toggle-disk operations, removeLayerData() deletes DrbdRscData +(freeing its TCP ports from the number pool), then ensureStackDataExists() +creates new DrbdRscData. Since the payload has no explicit tcpPorts, +the controller allocates new ports from the pool -- which may differ from +the old ports if other resources claimed them in the meantime. + +The controller correctly avoids collisions in its own number pool, but +the satellite may miss the update (e.g. during controller restart or +network issues). When this happens, the satellite keeps the old ports +while peers receive the new ones, causing DRBD connection failures +(StandAlone/Connecting state). + +Additionally, remove the redundant ensureStackDataExists() call from +resetStoragePools() -- the caller already invokes it with the correct +payload. + +Solution: +--------- +1. Add copyDrbdTcpPortsIfExists() to save existing TCP ports into the + LayerPayload before removeLayerData() deletes them. +2. Call it from copyDrbdNodeIdIfExists() (covers both toggle-disk paths) + and from the needsDeactivate path (shared storage pool case). +3. Remove the redundant ensureStackDataExists() from resetStoragePools(). + +This ensures the same TCP ports are reused when DrbdRscData is recreated, +eliminating the window for port mismatch between controller and satellites. + +Co-Authored-By: Claude +Signed-off-by: Andrei Kvapil +--- + .../controller/CtrlRscToggleDiskApiCallHandler.java | 40 +++++++++++++++++++-- + .../linstor/layer/resource/CtrlRscLayerDataFactory.java | 2 -- + 2 files changed, 38 insertions(+), 4 deletions(-) + diff --git a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java -index d93a18014..01cfbbacf 100644 +index ccdb0cee5..b0554c2ec 100644 --- a/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java +++ b/controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscToggleDiskApiCallHandler.java -@@ -37,6 +37,7 @@ import com.linbit.linstor.core.objects.StorPool; - import com.linbit.linstor.core.objects.Volume; - import com.linbit.linstor.core.objects.VolumeDefinition; - import com.linbit.linstor.core.objects.utils.MixedStorPoolHelper; +@@ -58,6 +58,7 @@ import com.linbit.linstor.stateflags.StateFlags; + import com.linbit.linstor.storage.StorageException; + import com.linbit.linstor.storage.data.adapter.drbd.DrbdRscData; + import com.linbit.linstor.storage.interfaces.categories.resource.AbsRscLayerObject; +import com.linbit.linstor.core.types.TcpPortNumber; - import com.linbit.linstor.dbdrivers.DatabaseException; - import com.linbit.linstor.event.EventWaiter; - import com.linbit.linstor.event.ObjectIdentifier; -@@ -85,6 +86,7 @@ import java.util.List; - import java.util.Map; + import com.linbit.linstor.storage.interfaces.categories.resource.VlmProviderObject; + import com.linbit.linstor.storage.kinds.DeviceLayerKind; + import com.linbit.linstor.storage.kinds.DeviceProviderKind; +@@ -88,6 +89,7 @@ import java.util.LinkedHashMap; + import java.util.List; import java.util.Map.Entry; import java.util.Set; +import java.util.TreeSet; - + import org.reactivestreams.Publisher; import reactor.core.publisher.Flux; -@@ -575,12 +577,13 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL - +@@ -587,8 +589,9 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL + /* * We also have to remove the currently diskless DrbdRscData and free up the node-id as now we must - * use the shared resource's node-id @@ -29,39 +73,30 @@ index d93a18014..01cfbbacf 100644 } else { -- copyDrbdNodeIdIfExists(rsc, payload); -+ copyDrbdSettings(rsc, payload); - } - /* - * rebuilds the layerdata in case we just removed it.. -@@ -782,10 +785,20 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL - } - +@@ -726,7 +729,7 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL /** -- * Although we need to rebuild the layerData as the layerList might have changed, if we do not -- * deactivate (i.e. down) the current resource, we need to make sure that deleting DrbdRscData + * Although we need to rebuild the layerData as the layerList might have changed, if we do not + * deactivate (i.e. down) the current resource, we need to make sure that deleting DrbdRscData - * and recreating a new DrbdRscData ends up with the same node-id as before. -+ * Copies DRBD settings (node-id and TCP ports) from the existing DrbdRscData into the payload -+ * before removeLayerData() deletes them. This ensures that recreated DrbdRscData ends up with -+ * the same node-id and TCP ports as before. -+ * -+ * TCP ports must be preserved because if the satellite misses the update (e.g. due to controller -+ * restart or connectivity issues), it will keep the old ports while peers receive the new ones, -+ * causing DRBD connections to fail with StandAlone state. ++ * and recreating a new DrbdRscData ends up with the same node-id and TCP ports as before. */ -+ private void copyDrbdSettings(Resource rsc, LayerPayload payload) throws ImplementationError -+ { -+ copyDrbdNodeIdIfExists(rsc, payload); + private void copyDrbdNodeIdIfExists(Resource rsc, LayerPayload payload) throws ImplementationError + { +@@ -743,6 +746,37 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL + DrbdRscData drbdRscData = (DrbdRscData) drbdRscDataSet.iterator().next(); + payload.drbdRsc.nodeId = drbdRscData.getNodeId().value; + } + copyDrbdTcpPortsIfExists(rsc, payload); + } + - private void copyDrbdNodeIdIfExists(Resource rsc, LayerPayload payload) throws ImplementationError - { - Set> drbdRscDataSet = LayerRscUtils.getRscDataByLayer( -@@ -804,6 +817,28 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL - } - } - ++ /** ++ * Preserves existing TCP ports during toggle-disk operations. ++ * ++ * When removeLayerData() deletes DrbdRscData, the TCP ports are freed from the number pool. ++ * If ensureStackDataExists() then allocates different ports, and the satellite misses the update ++ * (e.g. due to controller restart or connectivity issues), the satellite keeps the old ports ++ * while peers get the new ones, causing DRBD connections to fail with StandAlone state. ++ */ + private void copyDrbdTcpPortsIfExists(Resource rsc, LayerPayload payload) throws ImplementationError + { + Set> drbdRscDataSet = LayerRscUtils.getRscDataByLayer( @@ -82,56 +117,22 @@ index d93a18014..01cfbbacf 100644 + payload.drbdRsc.tcpPorts = portInts; + } + } -+ } -+ + } + private List removeLayerData(Resource rscRef) - { - List layerList; -@@ -1058,15 +1093,15 @@ public class CtrlRscToggleDiskApiCallHandler implements CtrlSatelliteConnectionL - /* - * We also have to remove the possible meta-children of previous StorageRscData. - * LayerData will be recreated with ensureStackDataExists. -- * However, we still need to remember our node-id if we had / have DRBD in the list -+ * However, we still need to remember our DRBD settings if we had / have DRBD in the list - */ -- copyDrbdNodeIdIfExists(rsc, payload); -+ copyDrbdSettings(rsc, payload); - layerList = removeLayerData(rsc); - } - else - { - markDiskAdded(rsc); -- ctrlLayerStackHelper.resetStoragePools(rsc); -+ ctrlLayerStackHelper.resetStoragePools(rsc, false); - } - ctrlLayerStackHelper.ensureStackDataExists(rsc, layerList, payload); - diff --git a/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java b/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java -index 3538b380c..f9733b6f1 100644 +index 3538b380c..4f589145e 100644 --- a/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java +++ b/controller/src/main/java/com/linbit/linstor/layer/resource/CtrlRscLayerDataFactory.java -@@ -263,6 +263,11 @@ public class CtrlRscLayerDataFactory - } - - public void resetStoragePools(Resource rscRef) -+ { -+ resetStoragePools(rscRef, true); -+ } -+ -+ public void resetStoragePools(Resource rscRef, boolean callEnsureStackDataExistsRef) - { - try - { -@@ -276,8 +281,10 @@ public class CtrlRscLayerDataFactory - +@@ -276,8 +276,6 @@ public class CtrlRscLayerDataFactory + rscDataToProcess.addAll(rscData.getChildren()); } - - ensureStackDataExists(rscRef, null, new LayerPayload()); -+ if (callEnsureStackDataExistsRef) -+ { -+ ensureStackDataExists(rscRef, null, new LayerPayload()); -+ } } catch (AccessDeniedException exc) { +-- +2.39.5 (Apple Git-154) + diff --git a/packages/system/linstor/images/piraeus-server/patches/fix-luks-header-size.diff b/packages/system/linstor/images/piraeus-server/patches/fix-luks-header-size.diff deleted file mode 100644 index 8611825b..00000000 --- a/packages/system/linstor/images/piraeus-server/patches/fix-luks-header-size.diff +++ /dev/null @@ -1,570 +0,0 @@ -diff --git a/satellite/src/main/java/com/linbit/linstor/layer/storage/AbsStorageProvider.java b/satellite/src/main/java/com/linbit/linstor/layer/storage/AbsStorageProvider.java ---- a/satellite/src/main/java/com/linbit/linstor/layer/storage/AbsStorageProvider.java -+++ b/satellite/src/main/java/com/linbit/linstor/layer/storage/AbsStorageProvider.java -@@ -2081,7 +2081,6 @@ public abstract class AbsStorageProvider< - ) - throws IOException, AccessDeniedException - { -- final StorPoolName storPoolObjName = storPoolObj.getName(); - if (storDevicePath != null) - { - errorReporter.logDebug("updateMinIoSize: Have storDevicePath \"%s\"", storDevicePath); -@@ -2094,35 +2093,18 @@ public abstract class AbsStorageProvider< - "updateMinIoSize: Block device path is \"%s\"", - blockDevicePath.toString() - ); -- final long minIoSize = BlockSizeInfo.getBlockSize(blockDevicePath); -- -- boolean updateValue = true; -- -- final String propKey = StorageConstants.NAMESPACE_INTERNAL + '/' + -- StorageConstants.BLK_DEV_MIN_IO_SIZE; -- final Props storPoolProps = storPoolObj.getProps(storDriverAccCtx); -- final @Nullable String currentPropValue = storPoolProps.getProp(propKey); -- if (currentPropValue != null) -- { -- try -- { -- final long currentPropMinIoSize = Long.parseLong(currentPropValue); -- updateValue = currentPropMinIoSize != minIoSize; -- } -- catch (NumberFormatException ignored) -- { -- } -- } -- -- if (updateValue) -- { -- final String propValue = Long.toString(minIoSize); -- errorReporter.logDebug( -- "Storage pool \"%s\": Set property \"%s\" = \"%s\"", -- storPoolObjName.displayValue, propKey, propValue -- ); -- propsChange.changeStorPoolProp(storPoolObj, propKey, propValue); -- } -+ updatePropIfNeeded( -+ propsChange, -+ storPoolObj, -+ StorageConstants.NAMESPACE_INTERNAL + '/' + StorageConstants.BLK_DEV_MIN_IO_SIZE, -+ Long.toString(BlockSizeInfo.getBlockSize(blockDevicePath)) -+ ); -+ updatePropIfNeeded( -+ propsChange, -+ storPoolObj, -+ StorageConstants.NAMESPACE_INTERNAL + '/' + StorageConstants.BLK_DEV_OPT_IO_SIZE, -+ Long.toString(BlockSizeInfo.getOptimalIoSize(blockDevicePath)) -+ ); - } - else - { -@@ -2130,6 +2112,28 @@ public abstract class AbsStorageProvider< - } - } - -+ private void updatePropIfNeeded( -+ LocalPropsChangePojo propsChangeRef, -+ StorPool storPoolObjRef, -+ String propKeyRef, -+ String propValueRef -+ ) -+ throws AccessDeniedException -+ { -+ final Props storPoolProps = storPoolObjRef.getProps(storDriverAccCtx); -+ final @Nullable String currentPropValue = storPoolProps.getProp(propKeyRef); -+ if (currentPropValue == null || !currentPropValue.equals(propValueRef)) -+ { -+ errorReporter.logDebug( -+ "Storage pool \"%s\": Set property \"%s\" = \"%s\"", -+ storPoolObjRef.getName().displayValue, -+ propKeyRef, -+ propValueRef -+ ); -+ propsChangeRef.changeStorPoolProp(storPoolObjRef, propKeyRef, propValueRef); -+ } -+ } -+ - @SuppressWarnings("unchecked") - @Override - public void updateAllocatedSize(VlmProviderObject vlmDataRef) -diff --git a/satellite/src/main/java/com/linbit/linstor/layer/storage/utils/BlockSizeInfo.java b/satellite/src/main/java/com/linbit/linstor/layer/storage/utils/BlockSizeInfo.java ---- a/satellite/src/main/java/com/linbit/linstor/layer/storage/utils/BlockSizeInfo.java -+++ b/satellite/src/main/java/com/linbit/linstor/layer/storage/utils/BlockSizeInfo.java -@@ -3,8 +3,11 @@ package com.linbit.linstor.layer.storage.utils; - import com.linbit.utils.MathUtils; - import com.linbit.utils.SymbolicLinkResolver; - -+import static com.linbit.linstor.layer.storage.BlockSizeConsts.DFLT_OPT_IO_SIZE; - import static com.linbit.linstor.layer.storage.BlockSizeConsts.DFLT_IO_SIZE; -+import static com.linbit.linstor.layer.storage.BlockSizeConsts.MAX_OPT_IO_SIZE; - import static com.linbit.linstor.layer.storage.BlockSizeConsts.MAX_IO_SIZE; -+import static com.linbit.linstor.layer.storage.BlockSizeConsts.MIN_OPT_IO_SIZE; - import static com.linbit.linstor.layer.storage.BlockSizeConsts.MIN_IO_SIZE; - - import java.io.FileInputStream; -@@ -13,6 +16,8 @@ import java.nio.file.Path; - - public class BlockSizeInfo - { -+ private static final int NUMBER_BUFFER_SIZE = 32; -+ - /** - * Determines the blocksize, aka minimum I/O size, for the specified backing storage path. - * -@@ -51,7 +56,7 @@ public class BlockSizeInfo - final Path infoSourceName = blockDevice.getFileName(); - final Path infoSource = Path.of("/sys/block", infoSourceName.toString(), "queue/physical_block_size"); - -- final byte[] data = new byte[32]; -+ final byte[] data = new byte[NUMBER_BUFFER_SIZE]; - try (final FileInputStream fileIn = new FileInputStream(infoSource.toString())) - { - final int readCount = fileIn.read(data); -@@ -75,4 +80,38 @@ public class BlockSizeInfo - } - return blockSize; - } -+ -+ public static long getOptimalIoSize(final Path storageObj) -+ { -+ long optIoSize = DFLT_OPT_IO_SIZE; -+ try -+ { -+ final Path blockDevice = SymbolicLinkResolver.resolveSymLink(storageObj); -+ final Path infoSourceName = blockDevice.getFileName(); -+ final Path infoSource = Path.of("/sys/block", infoSourceName.toString(), "queue/optimal_io_size"); -+ -+ final byte[] data = new byte[NUMBER_BUFFER_SIZE]; -+ try (final FileInputStream fileIn = new FileInputStream(infoSource.toString())) -+ { -+ final int readCount = fileIn.read(data); -+ if (readCount > 0) -+ { -+ String numberStr = new String(data, 0, readCount); -+ numberStr = numberStr.trim(); -+ try -+ { -+ final long unboundedOptIoSize = Long.parseLong(numberStr); -+ optIoSize = MathUtils.bounds(MIN_OPT_IO_SIZE, unboundedOptIoSize, MAX_OPT_IO_SIZE); -+ } -+ catch (NumberFormatException ignored) -+ { -+ } -+ } -+ } -+ } -+ catch (IOException ignored) -+ { -+ } -+ return optIoSize; -+ } - } -diff --git a/server/src/main/java/com/linbit/SizeConv.java b/server/src/main/java/com/linbit/SizeConv.java ---- a/server/src/main/java/com/linbit/SizeConv.java -+++ b/server/src/main/java/com/linbit/SizeConv.java -@@ -16,6 +16,7 @@ public class SizeConv - public enum SizeUnit - { - UNIT_B, -+ UNIT_SECTORS, - UNIT_KiB, - UNIT_MiB, - UNIT_GiB, -@@ -41,6 +42,9 @@ public class SizeConv - case UNIT_B: - factor = FACTOR_B; - break; -+ case UNIT_SECTORS: -+ factor = FACTOR_SECTORS; -+ break; - case UNIT_KiB: - factor = FACTOR_KiB; - break; -@@ -111,6 +115,9 @@ public class SizeConv - case "b": - unit = SizeUnit.UNIT_B; - break; -+ case "s": -+ unit = SizeUnit.UNIT_SECTORS; -+ break; - case "k": - // fall-through - case "kb": -@@ -217,6 +224,9 @@ public class SizeConv - // Factor 1 - public static final BigInteger FACTOR_B = BigInteger.valueOf(1L); - -+ // Factor 512 -+ public static final BigInteger FACTOR_SECTORS = BigInteger.valueOf(512L); -+ - // Factor 1,024 - // Naming convention exception: SI unit capitalization rules - @SuppressWarnings("checkstyle:constantname") -diff --git a/server/src/main/java/com/linbit/linstor/layer/luks/LuksLayerSizeCalculator.java b/server/src/main/java/com/linbit/linstor/layer/luks/LuksLayerSizeCalculator.java ---- a/server/src/main/java/com/linbit/linstor/layer/luks/LuksLayerSizeCalculator.java -+++ b/server/src/main/java/com/linbit/linstor/layer/luks/LuksLayerSizeCalculator.java -@@ -1,27 +1,62 @@ - package com.linbit.linstor.layer.luks; - -+import com.linbit.SizeConv; -+import com.linbit.SizeConv.SizeUnit; - import com.linbit.exceptions.InvalidSizeException; -+import com.linbit.linstor.PriorityProps; -+import com.linbit.linstor.annotation.Nullable; -+import com.linbit.linstor.api.ApiConsts; -+import com.linbit.linstor.core.objects.AbsResource; -+import com.linbit.linstor.core.objects.AbsVolume; -+import com.linbit.linstor.core.objects.Resource; -+import com.linbit.linstor.core.objects.ResourceDefinition; -+import com.linbit.linstor.core.objects.ResourceGroup; -+import com.linbit.linstor.core.objects.Snapshot; -+import com.linbit.linstor.core.objects.SnapshotVolume; -+import com.linbit.linstor.core.objects.StorPool; -+import com.linbit.linstor.core.objects.Volume; -+import com.linbit.linstor.core.objects.VolumeDefinition; - import com.linbit.linstor.dbdrivers.DatabaseException; - import com.linbit.linstor.layer.AbsLayerSizeCalculator; -+import com.linbit.linstor.netcom.Peer; -+import com.linbit.linstor.propscon.InvalidKeyException; -+import com.linbit.linstor.propscon.ReadOnlyProps; - import com.linbit.linstor.security.AccessDeniedException; -+import com.linbit.linstor.storage.StorageConstants; - import com.linbit.linstor.storage.data.adapter.luks.LuksVlmData; - import com.linbit.linstor.storage.interfaces.categories.resource.VlmProviderObject; - import com.linbit.linstor.storage.kinds.DeviceLayerKind; - import com.linbit.linstor.storage.kinds.ExtTools; - import com.linbit.linstor.storage.kinds.ExtToolsInfo; - import com.linbit.linstor.storage.kinds.ExtToolsInfo.Version; -+import com.linbit.linstor.utils.layer.LayerVlmUtils; -+import com.linbit.utils.ShellUtils; -+import com.linbit.utils.SignedAlign; - - import javax.inject.Inject; - import javax.inject.Singleton; - -+import java.util.Iterator; -+import java.util.LinkedList; -+import java.util.List; -+import java.util.Set; -+import java.util.regex.Matcher; -+import java.util.regex.Pattern; -+ - @Singleton - public class LuksLayerSizeCalculator extends AbsLayerSizeCalculator> - { -+ public static final String LUKS2_OPT_METADATA_SIZE = "--luks2-metadata-size"; -+ public static final String LUKS2_OPT_KEYSLOTS_SIZE = "--luks2-keyslots-size"; -+ public static final String LUKS2_OPT_OFFSET = "--offset"; -+ private static final String LUKS2_OPT_ALIGN_PAYLOAD = "--align-payload"; -+ private static final long DFLT_LUKS2_METADATA_SIZE_IN_BYTES = 16L << 10; -+ private static final long DFLT_ALIGNMENT_1MIB_IN_BYTES = 1L << 20; -+ private static final long LUKS1_HEADER_SIZE_IN_KIB = 2L << 10; -+ private static final long LUKS2_HEADER_SIZE_IN_KIB = 16L << 10; -+ private static final long LUKS2_HEADER_SIZE_IN_BYTES = LUKS2_HEADER_SIZE_IN_KIB << 10; - -- // linstor calculates in KiB -- private static final int MIB = 1024; -- private static final int LUKS1_HEADER_SIZE = 2 * MIB; -- private static final int LUKS2_HEADER_SIZE = 16 * MIB; -+ private static final Pattern PATTERN_SIZE = Pattern.compile("(\\d+)([kKmMgGtT]i?[bB]?|[sS]|)"); - - @Inject - public LuksLayerSizeCalculator(AbsLayerSizeCalculatorInit initRef) -@@ -74,30 +109,266 @@ public class LuksLayerSizeCalculator extends AbsLayerSizeCalculator vlmDataRef) -- throws AccessDeniedException -+ throws AccessDeniedException, InvalidSizeException - { -- ExtToolsInfo cryptSetupInfo = vlmDataRef.getRscLayerObject() -+ @Nullable Peer peer = vlmDataRef.getRscLayerObject() - .getAbsResource() - .getNode() -- .getPeer(sysCtx) -- .getExtToolsManager() -+ .getPeer(sysCtx); -+ if (peer == null) -+ { -+ throw new InvalidSizeException( -+ "Could not calculate size of LUKS volume, since cryptsetup's version could not be determined", -+ null -+ ); -+ } -+ ExtToolsInfo cryptSetupInfo = peer.getExtToolsManager() - .getExtToolInfo(ExtTools.CRYPT_SETUP); -- long luksHeaderSize; -+ -+ final long luksHeaderSize; - if (cryptSetupInfo != null && cryptSetupInfo.isSupported()) - { - if (cryptSetupInfo.hasVersionOrHigher(new Version(2, 1))) - { -- luksHeaderSize = LUKS2_HEADER_SIZE; -+ luksHeaderSize = calcLuks2HeaderSize(vlmDataRef); - } - else - { -- luksHeaderSize = LUKS1_HEADER_SIZE; -+ luksHeaderSize = LUKS1_HEADER_SIZE_IN_KIB; - } - } - else - { -- luksHeaderSize = -1; -+ throw new InvalidSizeException( -+ "Could not calculate size of LUKS volume, since cryptsetup's version could not be determined", -+ null -+ ); - } - return luksHeaderSize; - } -+ -+ private long calcLuks2HeaderSize(VlmProviderObject vlmDataRef) throws AccessDeniedException -+ { -+ PriorityProps prioProps = getPrioProps(vlmDataRef); -+ -+ final @Nullable String userOptProp = prioProps.getProp( -+ ApiConsts.KEY_STOR_DRIVER_LUKS_FORMAT_OPTIONS, -+ ApiConsts.NAMESPC_STORAGE_DRIVER -+ ); -+ List userOptions = userOptProp != null ? -+ ShellUtils.shellSplit(userOptProp) : -+ new LinkedList<>(); -+ -+ final long alignedHeaderSizeInBytes; -+ final long unalignedHeaderSizeInBytes; -+ @Nullable Long cryptsetupOffsetInBytes = getLongOptionValue( -+ userOptions, -+ LUKS2_OPT_OFFSET, -+ SizeUnit.UNIT_SECTORS -+ ); -+ if (cryptsetupOffsetInBytes != null) -+ { -+ alignedHeaderSizeInBytes = cryptsetupOffsetInBytes; -+ } -+ else -+ { -+ @Nullable Long cryptsetupLuks2KeyslotsSize = getLongOptionValue( -+ userOptions, -+ LUKS2_OPT_KEYSLOTS_SIZE -+ ); -+ if (cryptsetupLuks2KeyslotsSize == null) -+ { -+ unalignedHeaderSizeInBytes = LUKS2_HEADER_SIZE_IN_BYTES; -+ } -+ else -+ { -+ @Nullable Long cryptsetupLuks2MetadataSize = getLongOptionValue( -+ userOptions, -+ LUKS2_OPT_METADATA_SIZE -+ ); -+ cryptsetupLuks2MetadataSize = cryptsetupLuks2MetadataSize == null ? -+ DFLT_LUKS2_METADATA_SIZE_IN_BYTES : -+ cryptsetupLuks2MetadataSize; -+ -+ unalignedHeaderSizeInBytes = 2 * cryptsetupLuks2MetadataSize + cryptsetupLuks2KeyslotsSize; -+ } -+ -+ long alignment = getAlignment(vlmDataRef, userOptions); -+ alignedHeaderSizeInBytes = new SignedAlign(alignment).ceiling(unalignedHeaderSizeInBytes); -+ } -+ return SizeConv.convert( -+ alignedHeaderSizeInBytes, -+ SizeUnit.UNIT_B, -+ SizeUnit.UNIT_KiB -+ ); -+ } -+ -+ private long getAlignment(VlmProviderObject vlmDataRef, List userOptions) throws AccessDeniedException -+ { -+ @Nullable Long cryptsetupAlignPayloadInBytes = getLongOptionValue( -+ userOptions, -+ LUKS2_OPT_ALIGN_PAYLOAD, -+ SizeUnit.UNIT_SECTORS -+ ); -+ -+ long alignment = DFLT_ALIGNMENT_1MIB_IN_BYTES; -+ if (cryptsetupAlignPayloadInBytes != null) -+ { -+ alignment = cryptsetupAlignPayloadInBytes; -+ } -+ else -+ { -+ final long maxOptIoSize = getMaxOptIoSize(vlmDataRef); -+ alignment = Math.max(alignment, maxOptIoSize); -+ } -+ return alignment; -+ } -+ -+ private long getMaxOptIoSize(VlmProviderObject vlmDataRef) throws InvalidKeyException, AccessDeniedException -+ { -+ long ret = 0; -+ Set storPoolSet = LayerVlmUtils.getStorPoolSet(vlmDataRef, sysCtx); -+ for (StorPool sp : storPoolSet) -+ { -+ @Nullable String strValue = sp.getProps(sysCtx) -+ .getProp( -+ StorageConstants.BLK_DEV_OPT_IO_SIZE, -+ StorageConstants.NAMESPACE_INTERNAL -+ ); -+ if (strValue != null) -+ { -+ try -+ { -+ long parsed = Long.parseLong(strValue); -+ ret = Math.max(parsed, ret); -+ } -+ catch (NumberFormatException ignored) -+ { -+ errorReporter.logWarning( -+ "LuksHeaderSize: Failed to parse '%s' from prop %s. Defaulting to 0 opt_io_size " + -+ "(no recommendation/hint)", -+ strValue, -+ StorageConstants.NAMESPACE_INTERNAL + "/" + StorageConstants.BLK_DEV_OPT_IO_SIZE -+ ); -+ } -+ } -+ } -+ return ret; -+ } -+ -+ private @Nullable Long getLongOptionValue(List userOptionsRef, String optRef) -+ { -+ return getLongOptionValue(userOptionsRef, optRef, SizeUnit.UNIT_B); -+ } -+ -+ @SuppressWarnings("checkstyle:magicnumber") -+ private @Nullable Long getLongOptionValue(List userOptionsRef, String optRef, SizeUnit dfltSizeUnit) -+ { -+ @Nullable Long ret = null; -+ @Nullable String val = findLastValue(userOptionsRef, optRef); -+ if (val != null && !val.isBlank()) -+ { -+ Matcher matcher = PATTERN_SIZE.matcher(val); -+ if (matcher.matches()) -+ { -+ try -+ { -+ ret = Long.parseLong(matcher.group(1)); -+ String unit = matcher.group(2); -+ SizeUnit sizeUnit; -+ if (unit.isBlank()) -+ { -+ sizeUnit = dfltSizeUnit; -+ } -+ else -+ { -+ boolean forcePowerOfTwo = unit.length() == 1 || unit.length() == 3; -+ sizeUnit = SizeUnit.parse(unit, forcePowerOfTwo); -+ } -+ -+ ret = SizeConv.convert(ret, sizeUnit, SizeUnit.UNIT_B); -+ } -+ catch (NumberFormatException ignored) -+ { -+ errorReporter.logWarning( -+ "LuksHeaderSize: Failed to parse '%s' from option '%s %s'.", -+ matcher.group(1), -+ optRef, -+ val -+ ); -+ } -+ } -+ } -+ return ret; -+ } -+ -+ private @Nullable String findLastValue(List userOptionsRef, String optRef) -+ { -+ Iterator it = userOptionsRef.iterator(); -+ @Nullable String val = null; -+ while (it.hasNext()) -+ { -+ String opt = it.next(); -+ if (opt.equals(optRef)) -+ { -+ if (it.hasNext()) -+ { -+ val = it.next(); -+ } -+ else -+ { -+ val = null; -+ } -+ } -+ else if (opt.startsWith(optRef + "=")) -+ { -+ val = opt.substring(optRef.length() + 1); -+ if (val.isBlank()) -+ { -+ val = null; -+ } -+ } -+ } -+ return val; -+ } -+ -+ private PriorityProps getPrioProps(VlmProviderObject vlmDataRef) throws AccessDeniedException -+ { -+ final AbsVolume vlm = vlmDataRef.getVolume(); -+ final AbsResource rsc = vlm.getAbsResource(); -+ final ResourceDefinition rscDfn = vlm.getResourceDefinition(); -+ final VolumeDefinition vlmDfn = vlm.getVolumeDefinition(); -+ final ResourceGroup rscGrp = rscDfn.getResourceGroup(); -+ -+ final ReadOnlyProps vlmProps; -+ final ReadOnlyProps rscProps; -+ if (vlm instanceof Volume) -+ { -+ vlmProps = ((Volume) vlm).getProps(sysCtx); -+ rscProps = ((Resource) rsc).getProps(sysCtx); -+ } -+ else -+ { -+ vlmProps = ((SnapshotVolume) vlm).getVlmProps(sysCtx); -+ rscProps = ((Snapshot) rsc).getRscProps(sysCtx); -+ } -+ -+ final PriorityProps prioProps = new PriorityProps( -+ vlmProps, -+ rscProps -+ ); -+ for (StorPool storPool : LayerVlmUtils.getStorPoolSet(vlmDataRef, sysCtx)) -+ { -+ prioProps.addProps(storPool.getProps(sysCtx)); -+ } -+ prioProps.addProps( -+ rsc.getNode().getProps(sysCtx), -+ vlmDfn.getProps(sysCtx), -+ rscDfn.getProps(sysCtx), -+ rscGrp.getVolumeGroupProps(sysCtx, vlmDfn.getVolumeNumber()), -+ rscGrp.getProps(sysCtx), -+ stltProps -+ ); -+ return prioProps; -+ } - } -diff --git a/server/src/main/java/com/linbit/linstor/layer/storage/BlockSizeConsts.java b/server/src/main/java/com/linbit/linstor/layer/storage/BlockSizeConsts.java ---- a/server/src/main/java/com/linbit/linstor/layer/storage/BlockSizeConsts.java -+++ b/server/src/main/java/com/linbit/linstor/layer/storage/BlockSizeConsts.java -@@ -13,4 +13,9 @@ public class BlockSizeConsts - - // Default value for the minimum_io_size value of non-storage layers - public static final long DFLT_SPECIAL_IO_SIZE = (1L << 12); -+ -+ // optimal_io_size may be 0 to indicate no recommendation. -+ public static final long MIN_OPT_IO_SIZE = 0; -+ public static final long DFLT_OPT_IO_SIZE = 0; -+ public static final long MAX_OPT_IO_SIZE = Long.MAX_VALUE; - } -diff --git a/server/src/main/java/com/linbit/linstor/storage/StorageConstants.java b/server/src/main/java/com/linbit/linstor/storage/StorageConstants.java ---- a/server/src/main/java/com/linbit/linstor/storage/StorageConstants.java -+++ b/server/src/main/java/com/linbit/linstor/storage/StorageConstants.java -@@ -11,6 +11,7 @@ public class StorageConstants - public static final String NAMESPACE_NVME = ApiConsts.NAMESPC_STORAGE_DRIVER + "/NVME"; - public static final String NAMESPACE_INTERNAL = NAMESPACE_STOR_DRIVER + "/internal/"; - -+ public static final String BLK_DEV_OPT_IO_SIZE = "optIoSize"; - public static final String BLK_DEV_MIN_IO_SIZE = "minIoSize"; - public static final String BLK_DEV_MIN_IO_SIZE_AUTO = "minIoSizeAuto"; - public static final String BLK_DEV_MAX_BIO_SIZE = "maxBioSize"; diff --git a/packages/system/linstor/images/piraeus-server/patches/force-metadata-check-on-disk-add.diff b/packages/system/linstor/images/piraeus-server/patches/force-metadata-check-on-disk-add.diff new file mode 100644 index 00000000..0c413005 --- /dev/null +++ b/packages/system/linstor/images/piraeus-server/patches/force-metadata-check-on-disk-add.diff @@ -0,0 +1,63 @@ +diff --git a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java +index a302ee835..01967a31f 100644 +--- a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java ++++ b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java +@@ -371,10 +371,13 @@ public class DrbdLayer implements DeviceLayer + boolean isDiskless = drbdRscData.getAbsResource().isDrbdDiskless(workerCtx); + StateFlags rscFlags = drbdRscData.getAbsResource().getStateFlags(); + boolean isDiskRemoving = rscFlags.isSet(workerCtx, Resource.Flags.DISK_REMOVING); ++ // Check if we're in toggle-disk operation (adding disk to diskless resource) ++ boolean isDiskAdding = rscFlags.isSomeSet(workerCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING); + + boolean contProcess = isDiskless; + +- boolean processChildren = !isDiskless || isDiskRemoving; ++ // Process children when: has disk, removing disk, OR adding disk (toggle-disk) ++ boolean processChildren = !isDiskless || isDiskRemoving || isDiskAdding; + // do not process children when ONLY DRBD_DELETE flag is set (DELETE flag is still unset) + processChildren &= (!rscFlags.isSet(workerCtx, Resource.Flags.DRBD_DELETE) || + rscFlags.isSet(workerCtx, Resource.Flags.DELETE)); +@@ -570,7 +573,11 @@ public class DrbdLayer implements DeviceLayer + { + // hasMetaData needs to be run after child-resource processed + List> createMetaData = new ArrayList<>(); +- if (!drbdRscData.getAbsResource().isDrbdDiskless(workerCtx) && !skipDisk) ++ // Check if we're in toggle-disk operation (adding disk to diskless resource) ++ boolean isDiskAddingForMd = drbdRscData.getAbsResource().getStateFlags() ++ .isSomeSet(workerCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING); ++ // Create metadata when: has disk OR adding disk (toggle-disk), and skipDisk is disabled ++ if ((!drbdRscData.getAbsResource().isDrbdDiskless(workerCtx) || isDiskAddingForMd) && !skipDisk) + { + // do not try to create meta data while the resource is diskless or skipDisk is enabled + for (DrbdVlmData drbdVlmData : checkMetaData) +@@ -988,8 +995,10 @@ public class DrbdLayer implements DeviceLayer + { + List> checkMetaData = new ArrayList<>(); + Resource rsc = drbdRscData.getAbsResource(); ++ // Include DISK_ADD_REQUESTED/DISK_ADDING for toggle-disk scenario where we need to check/create metadata + if (!rsc.isDrbdDiskless(workerCtx) || +- rsc.getStateFlags().isSet(workerCtx, Resource.Flags.DISK_REMOVING) ++ rsc.getStateFlags().isSet(workerCtx, Resource.Flags.DISK_REMOVING) || ++ rsc.getStateFlags().isSomeSet(workerCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING) + ) + { + // using a dedicated list to prevent concurrentModificationException +@@ -1177,9 +1186,16 @@ public class DrbdLayer implements DeviceLayer + + boolean hasMetaData; + ++ // Check if we need to verify/create metadata ++ // Force metadata check when: ++ // 1. checkMetaData is enabled ++ // 2. volume doesn't have disk yet (diskless -> diskful transition) ++ // 3. DISK_ADD_REQUESTED/DISK_ADDING flag is set (retry scenario where storage exists but no metadata) ++ boolean isDiskAddingState = drbdVlmData.getRscLayerObject().getAbsResource().getStateFlags() ++ .isSomeSet(workerCtx, Resource.Flags.DISK_ADD_REQUESTED, Resource.Flags.DISK_ADDING); + if (drbdVlmData.checkMetaData() || +- // when adding a disk, DRBD believes that it is diskless but we still need to create metadata +- !drbdVlmData.hasDisk()) ++ !drbdVlmData.hasDisk() || ++ isDiskAddingState) + { + if (mdUtils.hasMetaData()) + { diff --git a/packages/system/linstor/images/piraeus-server/patches/retry-adjust-after-stale-bitmap.diff b/packages/system/linstor/images/piraeus-server/patches/retry-adjust-after-stale-bitmap.diff deleted file mode 100644 index 00959167..00000000 --- a/packages/system/linstor/images/piraeus-server/patches/retry-adjust-after-stale-bitmap.diff +++ /dev/null @@ -1,141 +0,0 @@ -diff --git a/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/DrbdAdm.java b/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/DrbdAdm.java -index 5627d1be8..ece191292 100644 ---- a/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/DrbdAdm.java -+++ b/satellite/src/main/java/com/linbit/linstor/layer/drbd/utils/DrbdAdm.java -@@ -42,6 +42,9 @@ import java.util.Arrays; - import java.util.List; - import java.util.concurrent.ArrayBlockingQueue; - import java.util.concurrent.TimeUnit; -+import java.nio.charset.StandardCharsets; -+import java.util.regex.Matcher; -+import java.util.regex.Pattern; - import java.util.stream.Collectors; - - @Singleton -@@ -56,6 +58,9 @@ public class DrbdAdm - - public static final int WAIT_CONNECT_RES_TIME = 10; - private static final long DOWN_WAIT_TIMEOUT_SEC = 5; -+ private static final long FORCE_DETACH_RETRY_WAIT_MS = 250; -+ private static final String BITMAP_LEAK_ERR_MSG = "already has a bitmap, this should not happen"; -+ private static final Pattern BITMAP_LEAK_MINOR_PATTERN = Pattern.compile("\\bminor\\s+(\\d+)\\b"); - - private final ExtCmdFactory extCmdFactory; - private final AccessContext sysCtx; -@@ -131,8 +136,38 @@ public class DrbdAdm - // command.add(resName); - command.add(drbdRscData.getSuffixedResourceName()); - // execute(Arrays.asList("drbdsetup", "show", drbdRscData.getSuffixedResourceName())); -- execute(command); -- // execute(Arrays.asList("drbdsetup", "show", drbdRscData.getSuffixedResourceName())); -+ String[] commandArr = command.toArray(new String[0]); -+ try -+ { -+ File nullDevice = new File(Platform.nullDevice()); -+ ExtCmd extCmd = extCmdFactory.create(); -+ if (Platform.isWindows()) -+ { -+ extCmd.setTimeout(TimeoutType.WAIT, 5 * 60 * 1000); -+ } -+ -+ OutputData outputData = extCmd.pipeExec(ProcessBuilder.Redirect.from(nullDevice), commandArr); -+ if ( -+ outputData.exitCode != 0 && -+ isBitmapLeakOnAttach(outputData) && -+ cleanupStaleBitmapAndRetry(extCmd, nullDevice, outputData) -+ ) -+ { -+ outputData = extCmd.pipeExec(ProcessBuilder.Redirect.from(nullDevice), commandArr); -+ } -+ if (outputData.exitCode != 0) -+ { -+ throw new ExtCmdFailedException(commandArr, outputData); -+ } -+ } -+ catch (ChildProcessTimeoutException timeoutExc) -+ { -+ throw new ExtCmdFailedException(commandArr, timeoutExc); -+ } -+ catch (IOException ioExc) -+ { -+ throw new ExtCmdFailedException(commandArr, ioExc); -+ } - - drbdRscData.setAdjustRequired(false); - } -@@ -805,6 +840,75 @@ public class DrbdAdm - } - } - -+ static boolean isBitmapLeakOnAttach(OutputData outputData) -+ { -+ return extractBitmapLeakMinor(outputData) != null; -+ } -+ -+ static @Nullable Integer extractBitmapLeakMinor(OutputData outputData) -+ { -+ String stderr = new String(outputData.stderrData, StandardCharsets.UTF_8); -+ if (!stderr.contains(BITMAP_LEAK_ERR_MSG)) -+ { -+ return null; -+ } -+ -+ Matcher matcher = BITMAP_LEAK_MINOR_PATTERN.matcher(stderr); -+ if (!matcher.find()) -+ { -+ return null; -+ } -+ -+ return Integer.parseInt(matcher.group(1)); -+ } -+ -+ private boolean cleanupStaleBitmapAndRetry( -+ ExtCmd extCmd, -+ File nullDevice, -+ OutputData outputData -+ ) -+ throws IOException, ChildProcessTimeoutException, ExtCmdFailedException -+ { -+ @Nullable Integer minor = extractBitmapLeakMinor(outputData); -+ if (minor == null) -+ { -+ return false; -+ } -+ -+ OutputData detachOut = extCmd.pipeExec( -+ ProcessBuilder.Redirect.from(nullDevice), -+ DRBDSETUP_UTIL, -+ "detach", -+ Integer.toString(minor) -+ ); -+ if (detachOut.exitCode == 0) -+ { -+ return true; -+ } -+ -+ OutputData forceDetachOut = extCmd.pipeExec( -+ ProcessBuilder.Redirect.from(nullDevice), -+ DRBDSETUP_UTIL, -+ "detach", -+ Integer.toString(minor), -+ "--force" -+ ); -+ if (forceDetachOut.exitCode != 0) -+ { -+ throw new ExtCmdFailedException(forceDetachOut.executedCommand, forceDetachOut); -+ } -+ -+ try -+ { -+ Thread.sleep(FORCE_DETACH_RETRY_WAIT_MS); -+ } -+ catch (InterruptedException ignored) -+ { -+ Thread.currentThread().interrupt(); -+ } -+ return true; -+ } -+ - public static class DrbdPrimary implements AutoCloseable - { - private final DrbdAdm drbdAdm; diff --git a/packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff b/packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff new file mode 100644 index 00000000..a93d7811 --- /dev/null +++ b/packages/system/linstor/images/piraeus-server/patches/skip-adjust-when-device-inaccessible.diff @@ -0,0 +1,155 @@ +diff --git a/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java b/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java +index 49138a8fd..2f768ca0d 100644 +--- a/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java ++++ b/satellite/src/main/java/com/linbit/linstor/core/devmgr/DeviceHandlerImpl.java +@@ -83,6 +83,8 @@ import java.util.TreeMap; + import java.util.TreeSet; + import java.util.concurrent.atomic.AtomicBoolean; + import java.util.function.Function; ++import java.nio.file.Files; ++import java.nio.file.Paths; + + @Singleton + public class DeviceHandlerImpl implements DeviceHandler +@@ -1646,7 +1648,10 @@ public class DeviceHandlerImpl implements DeviceHandler + private void updateDiscGran(VlmProviderObject vlmData) throws DatabaseException, StorageException + { + String devicePath = vlmData.getDevicePath(); +- if (devicePath != null && vlmData.exists()) ++ // Check if device path physically exists before calling lsblk ++ // This is important for DRBD devices which might be temporarily unavailable during adjust ++ // (drbdadm adjust brings devices down/up, and kernel might not have created the device node yet) ++ if (devicePath != null && vlmData.exists() && Files.exists(Paths.get(devicePath))) + { + if (vlmData.getDiscGran() == VlmProviderObject.UNINITIALIZED_SIZE) + { +diff --git a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java +index 01967a31f..78b8195a4 100644 +--- a/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java ++++ b/satellite/src/main/java/com/linbit/linstor/layer/drbd/DrbdLayer.java +@@ -592,7 +592,29 @@ public class DrbdLayer implements DeviceLayer + // The .res file might not have been generated in the prepare method since it was + // missing information from the child-layers. Now that we have processed them, we + // need to make sure the .res file exists in all circumstances. +- regenerateResFile(drbdRscData); ++ // However, if the underlying devices are not accessible (e.g., LUKS device is closed ++ // during resource deletion), we skip regenerating the res file to avoid errors ++ boolean canRegenerateResFile = true; ++ if (!skipDisk && !drbdRscData.getAbsResource().isDrbdDiskless(workerCtx)) ++ { ++ AbsRscLayerObject dataChild = drbdRscData.getChildBySuffix(RscLayerSuffixes.SUFFIX_DATA); ++ if (dataChild != null) ++ { ++ for (DrbdVlmData drbdVlmData : drbdRscData.getVlmLayerObjects().values()) ++ { ++ VlmProviderObject childVlm = dataChild.getVlmProviderObject(drbdVlmData.getVlmNr()); ++ if (childVlm == null || !childVlm.exists() || childVlm.getDevicePath() == null) ++ { ++ canRegenerateResFile = false; ++ break; ++ } ++ } ++ } ++ } ++ if (canRegenerateResFile) ++ { ++ regenerateResFile(drbdRscData); ++ } + + // createMetaData needs rendered resFile + for (DrbdVlmData drbdVlmData : createMetaData) +@@ -766,19 +788,72 @@ public class DrbdLayer implements DeviceLayer + + if (drbdRscData.isAdjustRequired()) + { +- try ++ // Check if underlying devices are accessible before adjusting ++ // This is important for encrypted resources (LUKS) where the device ++ // might be closed during deletion ++ boolean canAdjust = true; ++ ++ // IMPORTANT: Check child volumes only when disk access is actually needed. ++ // For network reconnect (StandAlone -> Connected), disk access is not required. ++ boolean needsDiskAccess = false; ++ ++ // Check if there are pending operations that require disk access ++ for (DrbdVlmData drbdVlmData : drbdRscData.getVlmLayerObjects().values()) + { +- drbdUtils.adjust( +- drbdRscData, +- false, +- skipDisk, +- false +- ); ++ Volume vlm = (Volume) drbdVlmData.getVolume(); ++ StateFlags vlmFlags = vlm.getFlags(); ++ ++ // Disk access is needed if: ++ // - creating a new volume ++ // - resizing ++ // - checking/creating metadata ++ if (!drbdVlmData.exists() || ++ drbdVlmData.checkMetaData() || ++ vlmFlags.isSomeSet(workerCtx, Volume.Flags.RESIZE, Volume.Flags.DRBD_RESIZE)) ++ { ++ needsDiskAccess = true; ++ break; ++ } ++ } ++ ++ // Check child volumes only if disk access is actually needed ++ if (needsDiskAccess && !skipDisk && !drbdRscData.getAbsResource().isDrbdDiskless(workerCtx)) ++ { ++ AbsRscLayerObject dataChild = drbdRscData.getChildBySuffix(RscLayerSuffixes.SUFFIX_DATA); ++ if (dataChild != null) ++ { ++ for (DrbdVlmData drbdVlmData : drbdRscData.getVlmLayerObjects().values()) ++ { ++ VlmProviderObject childVlm = dataChild.getVlmProviderObject(drbdVlmData.getVlmNr()); ++ if (childVlm == null || !childVlm.exists() || childVlm.getDevicePath() == null) ++ { ++ canAdjust = false; ++ break; ++ } ++ } ++ } + } +- catch (ExtCmdFailedException extCmdExc) ++ ++ if (canAdjust) ++ { ++ try ++ { ++ drbdUtils.adjust( ++ drbdRscData, ++ false, ++ skipDisk, ++ false ++ ); ++ } ++ catch (ExtCmdFailedException extCmdExc) ++ { ++ restoreBackupResFile(drbdRscData); ++ throw extCmdExc; ++ } ++ } ++ else + { +- restoreBackupResFile(drbdRscData); +- throw extCmdExc; ++ drbdRscData.setAdjustRequired(false); + } + } + +diff --git a/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java b/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java +index cdca0b6d2..89c8be9da 100644 +--- a/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java ++++ b/satellite/src/main/java/com/linbit/linstor/layer/luks/LuksLayer.java +@@ -383,6 +383,7 @@ public class LuksLayer implements DeviceLayer + vlmData.setSizeState(Size.AS_EXPECTED); + + vlmData.setOpened(true); ++ vlmData.setExists(true); + vlmData.setFailed(false); + } + } diff --git a/packages/system/linstor/templates/cluster.yaml b/packages/system/linstor/templates/cluster.yaml index e45b1dff..ba611e17 100644 --- a/packages/system/linstor/templates/cluster.yaml +++ b/packages/system/linstor/templates/cluster.yaml @@ -20,8 +20,6 @@ spec: - name: DrbdOptions/auto-diskful-allow-cleanup value: {{ .Values.linstor.autoDiskful.allowCleanup | quote }} {{- end }} - - name: DrbdOptions/Net/verify-alg - value: "crc32c" - name: DrbdOptions/Net/connect-int value: "15" - name: DrbdOptions/Net/ping-int diff --git a/packages/system/linstor/templates/satellites-cozy.yaml b/packages/system/linstor/templates/satellites-cozy.yaml index e6f877a0..c621126d 100644 --- a/packages/system/linstor/templates/satellites-cozy.yaml +++ b/packages/system/linstor/templates/satellites-cozy.yaml @@ -14,11 +14,6 @@ spec: containers: - name: linstor-satellite image: {{ .Values.piraeusServer.image.repository }}:{{ .Values.piraeusServer.image.tag }} - startupProbe: - tcpSocket: - port: linstor - periodSeconds: 10 - failureThreshold: 30 securityContext: # real-world installations need some debugging from time to time readOnlyRootFilesystem: false diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml index 62dd2cac..c9bafdbe 100644 --- a/packages/system/linstor/values.yaml +++ b/packages/system/linstor/values.yaml @@ -1,7 +1,7 @@ piraeusServer: image: repository: ghcr.io/cozystack/cozystack/piraeus-server - tag: 1.33.2@sha256:553f313ab35dc2e345ef3683156d29e75c23177e2750e9af3a83aa9e23941cbb + tag: 1.32.3@sha256:6d2b12f4bb0641f997b96b93f9c9d29efeb790fb1f179e2856b85ab992235bf8 # Talos-specific workarounds (disable for generic Linux like Ubuntu/Debian) talos: enabled: true @@ -13,4 +13,4 @@ linstor: linstorCSI: image: repository: ghcr.io/cozystack/cozystack/linstor-csi - tag: v1.10.5@sha256:b8f59b5659fb1791cb764d3f37df4cf29920aadcc10637231ba7d857233f377d + tag: v1.10.5@sha256:651d67f0f2123c4ef5cb15c6be9f9c3c759549d3304467e492a01588cf8bd50e diff --git a/packages/system/mariadb-rd/cozyrds/mariadb.yaml b/packages/system/mariadb-rd/cozyrds/mariadb.yaml index 6dacdf0e..5e8088c8 100644 --- a/packages/system/mariadb-rd/cozyrds/mariadb.yaml +++ b/packages/system/mariadb-rd/cozyrds/mariadb.yaml @@ -8,7 +8,7 @@ spec: plural: mariadbs singular: mariadb openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of MariaDB replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"MariaDB major.minor version to deploy","type":"string","default":"v11.8","enum":["v11.8","v11.4","v10.11","v10.6"]},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["maxUserConnections","password"],"properties":{"maxUserConnections":{"description":"Maximum number of connections.","type":"integer"},"password":{"description":"Password for the user.","type":"string"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":""},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/mariadb-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}}}} + {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["cleanupStrategy","enabled","resticPassword","s3AccessKey","s3Bucket","s3Region","s3SecretKey","schedule"],"properties":{"cleanupStrategy":{"description":"Retention strategy for cleaning up old backups.","type":"string","default":"--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"},"enabled":{"description":"Enable regular backups (default: false).","type":"boolean","default":false},"resticPassword":{"description":"Password for Restic backup encryption.","type":"string","default":""},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3Bucket":{"description":"S3 bucket used for storing backups.","type":"string","default":"s3.example.org/mariadb-backups"},"s3Region":{"description":"AWS S3 region where backups are stored.","type":"string","default":"us-east-1"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of MariaDB replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["maxUserConnections","password"],"properties":{"maxUserConnections":{"description":"Maximum number of connections.","type":"integer"},"password":{"description":"Password for the user.","type":"string"}}}},"version":{"description":"MariaDB major.minor version to deploy","type":"string","default":"v11.8","enum":["v11.8","v11.4","v10.11","v10.6"]}}} release: prefix: mariadb- labels: diff --git a/packages/system/mongodb-rd/cozyrds/mongodb.yaml b/packages/system/mongodb-rd/cozyrds/mongodb.yaml index 78141023..a79398c2 100644 --- a/packages/system/mongodb-rd/cozyrds/mongodb.yaml +++ b/packages/system/mongodb-rd/cozyrds/mongodb.yaml @@ -8,7 +8,7 @@ spec: singular: mongodb plural: mongodbs openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of MongoDB replicas in replica set.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each MongoDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"MongoDB major version to deploy.","type":"string","default":"v8","enum":["v8","v7","v6"]},"sharding":{"description":"Enable sharded cluster mode. When disabled, deploys a replica set.","type":"boolean","default":false},"shardingConfig":{"description":"Configuration for sharded cluster mode.","type":"object","default":{},"required":["configServerSize","configServers","mongos"],"properties":{"configServerSize":{"description":"PVC size for config servers.","default":"3Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"configServers":{"description":"Number of config server replicas.","type":"integer","default":3},"mongos":{"description":"Number of mongos router replicas.","type":"integer","default":2},"shards":{"description":"List of shard configurations.","type":"array","default":[{"name":"rs0","replicas":3,"size":"10Gi"}],"items":{"type":"object","required":["name","replicas","size"],"properties":{"name":{"description":"Shard name.","type":"string"},"replicas":{"description":"Number of replicas in this shard.","type":"integer"},"size":{"description":"PVC size for this shard.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges (readWrite + dbAdmin).","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["backupName","enabled"],"properties":{"backupName":{"description":"Name of backup to restore from.","type":"string","default":""},"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"recoveryTime":{"description":"Timestamp for point-in-time recovery; empty means latest.","type":"string","default":""}}}}} + {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["backupName","enabled"],"properties":{"backupName":{"description":"Name of backup to restore from.","type":"string","default":""},"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"recoveryTime":{"description":"Timestamp for point-in-time recovery; empty means latest.","type":"string","default":""}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges (readWrite + dbAdmin).","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of MongoDB replicas in replica set.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each MongoDB replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"sharding":{"description":"Enable sharded cluster mode. When disabled, deploys a replica set.","type":"boolean","default":false},"shardingConfig":{"description":"Configuration for sharded cluster mode.","type":"object","default":{},"required":["configServerSize","configServers","mongos"],"properties":{"configServerSize":{"description":"PVC size for config servers.","default":"3Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"configServers":{"description":"Number of config server replicas.","type":"integer","default":3},"mongos":{"description":"Number of mongos router replicas.","type":"integer","default":2},"shards":{"description":"List of shard configurations.","type":"array","default":[{"name":"rs0","replicas":3,"size":"10Gi"}],"items":{"type":"object","required":["name","replicas","size"],"properties":{"name":{"description":"Shard name.","type":"string"},"replicas":{"description":"Number of replicas in this shard.","type":"integer"},"size":{"description":"PVC size for this shard.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"}}}},"version":{"description":"MongoDB major version to deploy.","type":"string","default":"v8","enum":["v8","v7","v6"]}}} release: prefix: mongodb- labels: diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml deleted file mode 100644 index 5e0f9ea0..00000000 --- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml +++ /dev/null @@ -1,172 +0,0 @@ -apiVersion: operator.victoriametrics.com/v1beta1 -kind: VMRule -metadata: - name: alerts-gpu-recording.rules -spec: - groups: - - name: gpu.recording.cluster.1m - interval: 1m - params: {} - rules: - - record: cluster:gpu_count:total - expr: count(group by (UUID) (DCGM_FI_DEV_GPU_UTIL)) - # Kube-allocated GPU count: GPUs requested by *active* pods — Pending - # and Running only. Source of truth for "what tenants asked for" — used - # for capacity planning and billing. Includes system pods so it stays - # consistent with cluster:gpu_count:total when computing :free. - # - # Phase filter via group_left() on kube_pod_status_phase matches the - # canonical pattern from k8s.rules.container_resource.yaml. Without it - # kube-state-metrics keeps series for Failed/Succeeded pods until the - # apiserver garbage-collects them, which inflates billing hours and - # can push :free negative. - - record: cluster:gpu_count:allocated - expr: | - sum( - kube_pod_container_resource_requests{resource="nvidia_com_gpu"} - * on (namespace, pod) group_left() max by (namespace, pod) ( - kube_pod_status_phase{phase=~"Pending|Running"} == 1 - ) - ) - # clamp_min guards against transients at DCGM/kube-state-metrics - # restart where cluster:gpu_count:total dips before :allocated catches - # up, or rare label drift between the two sources. - - record: cluster:gpu_count:free - expr: clamp_min(cluster:gpu_count:total - (cluster:gpu_count:allocated or vector(0)), 0) - # Cluster-layer filter asymmetry — intentional, not a bug: - # - # * cluster:gpu_count:total and cluster:gpu_power_watts:sum do NOT - # filter cozy-*/kube-* namespaces because they describe the - # physical hardware fleet. A GPU draws power and occupies a - # slot regardless of which namespace's pod happens to hold it; - # excluding infra pods would under-report raw capacity and - # break capacity-planning math. - # - # No namespace filter — DCGM exporter metrics carry the exporter's - # own namespace, not the workload namespace. Filtering by namespace - # here would silently drop all series. - - record: cluster:gpu_util:avg - expr: avg(DCGM_FI_DEV_GPU_UTIL) - - record: cluster:gpu_power_watts:sum - expr: sum(DCGM_FI_DEV_POWER_USAGE) - - - name: gpu.recording.node.1m - interval: 1m - params: {} - rules: - # Kube-requested GPU count per namespace — billable/allocation view. - # This is the only namespace-level rule that works correctly because - # kube_pod_container_resource_requests carries the real workload - # namespace, unlike DCGM exporter metrics which carry the exporter's - # own namespace (cozy-gpu-operator). - - record: namespace:gpu_count:allocated - expr: | - sum by (namespace) ( - kube_pod_container_resource_requests{resource="nvidia_com_gpu", namespace!="", namespace!~"cozy-.*|kube-.*"} - * on (namespace, pod) group_left() max by (namespace, pod) ( - kube_pod_status_phase{phase=~"Pending|Running"} == 1 - ) - ) - # Hardware metrics aggregated per node (Hostname). DCGM exporter - # metrics carry a capital-H "Hostname" label identifying the node - # but no usable workload namespace — so hardware telemetry is - # aggregated at node/GPU granularity, not namespace. - - record: node:gpu_util:avg - expr: avg by (Hostname) (DCGM_FI_DEV_GPU_UTIL) - - record: node:tensor_active:avg - expr: avg by (Hostname) (DCGM_FI_PROF_PIPE_TENSOR_ACTIVE) - - record: node:fb_used_bytes:sum - expr: sum by (Hostname) (DCGM_FI_DEV_FB_USED) * 1048576 - - record: node:power_watts:sum - expr: sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE) - - # Known gap: there is no lower-bound sanity alert for under-reporting. - # If DCGM ever switches POWER/THERMAL_VIOLATION counter units the other - # direction — e.g. from the current nanoseconds back to microseconds, - # making rate()/1e9 produce values around 0.001 instead of real - # fractions — the throttle signal would silently collapse to near-zero - # instead of plateauing at 1.0. GPUThrottleFractionOverOne below catches - # the >1 drift; the <<1 drift would require correlation with independent - # signals (power draw vs TDP, clock dips) that we do not yet wire up. - # Documented here so future maintainers know this is a known gap, not - # an oversight. - - name: gpu.recording.efficiency.1m - interval: 1m - params: {} - rules: - # Tensor hardware saturation per GPU — the honest "am I using the GPU" - # metric for AI/LLM workloads. Aggregated at GPU level (Hostname + - # gpu + UUID) because DCGM metrics don't carry workload namespace. - # Stored as a 0..1 ratio; consumers multiply by 100 at display time. - - record: gpu:tensor_saturation:avg5m - expr: | - avg by (Hostname, gpu, UUID) ( - avg_over_time(DCGM_FI_PROF_PIPE_TENSOR_ACTIVE[5m]) - ) - - # Power efficiency per GPU — utilization per watt, reveals - # unoptimized workloads. Explicit on(...) pins the matching set - # to GPU-identifying labels. - - record: gpu:util_per_watt:avg5m - expr: | - max by (Hostname, gpu, UUID) ( - avg_over_time(DCGM_FI_DEV_GPU_UTIL[5m]) - ) - / on (Hostname, gpu, UUID) - clamp_min( - max by (Hostname, gpu, UUID) ( - avg_over_time(DCGM_FI_DEV_POWER_USAGE[5m]) - ), - 1 - ) - - # Fraction of time power-throttled (TDP cap) — 1.0 = fully throttled. - # DCGM_FI_DEV_*_VIOLATION is documented as µs but on A10/DCGM 3.x the - # counter grows in nanoseconds in practice — divide by 1e9 to get a - # 0..1 fraction (verified empirically when /1e6 yielded >100× reality). - # clamp_max protects against rate() artefacts at counter resets. - # - # max by (Hostname, gpu, UUID) collapses duplicate series from - # dcgm-exporter's pod-mapping labels (one physical GPU may appear - # under multiple pod/container labels during restarts or under - # MIG/MPS). Throttling is a physical-GPU property; taking max - # keeps consumer avg(...) honest — a naive avg() would dilute the - # signal by the number of pods sharing the GPU. - - record: gpu:power_throttle_fraction:rate5m - expr: clamp_max(max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_POWER_VIOLATION[5m]) / 1e9), 1) - - # Fraction of time thermal-throttled. - - record: gpu:thermal_throttle_fraction:rate5m - expr: clamp_max(max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_THERMAL_VIOLATION[5m]) / 1e9), 1) - - # Regression watch — the /1e9 divisor on *_VIOLATION was derived - # empirically against DCGM 3.x on A10. If a future DCGM version - # restores the documented µs units, pre-clamp values would exceed 1.0 - # while clamp_max(..., 1) silently masks the drift — recorded - # throttle fractions would plateau at 1.0 and consumers would think - # every GPU is always throttled. This alert fires on that condition - # so we can rescale to /1e6 before dashboards start lying. - - name: gpu.recording.throttle.validation.5m - interval: 5m - params: {} - rules: - - alert: GPUThrottleFractionOverOne - expr: | - max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_POWER_VIOLATION[5m]) / 1e9) > 1 - or - max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_THERMAL_VIOLATION[5m]) / 1e9) > 1 - for: 15m - labels: - severity: warning - component: gpu-monitoring - annotations: - summary: "DCGM throttle fraction exceeds 1.0 pre-clamp on {{ $labels.Hostname }}/{{ $labels.gpu }}" - description: | - gpu:{power,thermal}_throttle_fraction:rate5m clamps to 1.0, but the raw - rate(DCGM_FI_DEV_*_VIOLATION)/1e9 value is already >1 on this GPU — the - empirical nanosecond assumption is broken. Likely the DCGM exporter - version changed and the counter now grows in its documented µs units. - Re-verify on the exporter Pod and adjust the divisor (/1e9 → /1e6) in - gpu.recording.efficiency.1m before dashboards plateau at 100% throttle. - verified_on: "NVIDIA A10, DCGM 3.x — other GPU families (H100, L40S) may require a different divisor" - runbook: "If this alert fires, DCGM may have changed POWER_VIOLATION/THERMAL_VIOLATION counter units. Recalibrate by comparing raw counter rate against known throttle events; see gpu-recording.rules.yaml comments." diff --git a/packages/system/monitoring-agents/values.yaml b/packages/system/monitoring-agents/values.yaml index bcdee0e0..a4d4b025 100644 --- a/packages/system/monitoring-agents/values.yaml +++ b/packages/system/monitoring-agents/values.yaml @@ -344,8 +344,8 @@ fluent-bit: [OUTPUT] Name http Match kube.* - Host vlinsert-generic.{{ .Values.global.target }}.svc - port 9481 + Host vlogs-generic.{{ .Values.global.target }}.svc + port 9428 compress gzip uri /insert/jsonline?_stream_fields=log_source,stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date format json_lines @@ -355,8 +355,8 @@ fluent-bit: [OUTPUT] Name http Match events.* - Host vlinsert-generic.{{ .Values.global.target }}.svc - port 9481 + Host vlogs-generic.{{ .Values.global.target }}.svc + port 9428 compress gzip uri /insert/jsonline?_stream_fields=log_source,reason,meatdata_namespace,metadata_name&_msg_field=message&_time_field=date format json_lines @@ -366,8 +366,8 @@ fluent-bit: [OUTPUT] Name http Match audit.* - Host vlinsert-generic.{{ .Values.global.target }}.svc - port 9481 + Host vlogs-generic.{{ .Values.global.target }}.svc + port 9428 compress gzip uri /insert/jsonline?_stream_fields=log_source,stage,user_username,verb,requestUri&_msg_field=requestURI&_time_field=date format json_lines diff --git a/packages/system/monitoring-rd/cozyrds/monitoring.yaml b/packages/system/monitoring-rd/cozyrds/monitoring.yaml index ce4d75c5..b79f1cf6 100644 --- a/packages/system/monitoring-rd/cozyrds/monitoring.yaml +++ b/packages/system/monitoring-rd/cozyrds/monitoring.yaml @@ -8,7 +8,7 @@ spec: singular: monitoring plural: monitorings openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"host":{"description":"The hostname used to access Grafana externally (defaults to 'grafana' subdomain for the tenant host).","type":"string","default":""},"metricsStorages":{"description":"Configuration of metrics storage instances.","type":"array","default":[{"deduplicationInterval":"15s","name":"shortterm","retentionPeriod":"3d","storage":"10Gi","storageClassName":""},{"deduplicationInterval":"5m","name":"longterm","retentionPeriod":"14d","storage":"10Gi","storageClassName":""}],"items":{"type":"object","required":["deduplicationInterval","name","retentionPeriod","storage"],"properties":{"deduplicationInterval":{"description":"Deduplication interval for metrics.","type":"string"},"name":{"description":"Name of the storage instance.","type":"string"},"retentionPeriod":{"description":"Retention period for metrics.","type":"string"},"storage":{"description":"Persistent volume size.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used for the data.","type":"string"},"vminsert":{"description":"Configuration for vminsert.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"vmselect":{"description":"Configuration for vmselect.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"vmstorage":{"description":"Configuration for vmstorage.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}},"logsStorages":{"description":"Configuration of logs storage instances.","type":"array","default":[{"name":"generic","retentionPeriod":"1","storage":"10Gi","storageClassName":"replicated"}],"items":{"type":"object","required":["name","retentionPeriod","storage","storageClassName"],"properties":{"name":{"description":"Name of the storage instance.","type":"string"},"retentionPeriod":{"description":"Retention period for logs.","type":"string","default":"1"},"storage":{"description":"Persistent volume size.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}},"alerta":{"description":"Configuration for the Alerta service.","type":"object","default":{},"properties":{"alerts":{"description":"Alert routing configuration.","type":"object","default":{},"properties":{"slack":{"description":"Configuration for Slack alerts.","type":"object","default":{},"required":["url"],"properties":{"disabledSeverity":{"description":"List of severities without alerts (e.g. [\"informational\",\"warning\"]).","type":"array","default":[],"items":{"type":"string"}},"url":{"description":"Configuration uri for Slack alerts.","type":"string","default":""}}},"telegram":{"description":"Configuration for Telegram alerts.","type":"object","default":{},"required":["chatID","token"],"properties":{"chatID":{"description":"Telegram chat ID(s), separated by commas.","type":"string","default":""},"disabledSeverity":{"description":"List of severities without alerts (e.g. [\"informational\",\"warning\"]).","type":"array","default":[],"items":{"type":"string"}},"token":{"description":"Telegram bot token.","type":"string","default":""}}}}},"resources":{"description":"Resource configuration.","type":"object","default":{},"properties":{"limits":{"description":"Resource limits.","type":"object","default":{},"properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"requests":{"description":"Resource requests.","type":"object","default":{},"properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"storage":{"description":"Persistent volume size for the database.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used for the database.","type":"string","default":""}}},"grafana":{"description":"Configuration for Grafana.","type":"object","default":{},"properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"size":{"description":"Persistent volume size for the database.","type":"string","default":"10Gi"}}},"resources":{"description":"Resource configuration.","type":"object","default":{},"properties":{"limits":{"description":"Resource limits.","type":"object","default":{},"properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"requests":{"description":"Resource requests.","type":"object","default":{},"properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}},"vmagent":{"description":"Configuration for VictoriaMetrics Agent.","type":"object","default":{},"properties":{"externalLabels":{"description":"External labels applied to all metrics.","type":"object","default":{"cluster":"cozystack"}},"remoteWrite":{"description":"Remote write configuration.","type":"object","default":{"urls":["http://vminsert-shortterm:8480/insert/0/prometheus","http://vminsert-longterm:8480/insert/0/prometheus"]}}}}}} + {"title":"Chart Values","type":"object","properties":{"alerta":{"description":"Configuration for the Alerta service.","type":"object","default":{},"properties":{"alerts":{"description":"Alert routing configuration.","type":"object","default":{},"properties":{"slack":{"description":"Configuration for Slack alerts.","type":"object","default":{},"required":["url"],"properties":{"disabledSeverity":{"description":"List of severities without alerts (e.g. [\"informational\",\"warning\"]).","type":"array","default":[],"items":{"type":"string"}},"url":{"description":"Configuration uri for Slack alerts.","type":"string","default":""}}},"telegram":{"description":"Configuration for Telegram alerts.","type":"object","default":{},"required":["chatID","token"],"properties":{"chatID":{"description":"Telegram chat ID(s), separated by commas.","type":"string","default":""},"disabledSeverity":{"description":"List of severities without alerts (e.g. [\"informational\",\"warning\"]).","type":"array","default":[],"items":{"type":"string"}},"token":{"description":"Telegram bot token.","type":"string","default":""}}}}},"resources":{"description":"Resource configuration.","type":"object","default":{},"properties":{"limits":{"description":"Resource limits.","type":"object","default":{},"properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"requests":{"description":"Resource requests.","type":"object","default":{},"properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"storage":{"description":"Persistent volume size for the database.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used for the database.","type":"string","default":""}}},"grafana":{"description":"Configuration for Grafana.","type":"object","default":{},"properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"size":{"description":"Persistent volume size for the database.","type":"string","default":"10Gi"}}},"resources":{"description":"Resource configuration.","type":"object","default":{},"properties":{"limits":{"description":"Resource limits.","type":"object","default":{},"properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"requests":{"description":"Resource requests.","type":"object","default":{},"properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}},"host":{"description":"The hostname used to access Grafana externally (defaults to 'grafana' subdomain for the tenant host).","type":"string","default":""},"logsStorages":{"description":"Configuration of logs storage instances.","type":"array","default":[{"name":"generic","retentionPeriod":"1","storage":"10Gi","storageClassName":"replicated"}],"items":{"type":"object","required":["name","retentionPeriod","storage","storageClassName"],"properties":{"name":{"description":"Name of the storage instance.","type":"string"},"retentionPeriod":{"description":"Retention period for logs.","type":"string","default":"1"},"storage":{"description":"Persistent volume size.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}}},"metricsStorages":{"description":"Configuration of metrics storage instances.","type":"array","default":[{"deduplicationInterval":"15s","name":"shortterm","retentionPeriod":"3d","storage":"10Gi","storageClassName":""},{"deduplicationInterval":"5m","name":"longterm","retentionPeriod":"14d","storage":"10Gi","storageClassName":""}],"items":{"type":"object","required":["deduplicationInterval","name","retentionPeriod","storage"],"properties":{"deduplicationInterval":{"description":"Deduplication interval for metrics.","type":"string"},"name":{"description":"Name of the storage instance.","type":"string"},"retentionPeriod":{"description":"Retention period for metrics.","type":"string"},"storage":{"description":"Persistent volume size.","type":"string","default":"10Gi"},"storageClassName":{"description":"StorageClass used for the data.","type":"string"},"vminsert":{"description":"Configuration for vminsert.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"vmselect":{"description":"Configuration for vmselect.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}},"vmstorage":{"description":"Configuration for vmstorage.","type":"object","properties":{"maxAllowed":{"description":"Maximum allowed resources.","type":"object","properties":{"cpu":{"description":"CPU limit.","default":1,"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory limit.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"minAllowed":{"description":"Minimum guaranteed resources.","type":"object","properties":{"cpu":{"description":"CPU request.","default":"100m","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory request.","default":"256Mi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}}}}},"vmagent":{"description":"Configuration for VictoriaMetrics Agent.","type":"object","default":{},"properties":{"externalLabels":{"description":"External labels applied to all metrics.","default":{"cluster":"cozystack"}},"remoteWrite":{"description":"Remote write configuration.","default":{"urls":["http://vminsert-shortterm:8480/insert/0/prometheus","http://vminsert-longterm:8480/insert/0/prometheus"]}}}}}} release: prefix: "" labels: diff --git a/packages/system/monitoring/dashboards-infra.list b/packages/system/monitoring/dashboards-infra.list deleted file mode 100644 index 4c7e494d..00000000 --- a/packages/system/monitoring/dashboards-infra.list +++ /dev/null @@ -1,39 +0,0 @@ -main/controller -main/namespaces -main/capacity-planning -main/ntp -main/namespace -main/pod -main/volumes -main/node -main/nodes -control-plane/control-plane-status -control-plane/deprecated-resources -control-plane/dns-coredns -control-plane/kube-etcd -victoria-metrics/vmalert -victoria-metrics/vmagent -victoria-metrics/victoriametrics-cluster -victoria-metrics/backupmanager -victoria-metrics/victoriametrics -victoria-metrics/operator -dotdc/k8s-views-global -dotdc/k8s-views-namespaces -dotdc/k8s-system-coredns -dotdc/k8s-views-pods -flux/flux-control-plane -flux/flux-stats -kubevirt/kubevirt-control-plane -goldpinger/goldpinger -cache/nginx-vts-stats -storage/linstor -seaweedfs/seaweedfs -hubble/overview -hubble/dns-namespace -hubble/l7-http-metrics -hubble/network-overview -gpu/gpu-performance -gpu/gpu-efficiency -gpu/gpu-quotas -gpu/gpu-fleet -gpu/gpu-tenants diff --git a/packages/system/monitoring/dashboards.list b/packages/system/monitoring/dashboards.list index aee8c2dc..34aead18 100644 --- a/packages/system/monitoring/dashboards.list +++ b/packages/system/monitoring/dashboards.list @@ -1,3 +1,14 @@ +dotdc/k8s-views-global +dotdc/k8s-views-namespaces +dotdc/k8s-system-coredns +dotdc/k8s-views-pods +cache/nginx-vts-stats +victoria-metrics/vmalert +victoria-metrics/vmagent +victoria-metrics/victoriametrics-cluster +victoria-metrics/backupmanager +victoria-metrics/victoriametrics +victoria-metrics/operator ingress/controller-detail ingress/controllers ingress/namespaces @@ -7,8 +18,31 @@ ingress/namespace-detail db/cloudnativepg db/maria-db db/redis +main/controller +main/namespaces +main/capacity-planning +main/ntp +main/namespace +main/pod +main/volumes +main/node +main/nodes +control-plane/control-plane-status +control-plane/deprecated-resources +control-plane/dns-coredns +control-plane/kube-etcd +kubevirt/kubevirt-control-plane +flux/flux-control-plane +flux/flux-stats kafka/strimzi-kafka +goldpinger/goldpinger clickhouse/altinity-clickhouse-operator-dashboard +storage/linstor +seaweedfs/seaweedfs +hubble/overview +hubble/dns-namespace +hubble/l7-http-metrics +hubble/network-overview nats/nats-jetstream nats/nats-server mongodb/mongodb-overview diff --git a/packages/system/monitoring/images/grafana.tag b/packages/system/monitoring/images/grafana.tag index 06eb755a..06fa403d 100644 --- a/packages/system/monitoring/images/grafana.tag +++ b/packages/system/monitoring/images/grafana.tag @@ -1 +1 @@ -ghcr.io/cozystack/cozystack/grafana:0.0.0@sha256:58ee26efdccf81ee79b4d5478df347b91398280600971eaf4b9626b0ca72ed35 +ghcr.io/cozystack/cozystack/grafana:0.0.0@sha256:8ce0cd90c8f614cdabf5a41f8aa50b7dfbd02b31b9a0bd7897927e7f89968e07 diff --git a/packages/system/monitoring/images/grafana/Dockerfile b/packages/system/monitoring/images/grafana/Dockerfile index cc65c9d3..f8597a5c 100644 --- a/packages/system/monitoring/images/grafana/Dockerfile +++ b/packages/system/monitoring/images/grafana/Dockerfile @@ -13,4 +13,3 @@ RUN curl -L https://github.com/VictoriaMetrics/victorialogs-datasource/releases/ RUN grafana-cli --pluginsDir /var/lib/grafana-plugins plugins install natel-discrete-panel RUN grafana-cli --pluginsDir /var/lib/grafana-plugins plugins install grafana-worldmap-panel -RUN grafana-cli --pluginsDir /var/lib/grafana-plugins plugins install marcusolsson-dynamictext-panel diff --git a/packages/system/monitoring/templates/alerta/alerta-db.yaml b/packages/system/monitoring/templates/alerta/alerta-db.yaml index af9dc72c..fc03cd31 100644 --- a/packages/system/monitoring/templates/alerta/alerta-db.yaml +++ b/packages/system/monitoring/templates/alerta/alerta-db.yaml @@ -5,9 +5,6 @@ metadata: name: alerta-db spec: instances: 2 - {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace "alerta-db" }} - {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }} - imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }} {{- if .Values._cluster.scheduling }} {{- $rawConstraints := get .Values._cluster.scheduling "globalAppTopologySpreadConstraints" }} {{- if $rawConstraints }} diff --git a/packages/system/monitoring/templates/alerta/alerta.yaml b/packages/system/monitoring/templates/alerta/alerta.yaml index d30e698d..11aa417e 100644 --- a/packages/system/monitoring/templates/alerta/alerta.yaml +++ b/packages/system/monitoring/templates/alerta/alerta.yaml @@ -140,14 +140,6 @@ spec: - name: SLACK_SEVERITY_FILTER value: {{ .Values.alerta.alerts.slack.disabledSeverity | toJson | quote }} {{- end }} - {{- if .Values.alerta.alerts.slack.dashboardUrl }} - - name: DASHBOARD_URL - value: {{ .Values.alerta.alerts.slack.dashboardUrl | quote }} - {{- end }} - {{- if .Values.alerta.alerts.slack.summaryFmt }} - - name: SLACK_SUMMARY_FMT - value: {{ .Values.alerta.alerts.slack.summaryFmt | quote }} - {{- end }} {{- end }} ports: diff --git a/packages/system/monitoring/templates/dashboards.yaml b/packages/system/monitoring/templates/dashboards.yaml index 0427bfa0..3872f9b7 100644 --- a/packages/system/monitoring/templates/dashboards.yaml +++ b/packages/system/monitoring/templates/dashboards.yaml @@ -14,21 +14,3 @@ spec: url: http://grafana-dashboards.cozy-grafana-operator.svc/{{ . }}.json {{- end }} {{- end }} -{{- if or (eq .Release.Namespace "tenant-root") (eq .Release.Namespace "cozy-monitoring") }} -{{- range (split "\n" (.Files.Get "dashboards-infra.list")) }} -{{- $parts := split "/" . }} -{{- if eq (len $parts) 2 }} ---- -apiVersion: grafana.integreatly.org/v1beta1 -kind: GrafanaDashboard -metadata: - name: {{ $parts._0 }}-{{ $parts._1 }} -spec: - folder: {{ $parts._0 }} - instanceSelector: - matchLabels: - dashboards: grafana - url: http://grafana-dashboards.cozy-grafana-operator.svc/{{ . }}.json -{{- end }} -{{- end }} -{{- end }} diff --git a/packages/system/monitoring/templates/grafana/db.yaml b/packages/system/monitoring/templates/grafana/db.yaml index afc2d0d7..b20a8fd8 100644 --- a/packages/system/monitoring/templates/grafana/db.yaml +++ b/packages/system/monitoring/templates/grafana/db.yaml @@ -4,9 +4,6 @@ metadata: name: grafana-db spec: instances: 2 - {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace "grafana-db" }} - {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }} - imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }} storage: size: {{ .Values.grafana.db.size }} {{- if .Values._cluster.scheduling }} diff --git a/packages/system/monitoring/templates/vlogs/grafana-datasource.yaml b/packages/system/monitoring/templates/vlogs/grafana-datasource.yaml index 72755c6f..0fa41288 100644 --- a/packages/system/monitoring/templates/vlogs/grafana-datasource.yaml +++ b/packages/system/monitoring/templates/vlogs/grafana-datasource.yaml @@ -8,7 +8,7 @@ spec: access: proxy type: victoriametrics-logs-datasource name: vlogs-{{ .name }} - url: http://vlselect-{{ .name }}.{{ $.Release.Namespace }}.svc:9471 + url: http://vlogs-{{ .name }}.{{ $.Release.Namespace }}.svc:9428 instanceSelector: matchLabels: dashboards: grafana diff --git a/packages/system/monitoring/templates/vlogs/vlogs.yaml b/packages/system/monitoring/templates/vlogs/vlogs.yaml index 106d3aaf..adedb1e8 100644 --- a/packages/system/monitoring/templates/vlogs/vlogs.yaml +++ b/packages/system/monitoring/templates/vlogs/vlogs.yaml @@ -1,7 +1,6 @@ {{- range .Values.logsStorages }} ---- -apiVersion: operator.victoriametrics.com/v1 -kind: VLCluster +apiVersion: operator.victoriametrics.com/v1beta1 +kind: VLogs metadata: name: {{ .name }} spec: @@ -10,23 +9,14 @@ spec: apps.cozystack.io/application.group: apps.cozystack.io apps.cozystack.io/application.kind: Monitoring apps.cozystack.io/application.name: {{ $.Release.Name }} - vlinsert: - replicaCount: 2 - resources: {} - vlselect: - replicaCount: 2 - resources: {} - vlstorage: - retentionPeriod: {{ .retentionPeriod | quote }} - replicaCount: 2 - resources: {} - storage: - volumeClaimTemplate: - spec: - {{- with .storageClassName }} - storageClassName: {{ . }} - {{- end }} - resources: - requests: - storage: {{ .storage }} + image: + tag: v1.17.0-victorialogs + storage: + resources: + requests: + storage: {{ .storage }} + storageClassName: {{ .storageClassName }} + accessModes: [ReadWriteOnce] + retentionPeriod: "{{ .retentionPeriod }}" + removePvcAfterDelete: true {{- end }} diff --git a/packages/system/monitoring/templates/vm/vmagent.yaml b/packages/system/monitoring/templates/vm/vmagent.yaml index 98bff1e1..fb3edd30 100644 --- a/packages/system/monitoring/templates/vm/vmagent.yaml +++ b/packages/system/monitoring/templates/vm/vmagent.yaml @@ -11,9 +11,6 @@ spec: externalLabels: cluster: {{ .Values.vmagent.externalLabels.cluster }} tenant: {{ .Release.Namespace }} - {{- if .Values.vmagent.externalLabels.environment }} - environment: {{ .Values.vmagent.externalLabels.environment | quote }} - {{- end }} extraArgs: promscrape.maxScrapeSize: "32MB" promscrape.streamParse: "true" @@ -24,10 +21,6 @@ spec: scrapeInterval: 30s selectAllByDefault: false - {{- with .Values.vmagent.inlineScrapeConfig }} - inlineScrapeConfig: | - {{- . | nindent 4 }} - {{- end }} podScrapeNamespaceSelector: matchLabels: namespace.cozystack.io/monitoring: {{ .Release.Namespace }} diff --git a/packages/system/monitoring/templates/vpa.yaml b/packages/system/monitoring/templates/vpa.yaml index 551f8310..8b90c0ba 100644 --- a/packages/system/monitoring/templates/vpa.yaml +++ b/packages/system/monitoring/templates/vpa.yaml @@ -87,92 +87,3 @@ spec: memory: 8Gi {{- end }} {{- end }} -{{- range .Values.logsStorages }} ---- -apiVersion: autoscaling.k8s.io/v1 -kind: VerticalPodAutoscaler -metadata: - name: vpa-vlinsert-{{ .name }} -spec: - targetRef: - apiVersion: apps/v1 - kind: Deployment - name: vlinsert-{{ .name }} - updatePolicy: - updateMode: Auto - resourcePolicy: - containerPolicies: - - containerName: vlinsert - minAllowed: - {{- if and .vlinsert .vlinsert.minAllowed }} - {{- toYaml .vlinsert.minAllowed | nindent 10 }} - {{- else }} - cpu: 25m - memory: 64Mi - {{- end }} - maxAllowed: - {{- if and .vlinsert .vlinsert.maxAllowed }} - {{- toYaml .vlinsert.maxAllowed | nindent 10 }} - {{- else }} - cpu: 2000m - memory: 4Gi - {{- end }} ---- -apiVersion: autoscaling.k8s.io/v1 -kind: VerticalPodAutoscaler -metadata: - name: vpa-vlselect-{{ .name }} -spec: - targetRef: - apiVersion: apps/v1 - kind: Deployment - name: vlselect-{{ .name }} - updatePolicy: - updateMode: Auto - resourcePolicy: - containerPolicies: - - containerName: vlselect - minAllowed: - {{- if and .vlselect .vlselect.minAllowed }} - {{- toYaml .vlselect.minAllowed | nindent 10 }} - {{- else }} - cpu: 25m - memory: 64Mi - {{- end }} - maxAllowed: - {{- if and .vlselect .vlselect.maxAllowed }} - {{- toYaml .vlselect.maxAllowed | nindent 10 }} - {{- else }} - cpu: 4000m - memory: 8Gi - {{- end }} ---- -apiVersion: autoscaling.k8s.io/v1 -kind: VerticalPodAutoscaler -metadata: - name: vpa-vlstorage-{{ .name }} -spec: - targetRef: - apiVersion: apps/v1 - kind: StatefulSet - name: vlstorage-{{ .name }} - updatePolicy: - updateMode: Auto - resourcePolicy: - containerPolicies: - - containerName: vlstorage - minAllowed: - {{- if and .vlstorage .vlstorage.minAllowed }} - {{- toYaml .vlstorage.minAllowed | nindent 10 }} - {{- else }} - cpu: 25m - memory: 64Mi - {{- end }} - maxAllowed: - {{- if and .vlstorage .vlstorage.maxAllowed }} - {{- toYaml .vlstorage.maxAllowed | nindent 10 }} - {{- else }} - cpu: 4000m - memory: 8Gi - {{- end }} -{{- end }} diff --git a/packages/system/monitoring/values.yaml b/packages/system/monitoring/values.yaml index 3b632cbe..564c654d 100644 --- a/packages/system/monitoring/values.yaml +++ b/packages/system/monitoring/values.yaml @@ -44,7 +44,7 @@ logsStorages: - name: generic retentionPeriod: "1" storage: 10Gi - storageClassName: "" + storageClassName: replicated alerta: storage: 10Gi storageClassName: "" @@ -63,8 +63,6 @@ alerta: slack: url: "" disabledSeverity: [] - dashboardUrl: "" - summaryFmt: "" grafana: db: size: 10Gi @@ -78,12 +76,7 @@ grafana: vmagent: externalLabels: cluster: cozystack - environment: "" remoteWrite: urls: - http://vminsert-shortterm:8480/insert/0/prometheus - - http://vminsert-longterm:8480/insert/0/prometheus - ## inlineScrapeConfig: | - ## - job_name: "custom" - ## static_configs: - ## - targets: ["my-service:9090"] + - http://vminsert-longterm:8480/insert/0/prometheus \ No newline at end of file diff --git a/packages/system/multus/Makefile b/packages/system/multus/Makefile index 399af728..9b34606d 100644 --- a/packages/system/multus/Makefile +++ b/packages/system/multus/Makefile @@ -11,15 +11,3 @@ update: wget -q https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/refs/tags/$(RELEASE)/deployments/multus-daemonset-thick.yml -O templates/multus-daemonset-thick.yml sed -i '/multus-cni/s/snapshot-thick/$(RELEASE)-thick/' templates/multus-daemonset-thick.yml && \ patch --no-backup-if-mismatch -p4 < patches/customize-deployment.patch - $(SED_INPLACE) "/ARG VERSION/ s|=.*|=$(RELEASE)|g" images/multus-cni/Dockerfile - -image: - docker buildx build images/multus-cni \ - --tag $(REGISTRY)/multus-cni:$(call settag,$(TAG)) \ - --cache-from type=registry,ref=$(REGISTRY)/multus-cni:latest \ - --cache-to type=inline \ - --metadata-file images/multus-cni.json \ - $(BUILDX_ARGS) - DIGEST=$$(yq e '."containerimage.digest"' images/multus-cni.json -o json -r) && \ - sed -i "s|image: .*multus-cni.*|image: $(REGISTRY)/multus-cni:$(TAG)@$${DIGEST}|g" templates/multus-daemonset-thick.yml - rm -f images/multus-cni.json diff --git a/packages/system/multus/images/multus-cni/Dockerfile b/packages/system/multus/images/multus-cni/Dockerfile deleted file mode 100644 index feecbc6c..00000000 --- a/packages/system/multus/images/multus-cni/Dockerfile +++ /dev/null @@ -1,25 +0,0 @@ -FROM --platform=$BUILDPLATFORM golang:1.24 AS build - -ARG VERSION=v4.2.3 -ARG TARGETPLATFORM - -WORKDIR /usr/src/multus-cni - -RUN curl -sSL https://github.com/k8snetworkplumbingwg/multus-cni/archive/refs/tags/${VERSION}.tar.gz | \ - tar -xzf - --strip=1 - -COPY patches /patches -RUN git init && git config user.email "build@cozystack" && git config user.name "build" && \ - git add -A && git commit -m "init" && git tag ${VERSION} && \ - git apply /patches/*.diff - -RUN ./hack/build-go.sh - -FROM debian:stable-slim -LABEL org.opencontainers.image.source=https://github.com/cozystack/cozystack -COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin -COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE -COPY --from=build /usr/src/multus-cni/bin/cert-approver / -WORKDIR / - -ENTRYPOINT ["/usr/src/multus-cni/bin/multus-daemon"] diff --git a/packages/system/multus/images/multus-cni/patches/fix-del-without-cache.diff b/packages/system/multus/images/multus-cni/patches/fix-del-without-cache.diff deleted file mode 100644 index 7595ddb2..00000000 --- a/packages/system/multus/images/multus-cni/patches/fix-del-without-cache.diff +++ /dev/null @@ -1,49 +0,0 @@ -diff --git a/pkg/multus/multus.go b/pkg/multus/multus.go -index a7941fe..eff0406 100644 ---- a/pkg/multus/multus.go -+++ b/pkg/multus/multus.go -@@ -954,33 +954,19 @@ func CmdDel(args *skel.CmdArgs, exec invoke.Exec, kubeClient *k8s.ClientInfo) er - } - - if !useCacheConf { -- // Fetch delegates again if cache is not exist and pod info can be read -- if os.IsNotExist(err) && pod != nil { -- if in.ClusterNetwork != "" { -- _, err = k8s.GetDefaultNetworks(pod, in, kubeClient, nil) -- if err != nil { -- return cmdErr(k8sArgs, "failed to get clusterNetwork/defaultNetworks: %v", err) -- } -- // First delegate is always the master plugin -- in.Delegates[0].MasterPlugin = true -- } -- -- // Get pod annotation and so on -- _, _, err := k8s.TryLoadPodDelegates(pod, in, kubeClient, nil) -- if err != nil { -- if len(in.Delegates) == 0 { -- // No delegate available so send error -- return cmdErr(k8sArgs, "failed to get delegates: %v", err) -- } -- // Get clusterNetwork before, so continue to delete -- logging.Errorf("Multus: failed to get delegates: %v, but continue to delete clusterNetwork", err) -- } -- } else { -- // The options to continue with a delete have been exhausted (cachefile + API query didn't work) -- // We cannot exit with an error as this may cause a sandbox to never get deleted. -- logging.Errorf("Multus: failed to get the cached delegates file: %v, cannot properly delete", err) -+ // If cache does not exist, ADD was never completed for this sandbox. -+ // Attempting DEL with a config reconstructed from the API will fail because -+ // delegate plugins (e.g. kube-ovn) require runtime state that only exists -+ // after a successful ADD (socket paths, cached results, etc.). -+ // Return success to allow containerd to release the sandbox name reservation. -+ if os.IsNotExist(err) { -+ logging.Verbosef("Multus: no cache found for container %s (ADD was never completed), skip DEL", args.ContainerID) - return nil - } -+ // The options to continue with a delete have been exhausted -+ // We cannot exit with an error as this may cause a sandbox to never get deleted. -+ logging.Errorf("Multus: failed to get the cached delegates file: %v, cannot properly delete", err) -+ return nil - } - - // set CNIVersion in delegate CNI config if there is no CNIVersion and multus conf have CNIVersion. diff --git a/packages/system/multus/templates/multus-daemonset-thick.yml b/packages/system/multus/templates/multus-daemonset-thick.yml index cad330ea..2f00de85 100644 --- a/packages/system/multus/templates/multus-daemonset-thick.yml +++ b/packages/system/multus/templates/multus-daemonset-thick.yml @@ -119,7 +119,6 @@ data: "cniConfigDir": "/host/etc/cni/net.d", "multusAutoconfigDir": "/host/etc/cni/net.d", "multusConfigFile": "auto", - "multusMasterCNI": "05-cilium.conflist", "socketDir": "/host/run/multus/" } --- @@ -155,7 +154,7 @@ spec: serviceAccountName: multus containers: - name: kube-multus - image: ghcr.io/cozystack/cozystack/multus-cni:v1.3.0@sha256:6735ffc12e5e660951f5a42943b38c308f33774a55836e94c191001405b58ec0 + image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.3-thick command: [ "/usr/src/multus-cni/bin/multus-daemon" ] resources: requests: @@ -201,7 +200,7 @@ spec: fieldPath: spec.nodeName initContainers: - name: install-multus-binary - image: ghcr.io/cozystack/cozystack/multus-cni:v1.3.0@sha256:6735ffc12e5e660951f5a42943b38c308f33774a55836e94c191001405b58ec0 + image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.3-thick command: - "/usr/src/multus-cni/bin/install_multus" - "-d" diff --git a/packages/system/nats-rd/cozyrds/nats.yaml b/packages/system/nats-rd/cozyrds/nats.yaml index 69cad09c..61c590d3 100644 --- a/packages/system/nats-rd/cozyrds/nats.yaml +++ b/packages/system/nats-rd/cozyrds/nats.yaml @@ -8,7 +8,7 @@ spec: plural: natses singular: nats openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each NATS replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}},"jetstream":{"description":"Jetstream configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable Jetstream for persistent messaging in NATS.","type":"boolean","default":true},"size":{"description":"Jetstream persistent storage size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"config":{"description":"NATS configuration.","type":"object","default":{},"properties":{"merge":{"description":"Additional configuration to merge into NATS config.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true},"resolver":{"description":"Additional resolver configuration to merge into NATS config.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}} + {"title":"Chart Values","type":"object","properties":{"config":{"description":"NATS configuration.","type":"object","default":{},"properties":{"merge":{"description":"Additional configuration to merge into NATS config.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true},"resolver":{"description":"Additional resolver configuration to merge into NATS config.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"jetstream":{"description":"Jetstream configuration.","type":"object","default":{},"required":["enabled","size"],"properties":{"enabled":{"description":"Enable or disable Jetstream for persistent messaging in NATS.","type":"boolean","default":true},"size":{"description":"Jetstream persistent storage size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"replicas":{"description":"Number of replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each NATS replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}}}} release: prefix: nats- labels: diff --git a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile index 260446c3..01dafe83 100644 --- a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile +++ b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile @@ -1,13 +1,16 @@ # syntax=docker/dockerfile:1.2 FROM alpine AS source -ARG COMMIT_REF=v0.2.2 -RUN apk add --no-cache curl tar +ARG COMMIT_REF=c2f6e651eb58880627ccddafe0d84fb36e03a780 +RUN apk add --no-cache curl tar git WORKDIR /src RUN curl -sSL https://github.com/kubernetes-sigs/container-object-storage-interface/archive/${COMMIT_REF}.tar.gz \ | tar -xz --strip-components=1 +COPY patches /patches +RUN git apply /patches/*.diff + FROM --platform=$BUILDPLATFORM docker.io/golang:1.24 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/objectstorage-controller/images/objectstorage/patches/89-reconciliation.diff b/packages/system/objectstorage-controller/images/objectstorage/patches/89-reconciliation.diff new file mode 100644 index 00000000..8a3f11ab --- /dev/null +++ b/packages/system/objectstorage-controller/images/objectstorage/patches/89-reconciliation.diff @@ -0,0 +1,398 @@ +diff --git a/controller/pkg/bucketclaim/bucketclaim.go b/controller/pkg/bucketclaim/bucketclaim.go +index 2f4d565e..8ad7baed 100644 +--- a/controller/pkg/bucketclaim/bucketclaim.go ++++ b/controller/pkg/bucketclaim/bucketclaim.go +@@ -32,6 +32,10 @@ func NewBucketClaimListener() *BucketClaimListener { + + // Add creates a bucket in response to a bucketClaim + func (b *BucketClaimListener) Add(ctx context.Context, bucketClaim *v1alpha1.BucketClaim) error { ++ if !bucketClaim.GetDeletionTimestamp().IsZero() { ++ return b.handleDeletion(ctx, bucketClaim) ++ } ++ + klog.V(3).InfoS("Add BucketClaim", + "name", bucketClaim.ObjectMeta.Name, + "ns", bucketClaim.ObjectMeta.Namespace, +@@ -76,18 +80,11 @@ func (b *BucketClaimListener) Update(ctx context.Context, old, new *v1alpha1.Buc + bucketClaim := new.DeepCopy() + + if !new.GetDeletionTimestamp().IsZero() { +- if controllerutil.ContainsFinalizer(bucketClaim, util.BucketClaimFinalizer) { +- bucketName := bucketClaim.Status.BucketName +- err := b.buckets().Delete(ctx, bucketName, metav1.DeleteOptions{}) +- if err != nil { +- klog.V(3).ErrorS(err, "Error deleting bucket", +- "bucket", bucketName, +- "bucketClaim", bucketClaim.ObjectMeta.Name) +- return b.recordError(bucketClaim, v1.EventTypeWarning, v1alpha1.FailedDeleteBucket, err) +- } +- +- klog.V(5).Infof("Successfully deleted bucket: %s from bucketClaim: %s", bucketName, bucketClaim.ObjectMeta.Name) +- } ++ return b.handleDeletion(ctx, bucketClaim) ++ } ++ ++ if err := b.Add(ctx, bucketClaim); err != nil { ++ return err + } + + klog.V(3).InfoS("Update BucketClaim success", +@@ -96,6 +93,27 @@ func (b *BucketClaimListener) Update(ctx context.Context, old, new *v1alpha1.Buc + return nil + } + ++// handleDeletion processes the deletion of a bucketClaim. ++func (b *BucketClaimListener) handleDeletion(ctx context.Context, bucketClaim *v1alpha1.BucketClaim) error { ++ if !controllerutil.ContainsFinalizer(bucketClaim, util.BucketClaimFinalizer) { ++ return nil ++ } ++ ++ bucketName := bucketClaim.Status.BucketName ++ if bucketName != "" { ++ if err := b.buckets().Delete(ctx, bucketName, metav1.DeleteOptions{}); err != nil && !kubeerrors.IsNotFound(err) { ++ klog.V(3).ErrorS(err, "Error deleting bucket", ++ "bucket", bucketName, ++ "bucketClaim", bucketClaim.ObjectMeta.Name) ++ return b.recordError(bucketClaim, v1.EventTypeWarning, v1alpha1.FailedDeleteBucket, err) ++ } ++ klog.V(5).Infof("Successfully requested deletion of bucket: %s for bucketClaim: %s", ++ bucketName, bucketClaim.ObjectMeta.Name) ++ } ++ ++ return nil ++} ++ + // Delete processes a bucket for which bucket request is deleted + func (b *BucketClaimListener) Delete(ctx context.Context, bucketClaim *v1alpha1.BucketClaim) error { + klog.V(3).InfoS("Delete BucketClaim", +diff --git a/controller/pkg/bucketclaim/bucketclaim_test.go b/controller/pkg/bucketclaim/bucketclaim_test.go +index 284185b6..e2e2d3d2 100644 +--- a/controller/pkg/bucketclaim/bucketclaim_test.go ++++ b/controller/pkg/bucketclaim/bucketclaim_test.go +@@ -323,3 +323,32 @@ func TestRecordEvents(t *testing.T) { + func newEvent(eventType, reason, message string) string { + return fmt.Sprintf("%s %s %s", eventType, reason, message) + } ++ ++// Claim already marked for deletion must not create a bucket ++func TestAddDeletedBucketClaim(t *testing.T) { ++ ctx, cancel := context.WithCancel(context.Background()) ++ defer cancel() ++ ++ client := fakebucketclientset.NewSimpleClientset() ++ kubeClient := fakekubeclientset.NewSimpleClientset() ++ eventRecorder := record.NewFakeRecorder(3) ++ ++ listener := NewBucketClaimListener() ++ listener.InitializeKubeClient(kubeClient) ++ listener.InitializeBucketClient(client) ++ listener.InitializeEventRecorder(eventRecorder) ++ ++ _, _ = util.CreateBucketClass(ctx, client, &goldClass) ++ ++ claimToDelete := bucketClaim1.DeepCopy() ++ now := metav1.Now() ++ claimToDelete.ObjectMeta.DeletionTimestamp = &now ++ ++ if err := listener.Add(ctx, claimToDelete); err != nil { ++ t.Fatalf("Add returned error for deleted claim: %v", err) ++ } ++ ++ if bl := util.GetBuckets(ctx, client, 0); len(bl.Items) != 0 { ++ t.Fatalf("expected 0 buckets, got %d", len(bl.Items)) ++ } ++} +diff --git a/sidecar/pkg/bucket/bucket_controller.go b/sidecar/pkg/bucket/bucket_controller.go +index a934d0c5..bf8b5311 100644 +--- a/sidecar/pkg/bucket/bucket_controller.go ++++ b/sidecar/pkg/bucket/bucket_controller.go +@@ -68,6 +68,10 @@ func (b *BucketListener) Add(ctx context.Context, inputBucket *v1alpha1.Bucket) + + var err error + ++ if !bucket.GetDeletionTimestamp().IsZero() { ++ return b.handleDeletion(ctx, bucket) ++ } ++ + klog.V(3).InfoS("Add Bucket", + "name", bucket.ObjectMeta.Name) + +@@ -212,55 +216,60 @@ func (b *BucketListener) Update(ctx context.Context, old, new *v1alpha1.Bucket) + var err error + + if !bucket.GetDeletionTimestamp().IsZero() { +- if controllerutil.ContainsFinalizer(bucket, consts.BABucketFinalizer) { +- bucketClaimNs := bucket.Spec.BucketClaim.Namespace +- bucketClaimName := bucket.Spec.BucketClaim.Name +- bucketAccessList, err := b.bucketAccesses(bucketClaimNs).List(ctx, metav1.ListOptions{}) +- if err != nil { +- klog.V(3).ErrorS(err, "Error fetching BucketAccessList", +- "bucket", bucket.ObjectMeta.Name) +- return err +- } +- +- for _, bucketAccess := range bucketAccessList.Items { +- if strings.EqualFold(bucketAccess.Spec.BucketClaimName, bucketClaimName) { +- err = b.bucketAccesses(bucketClaimNs).Delete(ctx, bucketAccess.Name, metav1.DeleteOptions{}) +- if err != nil { +- klog.V(3).ErrorS(err, "Error deleting BucketAccess", +- "name", bucketAccess.Name, +- "bucket", bucket.ObjectMeta.Name) +- return err +- } +- } +- } ++ return b.handleDeletion(ctx, bucket) ++ } + +- klog.V(5).Infof("Successfully deleted dependent bucketAccess of bucket:%s", bucket.ObjectMeta.Name) ++ if err = b.Add(ctx, bucket); err != nil { ++ return err ++ } + +- controllerutil.RemoveFinalizer(bucket, consts.BABucketFinalizer) +- klog.V(5).Infof("Successfully removed finalizer: %s of bucket: %s", consts.BABucketFinalizer, bucket.ObjectMeta.Name) +- } ++ klog.V(3).InfoS("Update Bucket success", ++ "name", bucket.ObjectMeta.Name, ++ "ns", bucket.ObjectMeta.Namespace) ++ return nil ++} + +- if controllerutil.ContainsFinalizer(bucket, consts.BucketFinalizer) { +- err = b.deleteBucketOp(ctx, bucket) +- if err != nil { +- return b.recordError(bucket, v1.EventTypeWarning, v1alpha1.FailedDeleteBucket, err) +- } ++func (b *BucketListener) handleDeletion(ctx context.Context, bucket *v1alpha1.Bucket) error { ++ var err error + +- controllerutil.RemoveFinalizer(bucket, consts.BucketFinalizer) +- klog.V(5).Infof("Successfully removed finalizer: %s of bucket: %s", consts.BucketFinalizer, bucket.ObjectMeta.Name) +- } ++ if controllerutil.ContainsFinalizer(bucket, consts.BABucketFinalizer) { ++ bucketClaimNs := bucket.Spec.BucketClaim.Namespace ++ bucketClaimName := bucket.Spec.BucketClaim.Name + +- _, err = b.buckets().Update(ctx, bucket, metav1.UpdateOptions{}) ++ bucketAccessList, err := b.bucketAccesses(bucketClaimNs).List(ctx, metav1.ListOptions{}) + if err != nil { +- klog.V(3).ErrorS(err, "Error updating bucket after removing finalizers", ++ klog.V(3).ErrorS(err, "Error fetching BucketAccessList", + "bucket", bucket.ObjectMeta.Name) + return err + } ++ ++ for _, ba := range bucketAccessList.Items { ++ if strings.EqualFold(ba.Spec.BucketClaimName, bucketClaimName) { ++ if err = b.bucketAccesses(bucketClaimNs).Delete(ctx, ba.Name, metav1.DeleteOptions{}); err != nil { ++ klog.V(3).ErrorS(err, "Error deleting BucketAccess", ++ "name", ba.Name, ++ "bucket", bucket.ObjectMeta.Name) ++ return err ++ } ++ } ++ } ++ ++ controllerutil.RemoveFinalizer(bucket, consts.BABucketFinalizer) ++ } ++ ++ if controllerutil.ContainsFinalizer(bucket, consts.BucketFinalizer) { ++ if err = b.deleteBucketOp(ctx, bucket); err != nil { ++ return b.recordError(bucket, v1.EventTypeWarning, v1alpha1.FailedDeleteBucket, err) ++ } ++ controllerutil.RemoveFinalizer(bucket, consts.BucketFinalizer) ++ } ++ ++ if _, err = b.buckets().Update(ctx, bucket, metav1.UpdateOptions{}); err != nil { ++ klog.V(3).ErrorS(err, "Error updating bucket after removing finalizers", ++ "bucket", bucket.ObjectMeta.Name) ++ return err + } + +- klog.V(3).InfoS("Update Bucket success", +- "name", bucket.ObjectMeta.Name, +- "ns", bucket.ObjectMeta.Namespace) + return nil + } + +diff --git a/sidecar/pkg/bucket/bucket_controller_test.go b/sidecar/pkg/bucket/bucket_controller_test.go +index 9be6cc4a..ae63464e 100644 +--- a/sidecar/pkg/bucket/bucket_controller_test.go ++++ b/sidecar/pkg/bucket/bucket_controller_test.go +@@ -310,3 +310,43 @@ func TestRecordEvents(t *testing.T) { + func newEvent(eventType, reason, message string) string { + return fmt.Sprintf("%s %s %s", eventType, reason, message) + } ++ ++// TestAddDeletedBucket tests that the Add method does not call the driver ++func TestAddDeletedBucket(t *testing.T) { ++ driver := "driver1" ++ ++ mpc := struct{ fakespec.FakeProvisionerClient }{} ++ mpc.FakeDriverDeleteBucket = func( ++ _ context.Context, ++ _ *cosi.DriverDeleteBucketRequest, ++ _ ...grpc.CallOption, ++ ) (*cosi.DriverDeleteBucketResponse, error) { ++ t.Fatalf("driver should NOT be called from Add when object has DeletionTimestamp") ++ return nil, nil ++ } ++ ++ now := metav1.Now() ++ b := v1alpha1.Bucket{ ++ ObjectMeta: metav1.ObjectMeta{ ++ Name: "testbucket", ++ DeletionTimestamp: &now, ++ ResourceVersion: "1", ++ }, ++ Spec: v1alpha1.BucketSpec{ ++ DriverName: driver, ++ BucketClassName: "ignored", ++ }, ++ } ++ ++ client := fakebucketclientset.NewSimpleClientset(&b) ++ ++ bl := BucketListener{ ++ driverName: driver, ++ provisionerClient: &mpc, ++ } ++ bl.InitializeBucketClient(client) ++ ++ if err := bl.Add(context.TODO(), &b); err != nil { ++ t.Fatalf("Add returned error for deleted bucket: %v", err) ++ } ++} +diff --git a/sidecar/pkg/bucketaccess/bucketaccess_controller.go b/sidecar/pkg/bucketaccess/bucketaccess_controller.go +index c6d0ed07..dd18202f 100644 +--- a/sidecar/pkg/bucketaccess/bucketaccess_controller.go ++++ b/sidecar/pkg/bucketaccess/bucketaccess_controller.go +@@ -68,6 +68,12 @@ func NewBucketAccessListener(driverName string, client cosi.ProvisionerClient) * + func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1alpha1.BucketAccess) error { + bucketAccess := inputBucketAccess.DeepCopy() + ++ if !bucketAccess.GetDeletionTimestamp().IsZero() { ++ klog.V(3).InfoS("BucketAccess has deletion timestamp, handling deletion", ++ "name", bucketAccess.ObjectMeta.Name) ++ return bal.deleteBucketAccessOp(ctx, bucketAccess) ++ } ++ + if bucketAccess.Status.AccessGranted && bucketAccess.Status.AccountID != "" { + klog.V(3).InfoS("BucketAccess already exists", bucketAccess.ObjectMeta.Name) + return nil +@@ -310,10 +316,13 @@ func (bal *BucketAccessListener) Update(ctx context.Context, old, new *v1alpha1. + + bucketAccess := new.DeepCopy() + if !bucketAccess.GetDeletionTimestamp().IsZero() { +- err := bal.deleteBucketAccessOp(ctx, bucketAccess) +- if err != nil { ++ if err := bal.deleteBucketAccessOp(ctx, bucketAccess); err != nil { + return bal.recordError(bucketAccess, v1.EventTypeWarning, v1alpha1.FailedRevokeAccess, err) + } ++ } else { ++ if err := bal.Add(ctx, bucketAccess); err != nil { ++ return bal.recordError(bucketAccess, v1.EventTypeWarning, v1alpha1.FailedGrantAccess, err) ++ } + } + + klog.V(3).InfoS("Update BucketAccess success", +diff --git a/sidecar/pkg/bucketaccess/bucketaccess_controller_test.go b/sidecar/pkg/bucketaccess/bucketaccess_controller_test.go +index 2371c81e..d8da44a2 100644 +--- a/sidecar/pkg/bucketaccess/bucketaccess_controller_test.go ++++ b/sidecar/pkg/bucketaccess/bucketaccess_controller_test.go +@@ -502,3 +502,94 @@ func TestRecordEvents(t *testing.T) { + func newEvent(eventType, reason, message string) string { + return fmt.Sprintf("%s %s %s", eventType, reason, message) + } ++ ++// TestAddDeletedBucketAccess tests that a deleted BucketAccess does not ++// trigger a call to the driver to grant access, and that no secrets are created. ++func TestAddDeletedBucketAccess(t *testing.T) { ++ driver := "driver" ++ baName := "bucketaccess-deleted" ++ ns := "testns" ++ ++ mpc := struct{ fakespec.FakeProvisionerClient }{} ++ mpc.FakeDriverGrantBucketAccess = func( ++ _ context.Context, ++ _ *cosi.DriverGrantBucketAccessRequest, ++ _ ...grpc.CallOption, ++ ) (*cosi.DriverGrantBucketAccessResponse, error) { ++ t.Fatalf("driver Grant should NOT be called on deleted BA") ++ return nil, nil ++ } ++ mpc.FakeDriverRevokeBucketAccess = func( ++ _ context.Context, ++ _ *cosi.DriverRevokeBucketAccessRequest, ++ _ ...grpc.CallOption, ++ ) (*cosi.DriverRevokeBucketAccessResponse, error) { ++ return &cosi.DriverRevokeBucketAccessResponse{}, nil ++ } ++ ++ // minimal stub objects just to satisfy look-ups inside delete-path ++ bac := &v1alpha1.BucketAccessClass{ ++ ObjectMeta: metav1.ObjectMeta{Name: "bac"}, ++ DriverName: driver, ++ } ++ claim := &v1alpha1.BucketClaim{ ++ ObjectMeta: metav1.ObjectMeta{Name: "claim", Namespace: ns}, ++ Status: v1alpha1.BucketClaimStatus{ ++ BucketReady: true, ++ BucketName: "bucket", ++ }, ++ } ++ bucket := &v1alpha1.Bucket{ ++ ObjectMeta: metav1.ObjectMeta{Name: "bucket"}, ++ Status: v1alpha1.BucketStatus{ ++ BucketReady: true, ++ BucketID: "id", ++ }, ++ } ++ ++ now := metav1.Now() ++ ba := &v1alpha1.BucketAccess{ ++ ObjectMeta: metav1.ObjectMeta{ ++ Name: baName, ++ Namespace: ns, ++ DeletionTimestamp: &now, ++ Finalizers: []string{consts.BAFinalizer}, ++ }, ++ Spec: v1alpha1.BucketAccessSpec{ ++ BucketClaimName: claim.Name, ++ BucketAccessClassName: bac.Name, ++ CredentialsSecretName: "creds", ++ }, ++ Status: v1alpha1.BucketAccessStatus{ ++ AccountID: "acc", ++ AccessGranted: true, ++ }, ++ } ++ ++ secret := &v1.Secret{ ++ ObjectMeta: metav1.ObjectMeta{ ++ Name: "creds", ++ Namespace: ns, ++ Finalizers: []string{consts.SecretFinalizer}, ++ }, ++ StringData: map[string]string{"dummy": "val"}, ++ } ++ ++ client := fakebucketclientset.NewSimpleClientset(bac, claim, bucket, ba) ++ kubeClient := fakekubeclientset.NewSimpleClientset(secret) ++ ++ bal := BucketAccessListener{ ++ driverName: driver, ++ provisionerClient: &mpc, ++ bucketClient: client, ++ kubeClient: kubeClient, ++ } ++ ++ if err := bal.Add(context.TODO(), ba); err != nil { ++ t.Fatalf("Add returned error for deleted BucketAccess: %v", err) ++ } ++ ++ if _, err := bal.secrets(ns).Get(context.TODO(), "creds", metav1.GetOptions{}); !kubeerrors.IsNotFound(err) { ++ t.Fatalf("secret was not cleaned up, err=%v", err) ++ } ++} diff --git a/packages/system/objectstorage-controller/images/objectstorage/patches/90-bucket-name.diff b/packages/system/objectstorage-controller/images/objectstorage/patches/90-bucket-name.diff new file mode 100644 index 00000000..de2d2c6b --- /dev/null +++ b/packages/system/objectstorage-controller/images/objectstorage/patches/90-bucket-name.diff @@ -0,0 +1,13 @@ +diff --git a/controller/pkg/bucketclaim/bucketclaim.go b/controller/pkg/bucketclaim/bucketclaim.go +index 2f4d565e..2addcee8 100644 +--- a/controller/pkg/bucketclaim/bucketclaim.go ++++ b/controller/pkg/bucketclaim/bucketclaim.go +@@ -165,7 +165,7 @@ func (b *BucketClaimListener) provisionBucketClaimOperation(ctx context.Context, + return b.recordError(inputBucketClaim, v1.EventTypeWarning, v1alpha1.FailedCreateBucket, err) + } + +- bucketName = bucketClassName + string(bucketClaim.ObjectMeta.UID) ++ bucketName = fmt.Sprintf("bucket-%s", bucketClaim.ObjectMeta.UID) + + // create bucket + bucket := &v1alpha1.Bucket{} diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml index a3859194..6fe778ae 100644 --- a/packages/system/objectstorage-controller/values.yaml +++ b/packages/system/objectstorage-controller/values.yaml @@ -1,3 +1,3 @@ objectstorage: controller: - image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.3.0@sha256:7a9e4bf9c3f95f364756396815bb51b6c0f58f85db653460574d94b96cd3c7d5" + image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.1.7@sha256:080b89a5bbee971180f9e2ad16672795d990751f7953ebfd83042a32acb57a35" diff --git a/packages/system/openbao-rd/cozyrds/openbao.yaml b/packages/system/openbao-rd/cozyrds/openbao.yaml index 47691c88..9c20776e 100644 --- a/packages/system/openbao-rd/cozyrds/openbao.yaml +++ b/packages/system/openbao-rd/cozyrds/openbao.yaml @@ -8,7 +8,7 @@ spec: plural: openbaos singular: openbao openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size for data storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"ui":{"description":"Enable the OpenBAO web UI.","type":"boolean","default":true}}} + {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size for data storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"ui":{"description":"Enable the OpenBAO web UI.","type":"boolean","default":true}}} release: prefix: openbao- labels: diff --git a/packages/system/opensearch-operator/.helmignore b/packages/system/opensearch-operator/.helmignore deleted file mode 100644 index 0e8a0eb3..00000000 --- a/packages/system/opensearch-operator/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/packages/system/opensearch-operator/Chart.yaml b/packages/system/opensearch-operator/Chart.yaml deleted file mode 100644 index a991bdca..00000000 --- a/packages/system/opensearch-operator/Chart.yaml +++ /dev/null @@ -1,3 +0,0 @@ -apiVersion: v2 -name: cozy-opensearch-operator -version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process diff --git a/packages/system/opensearch-operator/Makefile b/packages/system/opensearch-operator/Makefile deleted file mode 100644 index 36522495..00000000 --- a/packages/system/opensearch-operator/Makefile +++ /dev/null @@ -1,10 +0,0 @@ -export NAME=opensearch-operator -export NAMESPACE=cozy-$(NAME) - -include ../../../hack/package.mk - -update: - rm -rf charts - helm repo add opensearch-operator https://opensearch-project.github.io/opensearch-k8s-operator/ - helm repo update opensearch-operator - helm pull opensearch-operator/opensearch-operator --version 2.8.0 --untar --untardir charts diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/CHANGELOG.md b/packages/system/opensearch-operator/charts/opensearch-operator/CHANGELOG.md deleted file mode 100644 index 1866ab55..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/CHANGELOG.md +++ /dev/null @@ -1,61 +0,0 @@ -# Changelog -All notable changes to this project will be documented in this file. - -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). - ---- -## [Unreleased] -### Added -- Added support for custom image used by `kubeRbacProxy`. -### Changed -### Deprecated -### Removed -### Fixed -### Security - ---- -## [2.0.0] -### Added -### Changed -- Modified `version` to `2.0.0` and `appVersion` to `v2.0`. -- Allow chart image tag to pick from `appVersion`, unless explicitly passed `tag` values in `values.yaml` file. -### Deprecated -### Removed -### Fixed -### Security - ---- -## [1.0.3] -### Added -### Changed -- Added missing spec `dashboards.additionalConfig` -### Deprecated -### Removed -### Fixed -### Security - ---- -## [1.0.2] -### Added -### Changed -- Added README.md file to charts/ folder. -### Deprecated -### Removed -### Fixed -### Security - ---- -## [1.0.1] -### Added -### Changed -- Updated version to 1.0.1 -### Deprecated -### Removed -### Fixed -### Security - -[Unreleased]: https://github.com/opensearch-project/opensearch-k8s-operator/compare/opensearch-operator-2.0.0...HEAD -[2.0.0]: https://github.com/opensearch-project/opensearch-k8s-operator/compare/opensearch-operator-1.0.3...opensearch-operator-2.0.0 -[1.0.3]: https://github.com/opensearch-project/opensearch-k8s-operator/compare/opensearch-operator-1.0.2...opensearch-operator-1.0.3 -[1.0.2]: https://github.com/opensearch-project/opensearch-k8s-operator/compare/opensearch-operator-1.0.1...opensearch-operator-1.0.2 diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/Chart.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/Chart.yaml deleted file mode 100644 index 331cf1e2..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/Chart.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v2 -appVersion: 2.8.0 -description: The OpenSearch Operator Helm chart for Kubernetes -name: opensearch-operator -type: application -version: 2.8.0 diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/README.md b/packages/system/opensearch-operator/charts/opensearch-operator/README.md deleted file mode 100644 index dc63c250..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/README.md +++ /dev/null @@ -1,29 +0,0 @@ -# OpenSearch-k8s-operator - -The Kubernetes [OpenSearch Operator](https://github.com/opensearch-project/opensearch-k8s-operator) is used for automating the deployment, provisioning, management, and orchestration of OpenSearch clusters and OpenSearch dashboards. - -## Getting started - -The Operator can be easily installed using helm on any CNCF-certified Kubernetes cluster. Please refer to the [User Guide](https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md) for more information. - -### Installation Using Helm - -#### Get Repo Info -``` -helm repo add opensearch-operator https://opensearch-project.github.io/opensearch-k8s-operator/ -helm repo update -``` -#### Install Chart -``` -helm install [RELEASE_NAME] opensearch-operator/opensearch-operator -``` -#### Uninstall Chart -``` -helm uninstall [RELEASE_NAME] -``` -#### Upgrade Chart -``` -helm repo update -helm upgrade [RELEASE_NAME] opensearch-operator/opensearch-operator -``` - diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchactiongroups.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchactiongroups.yaml deleted file mode 100644 index 8ba4c7b2..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchactiongroups.yaml +++ /dev/null @@ -1,94 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchactiongroups.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpensearchActionGroup - listKind: OpensearchActionGroupList - plural: opensearchactiongroups - shortNames: - - opensearchactiongroup - singular: opensearchactiongroup - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: OpensearchActionGroup is the Schema for the opensearchactiongroups - API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: OpensearchActionGroupSpec defines the desired state of OpensearchActionGroup - properties: - allowedActions: - items: - type: string - type: array - description: - type: string - opensearchCluster: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: - type: string - required: - - allowedActions - - opensearchCluster - type: object - status: - description: OpensearchActionGroupStatus defines the observed state of - OpensearchActionGroup - properties: - existingActionGroup: - type: boolean - managedCluster: - description: |- - UID is a type that holds unique ID values, including UUIDs. Because we - don't ONLY use UUIDs, this is an alias to string. Being a type captures - intent and helps make sure that UIDs and names do not get conflated. - type: string - reason: - type: string - state: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchclusters.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchclusters.yaml deleted file mode 100644 index 063bbd00..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchclusters.yaml +++ /dev/null @@ -1,6372 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchclusters.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpenSearchCluster - listKind: OpenSearchClusterList - plural: opensearchclusters - shortNames: - - os - - opensearch - singular: opensearchcluster - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.health - name: health - type: string - - description: Available nodes - jsonPath: .status.availableNodes - name: nodes - type: integer - - description: Opensearch version - jsonPath: .status.version - name: version - type: string - - jsonPath: .status.phase - name: phase - type: string - - jsonPath: .metadata.creationTimestamp - name: age - type: date - name: v1 - schema: - openAPIV3Schema: - description: Es is the Schema for the es API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: ClusterSpec defines the desired state of OpenSearchCluster - properties: - bootstrap: - properties: - additionalConfig: - additionalProperties: - type: string - description: Extra items to add to the opensearch.yml, defaults - to General.AdditionalConfig - type: object - affinity: - description: Affinity is a group of affinity scheduling rules. - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for - the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with - the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the - corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. - The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. - co-locate this pod in the same node, zone, etc. as some - other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules - (e.g. avoid putting this pod in the same node, zone, etc. - as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - jvm: - type: string - keystore: - items: - properties: - keyMappings: - additionalProperties: - type: string - description: Key mappings from secret to keystore keys - type: object - secret: - description: Secret containing key value pairs - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: object - type: array - nodeSelector: - additionalProperties: - type: string - type: object - pluginsList: - items: - type: string - type: array - resources: - description: ResourceRequirements describes the compute resource - requirements. - properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - This field is immutable. It can only be set for containers. - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - request: - description: |- - Request is the name chosen for a request in the referenced claim. - If empty, everything from the claim is made available, otherwise - only the result of this request. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - tolerations: - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - type: object - confMgmt: - description: ConfMgmt defines which additional services will be deployed - properties: - VerUpdate: - type: boolean - autoScaler: - type: boolean - smartScaler: - type: boolean - type: object - dashboards: - properties: - additionalConfig: - additionalProperties: - type: string - description: Additional properties for opensearch_dashboards.yaml - type: object - additionalVolumes: - items: - properties: - configMap: - description: ConfigMap to use to populate the volume - properties: - defaultMode: - description: |- - defaultMode is optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - csi: - description: CSI object to use to populate the volume - properties: - driver: - description: |- - driver is the name of the CSI driver that handles this volume. - Consult with your admin for the correct name as registered in the cluster. - type: string - fsType: - description: |- - fsType to mount. Ex. "ext4", "xfs", "ntfs". - If not provided, the empty value is passed to the associated CSI driver - which will determine the default filesystem to apply. - type: string - nodePublishSecretRef: - description: |- - nodePublishSecretRef is a reference to the secret object containing - sensitive information to pass to the CSI driver to complete the CSI - NodePublishVolume and NodeUnpublishVolume calls. - This field is optional, and may be empty if no secret is required. If the - secret object contains more than one secret, all secret references are passed. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - readOnly: - description: |- - readOnly specifies a read-only configuration for the volume. - Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: |- - volumeAttributes stores driver-specific properties that are passed to the CSI - driver. Consult your driver's documentation for supported values. - type: object - required: - - driver - type: object - emptyDir: - description: EmptyDir to use to populate the volume - properties: - medium: - description: |- - medium represents what type of storage medium should back this directory. - The default is "" which means to use the node's default medium. - Must be an empty string (default) or Memory. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: |- - sizeLimit is the total amount of local storage required for this EmptyDir volume. - The size limit is also applicable for memory medium. - The maximum usage on memory medium EmptyDir would be the minimum value between - the SizeLimit specified here and the sum of memory limits of all containers in a pod. - The default is nil which means that the limit is undefined. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - name: - description: Name to use for the volume. Required. - type: string - path: - description: Path in the container to mount the volume at. - Required. - type: string - projected: - description: Projected object to use to populate the volume - properties: - defaultMode: - description: |- - defaultMode are the mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. - items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. - properties: - clusterTrustBundle: - description: |- - ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field - of ClusterTrustBundle objects in an auto-updating file. - - Alpha, gated by the ClusterTrustBundleProjection feature gate. - - ClusterTrustBundle objects can either be selected by name, or by the - combination of signer name and a label selector. - - Kubelet performs aggressive normalization of the PEM contents written - into the pod filesystem. Esoteric PEM features such as inter-block - comments and block headers are stripped. Certificates are deduplicated. - The ordering of certificates within the file is arbitrary, and Kubelet - may change the order over time. - properties: - labelSelector: - description: |- - Select all ClusterTrustBundles that match this label selector. Only has - effect if signerName is set. Mutually-exclusive with name. If unset, - interpreted as "match nothing". If set but empty, interpreted as "match - everything". - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - name: - description: |- - Select a single ClusterTrustBundle by object name. Mutually-exclusive - with signerName and labelSelector. - type: string - optional: - description: |- - If true, don't block pod startup if the referenced ClusterTrustBundle(s) - aren't available. If using name, then the named ClusterTrustBundle is - allowed not to exist. If using signerName, then the combination of - signerName and labelSelector is allowed to match zero - ClusterTrustBundles. - type: boolean - path: - description: Relative path from the volume - root to write the bundle. - type: string - signerName: - description: |- - Select all ClusterTrustBundles that match this signer name. - Mutually-exclusive with name. The contents of all selected - ClusterTrustBundles will be unified and deduplicated. - type: string - required: - - path - type: object - configMap: - description: configMap information about the configMap - data to project - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: optional specify whether the - ConfigMap or its keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - downwardAPI: - description: downwardAPI information about the - downwardAPI data to project - properties: - items: - description: Items is a list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects a field - of the pod: only annotations, labels, - name, namespace and uid are supported.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in terms - of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to - select in the specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - description: |- - Optional: mode bits used to set permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file to - be created. Must not be absolute or - contain the ''..'' path. Must be utf-8 - encoded. The first item of the relative - path must not start with ''..''' - type: string - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. - properties: - containerName: - description: 'Container name: required - for volumes, optional for env - vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - x-kubernetes-list-type: atomic - type: object - secret: - description: secret information about the secret - data to project - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: optional field specify whether - the Secret or its key must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - serviceAccountToken: - description: serviceAccountToken is information - about the serviceAccountToken data to project - properties: - audience: - description: |- - audience is the intended audience of the token. A recipient of a token - must identify itself with an identifier specified in the audience of the - token, and otherwise should reject the token. The audience defaults to the - identifier of the apiserver. - type: string - expirationSeconds: - description: |- - expirationSeconds is the requested duration of validity of the service - account token. As the token approaches expiration, the kubelet volume - plugin will proactively rotate the service account token. The kubelet will - start trying to rotate the token if the token is older than 80 percent of - its time to live or if the token is older than 24 hours.Defaults to 1 hour - and must be at least 10 minutes. - format: int64 - type: integer - path: - description: |- - path is the path relative to the mount point of the file to project the - token into. - type: string - required: - - path - type: object - type: object - type: array - x-kubernetes-list-type: atomic - type: object - restartPods: - description: Whether to restart the pods on content change - type: boolean - secret: - description: Secret to use populate the volume - properties: - defaultMode: - description: |- - defaultMode is Optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values - for mode bits. Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - items: - description: |- - items If unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - optional: - description: optional field specify whether the Secret - or its keys must be defined - type: boolean - secretName: - description: |- - secretName is the name of the secret in the pod's namespace to use. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: string - type: object - subPath: - description: SubPath of the referenced volume to mount. - type: string - required: - - name - - path - type: object - type: array - affinity: - description: Affinity is a group of affinity scheduling rules. - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for - the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with - the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the - corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. - The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. - co-locate this pod in the same node, zone, etc. as some - other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules - (e.g. avoid putting this pod in the same node, zone, etc. - as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - annotations: - additionalProperties: - type: string - type: object - basePath: - description: Base Path for Opensearch Clusters running behind - a reverse proxy - type: string - enable: - type: boolean - env: - items: - description: EnvVar represents an environment variable present - in a Container. - properties: - name: - description: Name of the environment variable. Must be a - C_IDENTIFIER. - type: string - value: - description: |- - Variable references $(VAR_NAME) are expanded - using the previously defined environment variables in the container and - any service environment variables. If a variable cannot be resolved, - the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless of whether the variable - exists or not. - Defaults to "". - type: string - valueFrom: - description: Source for the environment variable's value. - Cannot be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: Specify whether the ConfigMap or its - key must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - description: |- - Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. - properties: - apiVersion: - description: Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. - properties: - containerName: - description: 'Container name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of the - exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - description: Selects a key of a secret in the pod's - namespace - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: Specify whether the Secret or its key - must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - image: - type: string - imagePullPolicy: - description: PullPolicy describes a policy for if/when to pull - a container image - type: string - imagePullSecrets: - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - labels: - additionalProperties: - type: string - type: object - nodeSelector: - additionalProperties: - type: string - type: object - opensearchCredentialsSecret: - description: Secret that contains fields username and password - for dashboards to use to login to opensearch, must only be supplied - if a custom securityconfig is provided - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - pluginsList: - items: - type: string - type: array - podSecurityContext: - description: Set security context for the dashboards pods - properties: - appArmorProfile: - description: |- - appArmorProfile is the AppArmor options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile loaded on the node that should be used. - The profile must be preconfigured on the node to work. - Must match the loaded name of the profile. - Must be set if and only if type is "Localhost". - type: string - type: - description: |- - type indicates which kind of AppArmor profile will be applied. - Valid options are: - Localhost - a profile pre-loaded on the node. - RuntimeDefault - the container runtime's default profile. - Unconfined - no AppArmor enforcement. - type: string - required: - - type - type: object - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxChangePolicy: - description: |- - seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod. - It has no effect on nodes that do not support SELinux or to volumes does not support SELinux. - Valid values are "MountOption" and "Recursive". - - "Recursive" means relabeling of all files on all Pod volumes by the container runtime. - This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node. - - "MountOption" mounts all eligible Pod volumes with `-o context` mount option. - This requires all Pods that share the same volume to use the same SELinux label. - It is not possible to share the same volume among privileged and unprivileged Pods. - Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes - whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their - CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. - - This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. - - All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state. - Note that this field cannot be set when spec.os.name is windows. - type: string - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies - to the container. - type: string - role: - description: Role is a SELinux role label that applies - to the container. - type: string - type: - description: Type is a SELinux type label that applies - to the container. - type: string - user: - description: User is a SELinux user label that applies - to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in - addition to the container's primary GID and fsGroup (if specified). If - the SupplementalGroupsPolicy feature is enabled, the - supplementalGroupsPolicy field determines whether these are in addition - to or instead of any group memberships defined in the container image. - If unspecified, no additional groups are added, though group memberships - defined in the container image may still be used, depending on the - supplementalGroupsPolicy field. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - supplementalGroupsPolicy: - description: |- - Defines how supplemental groups of the first container processes are calculated. - Valid values are "Merge" and "Strict". If not specified, "Merge" is used. - (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled - and the container runtime must implement support for this feature. - Note that this field cannot be set when spec.os.name is windows. - type: string - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - windowsOptions: - description: |- - The Windows specific settings applied to all containers. - If unspecified, the options within a container's SecurityContext will be used. - If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: |- - GMSACredentialSpec is where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the - GMSA credential spec named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name of the - GMSA credential spec to use. - type: string - hostProcess: - description: |- - HostProcess determines if a container should be run as a 'Host Process' container. - All of a Pod's containers must have the same effective HostProcess value - (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). - In addition, if HostProcess is true then HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: |- - The UserName in Windows to run the entrypoint of the container process. - Defaults to the user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: string - type: object - type: object - replicas: - format: int32 - type: integer - resources: - description: ResourceRequirements describes the compute resource - requirements. - properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - This field is immutable. It can only be set for containers. - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - request: - description: |- - Request is the name chosen for a request in the referenced claim. - If empty, everything from the claim is made available, otherwise - only the result of this request. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - securityContext: - description: Set security context for the dashboards pods' container - properties: - allowPrivilegeEscalation: - description: |- - AllowPrivilegeEscalation controls whether a process can gain more - privileges than its parent process. This bool directly controls if - the no_new_privs flag will be set on the container process. - AllowPrivilegeEscalation is true always when the container is: - 1) run as Privileged - 2) has CAP_SYS_ADMIN - Note that this field cannot be set when spec.os.name is windows. - type: boolean - appArmorProfile: - description: |- - appArmorProfile is the AppArmor options to use by this container. If set, this profile - overrides the pod's appArmorProfile. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile loaded on the node that should be used. - The profile must be preconfigured on the node to work. - Must match the loaded name of the profile. - Must be set if and only if type is "Localhost". - type: string - type: - description: |- - type indicates which kind of AppArmor profile will be applied. - Valid options are: - Localhost - a profile pre-loaded on the node. - RuntimeDefault - the container runtime's default profile. - Unconfined - no AppArmor enforcement. - type: string - required: - - type - type: object - capabilities: - description: |- - The capabilities to add/drop when running containers. - Defaults to the default set of capabilities granted by the container runtime. - Note that this field cannot be set when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - x-kubernetes-list-type: atomic - drop: - description: Removed capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - x-kubernetes-list-type: atomic - type: object - privileged: - description: |- - Run container in privileged mode. - Processes in privileged containers are essentially equivalent to root on the host. - Defaults to false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - procMount: - description: |- - procMount denotes the type of proc mount to use for the containers. - The default value is Default which uses the container runtime defaults for - readonly paths and masked paths. - This requires the ProcMountType feature flag to be enabled. - Note that this field cannot be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: |- - Whether this container has a read-only root filesystem. - Default is false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to the container. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies - to the container. - type: string - role: - description: Role is a SELinux role label that applies - to the container. - type: string - type: - description: Type is a SELinux type label that applies - to the container. - type: string - user: - description: User is a SELinux user label that applies - to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by this container. If seccomp options are - provided at both the pod & container level, the container options - override the pod options. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - windowsOptions: - description: |- - The Windows specific settings applied to all containers. - If unspecified, the options from the PodSecurityContext will be used. - If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: |- - GMSACredentialSpec is where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the - GMSA credential spec named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name of the - GMSA credential spec to use. - type: string - hostProcess: - description: |- - HostProcess determines if a container should be run as a 'Host Process' container. - All of a Pod's containers must have the same effective HostProcess value - (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). - In addition, if HostProcess is true then HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: |- - The UserName in Windows to run the entrypoint of the container process. - Defaults to the user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: string - type: object - type: object - service: - properties: - labels: - additionalProperties: - type: string - type: object - loadBalancerSourceRanges: - items: - type: string - type: array - type: - default: ClusterIP - description: Service Type string describes ingress methods - for a service - enum: - - ClusterIP - - NodePort - - LoadBalancer - type: string - type: object - tls: - properties: - caSecret: - description: Optional, secret that contains the ca certificate - as ca.crt. If this and generate=true is set the existing - CA cert from that secret is used to generate the node certs. - In this case must contain ca.crt and ca.key fields - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - enable: - description: Enable HTTPS for Dashboards - type: boolean - generate: - description: Generate certificate, if false secret must be - provided - type: boolean - secret: - description: Optional, name of a TLS secret that contains - ca.crt, tls.key and tls.crt data. If ca.crt is in a different - secret provide it via the caSecret field - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: object - tolerations: - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - version: - type: string - required: - - replicas - - version - type: object - general: - description: |- - INSERT ADDITIONAL SPEC FIELDS - desired state of cluster - Important: Run "make" to regenerate code after modifying this file - properties: - additionalConfig: - additionalProperties: - type: string - description: Extra items to add to the opensearch.yml - type: object - additionalVolumes: - description: Additional volumes to mount to all pods in the cluster - items: - properties: - configMap: - description: ConfigMap to use to populate the volume - properties: - defaultMode: - description: |- - defaultMode is optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - csi: - description: CSI object to use to populate the volume - properties: - driver: - description: |- - driver is the name of the CSI driver that handles this volume. - Consult with your admin for the correct name as registered in the cluster. - type: string - fsType: - description: |- - fsType to mount. Ex. "ext4", "xfs", "ntfs". - If not provided, the empty value is passed to the associated CSI driver - which will determine the default filesystem to apply. - type: string - nodePublishSecretRef: - description: |- - nodePublishSecretRef is a reference to the secret object containing - sensitive information to pass to the CSI driver to complete the CSI - NodePublishVolume and NodeUnpublishVolume calls. - This field is optional, and may be empty if no secret is required. If the - secret object contains more than one secret, all secret references are passed. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - readOnly: - description: |- - readOnly specifies a read-only configuration for the volume. - Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: |- - volumeAttributes stores driver-specific properties that are passed to the CSI - driver. Consult your driver's documentation for supported values. - type: object - required: - - driver - type: object - emptyDir: - description: EmptyDir to use to populate the volume - properties: - medium: - description: |- - medium represents what type of storage medium should back this directory. - The default is "" which means to use the node's default medium. - Must be an empty string (default) or Memory. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: |- - sizeLimit is the total amount of local storage required for this EmptyDir volume. - The size limit is also applicable for memory medium. - The maximum usage on memory medium EmptyDir would be the minimum value between - the SizeLimit specified here and the sum of memory limits of all containers in a pod. - The default is nil which means that the limit is undefined. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - name: - description: Name to use for the volume. Required. - type: string - path: - description: Path in the container to mount the volume at. - Required. - type: string - projected: - description: Projected object to use to populate the volume - properties: - defaultMode: - description: |- - defaultMode are the mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. - items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. - properties: - clusterTrustBundle: - description: |- - ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field - of ClusterTrustBundle objects in an auto-updating file. - - Alpha, gated by the ClusterTrustBundleProjection feature gate. - - ClusterTrustBundle objects can either be selected by name, or by the - combination of signer name and a label selector. - - Kubelet performs aggressive normalization of the PEM contents written - into the pod filesystem. Esoteric PEM features such as inter-block - comments and block headers are stripped. Certificates are deduplicated. - The ordering of certificates within the file is arbitrary, and Kubelet - may change the order over time. - properties: - labelSelector: - description: |- - Select all ClusterTrustBundles that match this label selector. Only has - effect if signerName is set. Mutually-exclusive with name. If unset, - interpreted as "match nothing". If set but empty, interpreted as "match - everything". - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - name: - description: |- - Select a single ClusterTrustBundle by object name. Mutually-exclusive - with signerName and labelSelector. - type: string - optional: - description: |- - If true, don't block pod startup if the referenced ClusterTrustBundle(s) - aren't available. If using name, then the named ClusterTrustBundle is - allowed not to exist. If using signerName, then the combination of - signerName and labelSelector is allowed to match zero - ClusterTrustBundles. - type: boolean - path: - description: Relative path from the volume - root to write the bundle. - type: string - signerName: - description: |- - Select all ClusterTrustBundles that match this signer name. - Mutually-exclusive with name. The contents of all selected - ClusterTrustBundles will be unified and deduplicated. - type: string - required: - - path - type: object - configMap: - description: configMap information about the configMap - data to project - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: optional specify whether the - ConfigMap or its keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - downwardAPI: - description: downwardAPI information about the - downwardAPI data to project - properties: - items: - description: Items is a list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects a field - of the pod: only annotations, labels, - name, namespace and uid are supported.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in terms - of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to - select in the specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - description: |- - Optional: mode bits used to set permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file to - be created. Must not be absolute or - contain the ''..'' path. Must be utf-8 - encoded. The first item of the relative - path must not start with ''..''' - type: string - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. - properties: - containerName: - description: 'Container name: required - for volumes, optional for env - vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - x-kubernetes-list-type: atomic - type: object - secret: - description: secret information about the secret - data to project - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: optional field specify whether - the Secret or its key must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - serviceAccountToken: - description: serviceAccountToken is information - about the serviceAccountToken data to project - properties: - audience: - description: |- - audience is the intended audience of the token. A recipient of a token - must identify itself with an identifier specified in the audience of the - token, and otherwise should reject the token. The audience defaults to the - identifier of the apiserver. - type: string - expirationSeconds: - description: |- - expirationSeconds is the requested duration of validity of the service - account token. As the token approaches expiration, the kubelet volume - plugin will proactively rotate the service account token. The kubelet will - start trying to rotate the token if the token is older than 80 percent of - its time to live or if the token is older than 24 hours.Defaults to 1 hour - and must be at least 10 minutes. - format: int64 - type: integer - path: - description: |- - path is the path relative to the mount point of the file to project the - token into. - type: string - required: - - path - type: object - type: object - type: array - x-kubernetes-list-type: atomic - type: object - restartPods: - description: Whether to restart the pods on content change - type: boolean - secret: - description: Secret to use populate the volume - properties: - defaultMode: - description: |- - defaultMode is Optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values - for mode bits. Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - items: - description: |- - items If unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - format: int32 - type: integer - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - optional: - description: optional field specify whether the Secret - or its keys must be defined - type: boolean - secretName: - description: |- - secretName is the name of the secret in the pod's namespace to use. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: string - type: object - subPath: - description: SubPath of the referenced volume to mount. - type: string - required: - - name - - path - type: object - type: array - annotations: - additionalProperties: - type: string - description: Adds support for annotations in services - type: object - command: - type: string - defaultRepo: - type: string - drainDataNodes: - description: Drain data nodes controls whether to drain data notes - on rolling restart operations - type: boolean - httpPort: - default: 9200 - format: int32 - type: integer - image: - type: string - imagePullPolicy: - description: PullPolicy describes a policy for if/when to pull - a container image - type: string - imagePullSecrets: - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - keystore: - description: Populate opensearch keystore before startup - items: - properties: - keyMappings: - additionalProperties: - type: string - description: Key mappings from secret to keystore keys - type: object - secret: - description: Secret containing key value pairs - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: object - type: array - monitoring: - properties: - enable: - type: boolean - labels: - additionalProperties: - type: string - type: object - monitoringUserSecret: - type: string - pluginUrl: - type: string - scrapeInterval: - type: string - tlsConfig: - properties: - insecureSkipVerify: - type: boolean - serverName: - type: string - type: object - type: object - pluginsList: - items: - type: string - type: array - podSecurityContext: - description: Set security context for the cluster pods - properties: - appArmorProfile: - description: |- - appArmorProfile is the AppArmor options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile loaded on the node that should be used. - The profile must be preconfigured on the node to work. - Must match the loaded name of the profile. - Must be set if and only if type is "Localhost". - type: string - type: - description: |- - type indicates which kind of AppArmor profile will be applied. - Valid options are: - Localhost - a profile pre-loaded on the node. - RuntimeDefault - the container runtime's default profile. - Unconfined - no AppArmor enforcement. - type: string - required: - - type - type: object - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxChangePolicy: - description: |- - seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod. - It has no effect on nodes that do not support SELinux or to volumes does not support SELinux. - Valid values are "MountOption" and "Recursive". - - "Recursive" means relabeling of all files on all Pod volumes by the container runtime. - This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node. - - "MountOption" mounts all eligible Pod volumes with `-o context` mount option. - This requires all Pods that share the same volume to use the same SELinux label. - It is not possible to share the same volume among privileged and unprivileged Pods. - Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes - whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their - CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. - - This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. - - All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state. - Note that this field cannot be set when spec.os.name is windows. - type: string - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies - to the container. - type: string - role: - description: Role is a SELinux role label that applies - to the container. - type: string - type: - description: Type is a SELinux type label that applies - to the container. - type: string - user: - description: User is a SELinux user label that applies - to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in - addition to the container's primary GID and fsGroup (if specified). If - the SupplementalGroupsPolicy feature is enabled, the - supplementalGroupsPolicy field determines whether these are in addition - to or instead of any group memberships defined in the container image. - If unspecified, no additional groups are added, though group memberships - defined in the container image may still be used, depending on the - supplementalGroupsPolicy field. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - supplementalGroupsPolicy: - description: |- - Defines how supplemental groups of the first container processes are calculated. - Valid values are "Merge" and "Strict". If not specified, "Merge" is used. - (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled - and the container runtime must implement support for this feature. - Note that this field cannot be set when spec.os.name is windows. - type: string - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - windowsOptions: - description: |- - The Windows specific settings applied to all containers. - If unspecified, the options within a container's SecurityContext will be used. - If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: |- - GMSACredentialSpec is where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the - GMSA credential spec named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name of the - GMSA credential spec to use. - type: string - hostProcess: - description: |- - HostProcess determines if a container should be run as a 'Host Process' container. - All of a Pod's containers must have the same effective HostProcess value - (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). - In addition, if HostProcess is true then HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: |- - The UserName in Windows to run the entrypoint of the container process. - Defaults to the user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: string - type: object - type: object - securityContext: - description: Set security context for the cluster pods' container - properties: - allowPrivilegeEscalation: - description: |- - AllowPrivilegeEscalation controls whether a process can gain more - privileges than its parent process. This bool directly controls if - the no_new_privs flag will be set on the container process. - AllowPrivilegeEscalation is true always when the container is: - 1) run as Privileged - 2) has CAP_SYS_ADMIN - Note that this field cannot be set when spec.os.name is windows. - type: boolean - appArmorProfile: - description: |- - appArmorProfile is the AppArmor options to use by this container. If set, this profile - overrides the pod's appArmorProfile. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile loaded on the node that should be used. - The profile must be preconfigured on the node to work. - Must match the loaded name of the profile. - Must be set if and only if type is "Localhost". - type: string - type: - description: |- - type indicates which kind of AppArmor profile will be applied. - Valid options are: - Localhost - a profile pre-loaded on the node. - RuntimeDefault - the container runtime's default profile. - Unconfined - no AppArmor enforcement. - type: string - required: - - type - type: object - capabilities: - description: |- - The capabilities to add/drop when running containers. - Defaults to the default set of capabilities granted by the container runtime. - Note that this field cannot be set when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - x-kubernetes-list-type: atomic - drop: - description: Removed capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - x-kubernetes-list-type: atomic - type: object - privileged: - description: |- - Run container in privileged mode. - Processes in privileged containers are essentially equivalent to root on the host. - Defaults to false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - procMount: - description: |- - procMount denotes the type of proc mount to use for the containers. - The default value is Default which uses the container runtime defaults for - readonly paths and masked paths. - This requires the ProcMountType feature flag to be enabled. - Note that this field cannot be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: |- - Whether this container has a read-only root filesystem. - Default is false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to the container. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies - to the container. - type: string - role: - description: Role is a SELinux role label that applies - to the container. - type: string - type: - description: Type is a SELinux type label that applies - to the container. - type: string - user: - description: User is a SELinux user label that applies - to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by this container. If seccomp options are - provided at both the pod & container level, the container options - override the pod options. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - windowsOptions: - description: |- - The Windows specific settings applied to all containers. - If unspecified, the options from the PodSecurityContext will be used. - If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: |- - GMSACredentialSpec is where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the - GMSA credential spec named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name of the - GMSA credential spec to use. - type: string - hostProcess: - description: |- - HostProcess determines if a container should be run as a 'Host Process' container. - All of a Pod's containers must have the same effective HostProcess value - (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). - In addition, if HostProcess is true then HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: |- - The UserName in Windows to run the entrypoint of the container process. - Defaults to the user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: string - type: object - type: object - serviceAccount: - type: string - serviceName: - type: string - setVMMaxMapCount: - type: boolean - snapshotRepositories: - items: - properties: - name: - type: string - settings: - additionalProperties: - type: string - type: object - type: - type: string - required: - - name - - type - type: object - type: array - vendor: - enum: - - Opensearch - - Op - - OP - - os - - opensearch - type: string - version: - type: string - required: - - serviceName - type: object - initHelper: - properties: - image: - type: string - imagePullPolicy: - description: PullPolicy describes a policy for if/when to pull - a container image - type: string - imagePullSecrets: - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - resources: - description: ResourceRequirements describes the compute resource - requirements. - properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - This field is immutable. It can only be set for containers. - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - request: - description: |- - Request is the name chosen for a request in the referenced claim. - If empty, everything from the claim is made available, otherwise - only the result of this request. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - version: - type: string - type: object - nodePools: - items: - properties: - additionalConfig: - additionalProperties: - type: string - type: object - affinity: - description: Affinity is a group of affinity scheduling rules. - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for - the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated - with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the - selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the - selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the - corresponding nodeSelectorTerm, in the range - 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. - The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the - selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the - selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. - co-locate this pod in the same node, zone, etc. as some - other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of - label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of - label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules - (e.g. avoid putting this pod in the same node, zone, etc. - as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of - label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of - label selector requirements. The requirements - are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - annotations: - additionalProperties: - type: string - type: object - component: - type: string - diskSize: - type: string - env: - items: - description: EnvVar represents an environment variable present - in a Container. - properties: - name: - description: Name of the environment variable. Must be - a C_IDENTIFIER. - type: string - value: - description: |- - Variable references $(VAR_NAME) are expanded - using the previously defined environment variables in the container and - any service environment variables. If a variable cannot be resolved, - the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless of whether the variable - exists or not. - Defaults to "". - type: string - valueFrom: - description: Source for the environment variable's value. - Cannot be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: Specify whether the ConfigMap or - its key must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - description: |- - Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. - properties: - apiVersion: - description: Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. - properties: - containerName: - description: 'Container name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of the - exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - description: Selects a key of a secret in the pod's - namespace - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: Specify whether the Secret or its - key must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - jvm: - type: string - labels: - additionalProperties: - type: string - type: object - nodeSelector: - additionalProperties: - type: string - type: object - pdb: - properties: - enable: - type: boolean - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - persistence: - description: PersistencConfig defines options for data persistence - properties: - emptyDir: - description: |- - Represents an empty directory for a pod. - Empty directory volumes support ownership management and SELinux relabeling. - properties: - medium: - description: |- - medium represents what type of storage medium should back this directory. - The default is "" which means to use the node's default medium. - Must be an empty string (default) or Memory. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: |- - sizeLimit is the total amount of local storage required for this EmptyDir volume. - The size limit is also applicable for memory medium. - The maximum usage on memory medium EmptyDir would be the minimum value between - the SizeLimit specified here and the sum of memory limits of all containers in a pod. - The default is nil which means that the limit is undefined. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - hostPath: - description: |- - Represents a host path mapped into a pod. - Host path volumes do not support ownership management or SELinux relabeling. - properties: - path: - description: |- - path of the directory on the host. - If the path is a symlink, it will follow the link to the real path. - More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - type: string - type: - description: |- - type for HostPath Volume - Defaults to "" - More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - type: string - required: - - path - type: object - pvc: - properties: - accessModes: - items: - type: string - type: array - storageClass: - type: string - type: object - type: object - priorityClassName: - type: string - probes: - properties: - liveness: - properties: - failureThreshold: - format: int32 - type: integer - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - readiness: - properties: - failureThreshold: - format: int32 - type: integer - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - startup: - properties: - failureThreshold: - format: int32 - type: integer - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - type: object - replicas: - format: int32 - type: integer - resources: - description: ResourceRequirements describes the compute resource - requirements. - properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - This field is immutable. It can only be set for containers. - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - request: - description: |- - Request is the name chosen for a request in the referenced claim. - If empty, everything from the claim is made available, otherwise - only the result of this request. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - roles: - items: - type: string - type: array - tolerations: - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - topologySpreadConstraints: - items: - description: TopologySpreadConstraint specifies how to spread - matching pods among the given topology. - properties: - labelSelector: - description: |- - LabelSelector is used to find matching pods. - Pods that match this label selector are counted to determine the number of pods - in their corresponding topology domain. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select the pods over which - spreading will be calculated. The keys are used to lookup values from the - incoming pod labels, those key-value labels are ANDed with labelSelector - to select the group of existing pods over which spreading will be calculated - for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. - MatchLabelKeys cannot be set when LabelSelector isn't set. - Keys that don't exist in the incoming pod labels will - be ignored. A null or empty list means only match against labelSelector. - - This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxSkew: - description: |- - MaxSkew describes the degree to which pods may be unevenly distributed. - When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference - between the number of matching pods in the target topology and the global minimum. - The global minimum is the minimum number of matching pods in an eligible domain - or zero if the number of eligible domains is less than MinDomains. - For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same - labelSelector spread as 2/2/1: - In this case, the global minimum is 1. - | zone1 | zone2 | zone3 | - | P P | P P | P | - - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; - scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) - violate MaxSkew(1). - - if MaxSkew is 2, incoming pod can be scheduled onto any zone. - When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence - to topologies that satisfy it. - It's a required field. Default value is 1 and 0 is not allowed. - format: int32 - type: integer - minDomains: - description: |- - MinDomains indicates a minimum number of eligible domains. - When the number of eligible domains with matching topology keys is less than minDomains, - Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. - And when the number of eligible domains with matching topology keys equals or greater than minDomains, - this value has no effect on scheduling. - As a result, when the number of eligible domains is less than minDomains, - scheduler won't schedule more than maxSkew Pods to those domains. - If value is nil, the constraint behaves as if MinDomains is equal to 1. - Valid values are integers greater than 0. - When value is not nil, WhenUnsatisfiable must be DoNotSchedule. - - For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same - labelSelector spread as 2/2/2: - | zone1 | zone2 | zone3 | - | P P | P P | P P | - The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. - In this situation, new pod with the same labelSelector cannot be scheduled, - because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, - it will violate MaxSkew. - format: int32 - type: integer - nodeAffinityPolicy: - description: |- - NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector - when calculating pod topology spread skew. Options are: - - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. - - If this value is nil, the behavior is equivalent to the Honor policy. - type: string - nodeTaintsPolicy: - description: |- - NodeTaintsPolicy indicates how we will treat node taints when calculating - pod topology spread skew. Options are: - - Honor: nodes without taints, along with tainted nodes for which the incoming pod - has a toleration, are included. - - Ignore: node taints are ignored. All nodes are included. - - If this value is nil, the behavior is equivalent to the Ignore policy. - type: string - topologyKey: - description: |- - TopologyKey is the key of node labels. Nodes that have a label with this key - and identical values are considered to be in the same topology. - We consider each as a "bucket", and try to put balanced number - of pods into each bucket. - We define a domain as a particular instance of a topology. - Also, we define an eligible domain as a domain whose nodes meet the requirements of - nodeAffinityPolicy and nodeTaintsPolicy. - e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. - And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. - It's a required field. - type: string - whenUnsatisfiable: - description: |- - WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy - the spread constraint. - - DoNotSchedule (default) tells the scheduler not to schedule it. - - ScheduleAnyway tells the scheduler to schedule the pod in any location, - but giving higher precedence to topologies that would help reduce the - skew. - A constraint is considered "Unsatisfiable" for an incoming pod - if and only if every possible node assignment for that pod would violate - "MaxSkew" on some topology. - For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same - labelSelector spread as 3/1/1: - | zone1 | zone2 | zone3 | - | P P P | P | P | - If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled - to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies - MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler - won't make it *more* imbalanced. - It's a required field. - type: string - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - type: array - required: - - component - - replicas - - roles - type: object - type: array - security: - description: Security defines options for managing the opensearch-security - plugin - properties: - config: - properties: - adminCredentialsSecret: - description: Secret that contains fields username and password - to be used by the operator to access the opensearch cluster - for node draining. Must be set if custom securityconfig - is provided. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - adminSecret: - description: TLS Secret that contains a client certificate - (tls.key, tls.crt, ca.crt) with admin rights in the opensearch - cluster. Must be set if transport certificates are provided - by user and not generated - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - securityConfigSecret: - description: Secret that contains the differnt yml files of - the opensearch-security config (config.yml, internal_users.yml, - ...) - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - updateJob: - description: Specific configs for the SecurityConfig update - job - properties: - resources: - description: ResourceRequirements describes the compute - resource requirements. - properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - This field is immutable. It can only be set for containers. - items: - description: ResourceClaim references one entry - in PodSpec.ResourceClaims. - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - request: - description: |- - Request is the name chosen for a request in the referenced claim. - If empty, everything from the claim is made available, otherwise - only the result of this request. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - type: object - type: object - tls: - description: Configure tls usage for transport and http interface - properties: - http: - properties: - caSecret: - description: Optional, secret that contains the ca certificate - as ca.crt. If this and generate=true is set the existing - CA cert from that secret is used to generate the node - certs. In this case must contain ca.crt and ca.key fields - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - generate: - description: If set to true the operator will generate - a CA and certificates for the cluster to use, if false - secrets with existing certificates must be supplied - type: boolean - secret: - description: Optional, name of a TLS secret that contains - ca.crt, tls.key and tls.crt data. If ca.crt is in a - different secret provide it via the caSecret field - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: object - transport: - properties: - adminDn: - description: DNs of certificates that should have admin - access, mainly used for securityconfig updates via securityadmin.sh, - only used when existing certificates are provided - items: - type: string - type: array - caSecret: - description: Optional, secret that contains the ca certificate - as ca.crt. If this and generate=true is set the existing - CA cert from that secret is used to generate the node - certs. In this case must contain ca.crt and ca.key fields - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - generate: - description: If set to true the operator will generate - a CA and certificates for the cluster to use, if false - secrets with existing certificates must be supplied - type: boolean - nodesDn: - description: Allowed Certificate DNs for nodes, only used - when existing certificates are provided - items: - type: string - type: array - perNode: - description: Configure transport node certificate - type: boolean - secret: - description: Optional, name of a TLS secret that contains - ca.crt, tls.key and tls.crt data. If ca.crt is in a - different secret provide it via the caSecret field - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: object - type: object - type: object - required: - - nodePools - type: object - status: - description: ClusterStatus defines the observed state of Es - properties: - availableNodes: - description: AvailableNodes is the number of available instances. - format: int32 - type: integer - componentsStatus: - items: - properties: - component: - type: string - conditions: - items: - type: string - type: array - description: - type: string - status: - type: string - type: object - type: array - health: - description: OpenSearchHealth is the health of the cluster as returned - by the health API. - type: string - initialized: - type: boolean - phase: - description: |- - INSERT ADDITIONAL STATUS FIELD - define observed state of cluster - Important: Run "make" to regenerate code after modifying this file - type: string - version: - type: string - required: - - componentsStatus - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchcomponenttemplates.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchcomponenttemplates.yaml deleted file mode 100644 index 7d4fd549..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchcomponenttemplates.yaml +++ /dev/null @@ -1,136 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchcomponenttemplates.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpensearchComponentTemplate - listKind: OpensearchComponentTemplateList - plural: opensearchcomponenttemplates - shortNames: - - opensearchcomponenttemplate - singular: opensearchcomponenttemplate - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: OpensearchComponentTemplate is the schema for the OpenSearch - component templates API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - properties: - _meta: - description: Optional user metadata about the component template - x-kubernetes-preserve-unknown-fields: true - allowAutoCreate: - description: If true, then indices can be automatically created using - this template - type: boolean - name: - description: The name of the component template. Defaults to metadata.name - type: string - opensearchCluster: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - template: - description: The template that should be applied - properties: - aliases: - additionalProperties: - description: Describes the specs of an index alias - properties: - alias: - description: The name of the alias. - type: string - filter: - description: Query used to limit documents the alias can - access. - x-kubernetes-preserve-unknown-fields: true - index: - description: The name of the index that the alias points - to. - type: string - isWriteIndex: - description: If true, the index is the write index for the - alias - type: boolean - routing: - description: Value used to route indexing and search operations - to a specific shard. - type: string - type: object - description: Aliases to add - type: object - mappings: - description: Mapping for fields in the index - x-kubernetes-preserve-unknown-fields: true - settings: - description: Configuration options for the index - x-kubernetes-preserve-unknown-fields: true - type: object - version: - description: Version number used to manage the component template - externally - type: integer - required: - - opensearchCluster - - template - type: object - status: - properties: - componentTemplateName: - description: Name of the currently managed component template - type: string - existingComponentTemplate: - type: boolean - managedCluster: - description: |- - UID is a type that holds unique ID values, including UUIDs. Because we - don't ONLY use UUIDs, this is an alias to string. Being a type captures - intent and helps make sure that UIDs and names do not get conflated. - type: string - reason: - type: string - state: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchindextemplates.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchindextemplates.yaml deleted file mode 100644 index 37e517ee..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchindextemplates.yaml +++ /dev/null @@ -1,163 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchindextemplates.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpensearchIndexTemplate - listKind: OpensearchIndexTemplateList - plural: opensearchindextemplates - shortNames: - - opensearchindextemplate - singular: opensearchindextemplate - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: OpensearchIndexTemplate is the schema for the OpenSearch index - templates API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - properties: - _meta: - description: Optional user metadata about the index template - x-kubernetes-preserve-unknown-fields: true - composedOf: - description: |- - An ordered list of component template names. Component templates are merged in the order specified, - meaning that the last component template specified has the highest precedence - items: - type: string - type: array - dataStream: - description: The dataStream config that should be applied - properties: - timestamp_field: - description: TimestampField for dataStream - properties: - name: - description: Name of the field that are used for the DataStream - type: string - required: - - name - type: object - type: object - indexPatterns: - description: Array of wildcard expressions used to match the names - of indices during creation - items: - type: string - type: array - name: - description: The name of the index template. Defaults to metadata.name - type: string - opensearchCluster: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - priority: - description: |- - Priority to determine index template precedence when a new data stream or index is created. - The index template with the highest priority is chosen - type: integer - template: - description: The template that should be applied - properties: - aliases: - additionalProperties: - description: Describes the specs of an index alias - properties: - alias: - description: The name of the alias. - type: string - filter: - description: Query used to limit documents the alias can - access. - x-kubernetes-preserve-unknown-fields: true - index: - description: The name of the index that the alias points - to. - type: string - isWriteIndex: - description: If true, the index is the write index for the - alias - type: boolean - routing: - description: Value used to route indexing and search operations - to a specific shard. - type: string - type: object - description: Aliases to add - type: object - mappings: - description: Mapping for fields in the index - x-kubernetes-preserve-unknown-fields: true - settings: - description: Configuration options for the index - x-kubernetes-preserve-unknown-fields: true - type: object - version: - description: Version number used to manage the component template - externally - type: integer - required: - - indexPatterns - - opensearchCluster - type: object - status: - properties: - existingIndexTemplate: - type: boolean - indexTemplateName: - description: Name of the currently managed index template - type: string - managedCluster: - description: |- - UID is a type that holds unique ID values, including UUIDs. Because we - don't ONLY use UUIDs, this is an alias to string. Being a type captures - intent and helps make sure that UIDs and names do not get conflated. - type: string - reason: - type: string - state: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchismpolicies.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchismpolicies.yaml deleted file mode 100644 index 2f4b261d..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchismpolicies.yaml +++ /dev/null @@ -1,461 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchismpolicies.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpenSearchISMPolicy - listKind: OpenSearchISMPolicyList - plural: opensearchismpolicies - shortNames: - - ismp - - ismpolicy - singular: opensearchismpolicy - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: ISMPolicySpec is the specification for the ISM policy for - OS. - properties: - applyToExistingIndices: - description: If true, apply the policy to existing indices that match - the index patterns in the ISM template. - type: boolean - defaultState: - description: The default starting state for each index that uses this - policy. - type: string - description: - description: A human-readable description of the policy. - type: string - errorNotification: - properties: - channel: - type: string - destination: - description: The destination URL. - properties: - amazon: - properties: - url: - type: string - type: object - chime: - properties: - url: - type: string - type: object - customWebhook: - properties: - url: - type: string - type: object - slack: - properties: - url: - type: string - type: object - type: object - messageTemplate: - description: The text of the message - properties: - source: - type: string - type: object - type: object - ismTemplate: - description: Specify an ISM template pattern that matches the index - to apply the policy. - properties: - indexPatterns: - description: Index patterns on which this policy has to be applied - items: - type: string - type: array - priority: - description: Priority of the template, defaults to 0 - type: integer - required: - - indexPatterns - type: object - opensearchCluster: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - policyId: - type: string - states: - description: The states that you define in the policy. - items: - properties: - actions: - description: The actions to execute after entering a state. - items: - description: Actions are the steps that the policy sequentially - executes on entering a specific state. - properties: - alias: - properties: - actions: - description: Allocate the index to a node with a specified - attribute. - items: - properties: - add: - properties: - aliases: - description: The name of the alias. - items: - type: string - type: array - index: - description: The name of the index that - the alias points to. - type: string - isWriteIndex: - description: Specify the index that accepts - any write operations to the alias. - type: boolean - routing: - description: Limit search to an associated - shard value - type: string - type: object - remove: - properties: - aliases: - description: The name of the alias. - items: - type: string - type: array - index: - description: The name of the index that - the alias points to. - type: string - isWriteIndex: - description: Specify the index that accepts - any write operations to the alias. - type: boolean - routing: - description: Limit search to an associated - shard value - type: string - type: object - type: object - type: array - required: - - actions - type: object - allocation: - description: Allocate the index to a node with a specific - attribute set - properties: - exclude: - description: Allocate the index to a node with a specified - attribute. - type: string - include: - description: Allocate the index to a node with any - of the specified attributes. - type: string - require: - description: Don’t allocate the index to a node with - any of the specified attributes. - type: string - waitFor: - description: Wait for the policy to execute before - allocating the index to a node with a specified - attribute. - type: string - required: - - exclude - - include - - require - - waitFor - type: object - close: - description: Closes the managed index. - type: object - delete: - description: Deletes a managed index. - type: object - forceMerge: - description: Reduces the number of Lucene segments by - merging the segments of individual shards. - properties: - maxNumSegments: - description: The number of segments to reduce the - shard to. - format: int64 - type: integer - required: - - maxNumSegments - type: object - indexPriority: - description: Set the priority for the index in a specific - state. - properties: - priority: - description: The priority for the index as soon as - it enters a state. - format: int64 - type: integer - required: - - priority - type: object - notification: - description: Name string `json:"name,omitempty"` - properties: - destination: - type: string - messageTemplate: - properties: - source: - type: string - type: object - required: - - destination - - messageTemplate - type: object - open: - description: Opens a managed index. - type: object - readOnly: - description: Sets a managed index to be read only. - type: object - readWrite: - description: Sets a managed index to be writeable. - type: object - replicaCount: - description: Sets the number of replicas to assign to - an index. - properties: - numberOfReplicas: - format: int64 - type: integer - required: - - numberOfReplicas - type: object - retry: - description: The retry configuration for the action. - properties: - backoff: - description: The backoff policy type to use when retrying. - type: string - count: - description: The number of retry counts. - format: int64 - type: integer - delay: - description: The time to wait between retries. - type: string - required: - - count - type: object - rollover: - description: Rolls an alias over to a new index when the - managed index meets one of the rollover conditions. - properties: - minDocCount: - description: The minimum number of documents required - to roll over the index. - format: int64 - type: integer - minIndexAge: - description: The minimum age required to roll over - the index. - type: string - minPrimaryShardSize: - description: The minimum storage size of a single - primary shard required to roll over the index. - type: string - minSize: - description: The minimum size of the total primary - shard storage (not counting replicas) required to - roll over the index. - type: string - type: object - rollup: - description: Periodically reduce data granularity by rolling - up old data into summarized indexes. - type: object - shrink: - description: Allows you to reduce the number of primary - shards in your indexes - properties: - forceUnsafe: - description: If true, executes the shrink action even - if there are no replicas. - type: boolean - maxShardSize: - description: The maximum size in bytes of a shard - for the target index. - type: string - numNewShards: - description: The maximum number of primary shards - in the shrunken index. - type: integer - percentageOfSourceShards: - description: Percentage of the number of original - primary shards to shrink. - format: int64 - type: integer - targetIndexNameTemplate: - description: The name of the shrunken index. - type: string - type: object - snapshot: - description: Back up your cluster’s indexes and state - properties: - repository: - description: The repository name that you register - through the native snapshot API operations. - type: string - snapshot: - description: The name of the snapshot. - type: string - required: - - repository - - snapshot - type: object - timeout: - description: The timeout period for the action. Accepts - time units for minutes, hours, and days. - type: string - type: object - type: array - name: - description: The name of the state. - type: string - transitions: - description: The next states and the conditions required to - transition to those states. If no transitions exist, the policy - assumes that it’s complete and can now stop managing the index - items: - properties: - conditions: - description: conditions for the transition. - properties: - cron: - description: The cron job that triggers the transition - if no other transition happens first. - properties: - cron: - description: A wrapper for the cron job that triggers - the transition if no other transition happens - first. This wrapper is here to adhere to the - OpenSearch API. - properties: - expression: - description: The cron expression that triggers - the transition. - type: string - timezone: - description: The timezone that triggers the - transition. - type: string - required: - - expression - - timezone - type: object - required: - - cron - type: object - minDocCount: - description: The minimum document count of the index - required to transition. - format: int64 - type: integer - minIndexAge: - description: The minimum age of the index required - to transition. - type: string - minRolloverAge: - description: The minimum age required after a rollover - has occurred to transition to the next state. - type: string - minSize: - description: The minimum size of the total primary - shard storage (not counting replicas) required to - transition. - type: string - type: object - stateName: - description: The name of the state to transition to if - the conditions are met. - type: string - required: - - conditions - - stateName - type: object - type: array - required: - - actions - - name - type: object - type: array - required: - - defaultState - - description - - states - type: object - status: - description: OpensearchISMPolicyStatus defines the observed state of OpensearchISMPolicy - properties: - existingISMPolicy: - type: boolean - managedCluster: - description: |- - UID is a type that holds unique ID values, including UUIDs. Because we - don't ONLY use UUIDs, this is an alias to string. Being a type captures - intent and helps make sure that UIDs and names do not get conflated. - type: string - policyId: - type: string - reason: - type: string - state: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchroles.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchroles.yaml deleted file mode 100644 index 36ae514a..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchroles.yaml +++ /dev/null @@ -1,123 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchroles.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpensearchRole - listKind: OpensearchRoleList - plural: opensearchroles - shortNames: - - opensearchrole - singular: opensearchrole - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: OpensearchRole is the Schema for the opensearchroles API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: OpensearchRoleSpec defines the desired state of OpensearchRole - properties: - clusterPermissions: - items: - type: string - type: array - indexPermissions: - items: - properties: - allowedActions: - items: - type: string - type: array - dls: - type: string - fls: - items: - type: string - type: array - indexPatterns: - items: - type: string - type: array - maskedFields: - items: - type: string - type: array - type: object - type: array - opensearchCluster: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - tenantPermissions: - items: - properties: - allowedActions: - items: - type: string - type: array - tenantPatterns: - items: - type: string - type: array - type: object - type: array - required: - - opensearchCluster - type: object - status: - description: OpensearchRoleStatus defines the observed state of OpensearchRole - properties: - existingRole: - type: boolean - managedCluster: - description: |- - UID is a type that holds unique ID values, including UUIDs. Because we - don't ONLY use UUIDs, this is an alias to string. Being a type captures - intent and helps make sure that UIDs and names do not get conflated. - type: string - reason: - type: string - state: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchsnapshotpolicies.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchsnapshotpolicies.yaml deleted file mode 100644 index 2c32048d..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchsnapshotpolicies.yaml +++ /dev/null @@ -1,203 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchsnapshotpolicies.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpensearchSnapshotPolicy - listKind: OpensearchSnapshotPolicyList - plural: opensearchsnapshotpolicies - singular: opensearchsnapshotpolicy - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: Existing policy state - jsonPath: .status.existingSnapshotPolicy - name: existingpolicy - type: boolean - - description: Snapshot policy name - jsonPath: .status.snapshotPolicyName - name: policyName - type: string - - jsonPath: .status.state - name: state - type: string - - jsonPath: .metadata.creationTimestamp - name: age - type: date - name: v1 - schema: - openAPIV3Schema: - description: OpensearchSnapshotPolicy is the Schema for the opensearchsnapshotpolicies - API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - properties: - creation: - properties: - schedule: - properties: - cron: - properties: - expression: - type: string - timezone: - type: string - required: - - expression - - timezone - type: object - required: - - cron - type: object - timeLimit: - type: string - required: - - schedule - type: object - deletion: - properties: - deleteCondition: - properties: - maxAge: - type: string - maxCount: - type: integer - minCount: - type: integer - type: object - schedule: - properties: - cron: - properties: - expression: - type: string - timezone: - type: string - required: - - expression - - timezone - type: object - required: - - cron - type: object - timeLimit: - type: string - type: object - description: - type: string - enabled: - type: boolean - notification: - properties: - channel: - properties: - id: - type: string - required: - - id - type: object - conditions: - properties: - creation: - type: boolean - deletion: - type: boolean - failure: - type: boolean - type: object - required: - - channel - type: object - opensearchCluster: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - policyName: - type: string - snapshotConfig: - properties: - dateFormat: - type: string - dateFormatTimezone: - type: string - ignoreUnavailable: - type: boolean - includeGlobalState: - type: boolean - indices: - type: string - metadata: - additionalProperties: - type: string - type: object - partial: - type: boolean - repository: - type: string - required: - - repository - type: object - required: - - creation - - opensearchCluster - - policyName - - snapshotConfig - type: object - status: - description: OpensearchSnapshotPolicyStatus defines the observed state - of OpensearchSnapshotPolicy - properties: - existingSnapshotPolicy: - type: boolean - managedCluster: - description: |- - UID is a type that holds unique ID values, including UUIDs. Because we - don't ONLY use UUIDs, this is an alias to string. Being a type captures - intent and helps make sure that UIDs and names do not get conflated. - type: string - reason: - type: string - snapshotPolicyName: - type: string - state: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchtenants.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchtenants.yaml deleted file mode 100644 index d085f3ca..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchtenants.yaml +++ /dev/null @@ -1,85 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchtenants.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpensearchTenant - listKind: OpensearchTenantList - plural: opensearchtenants - shortNames: - - opensearchtenant - singular: opensearchtenant - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: OpensearchTenant is the Schema for the opensearchtenants API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: OpensearchTenantSpec defines the desired state of OpensearchTenant - properties: - description: - type: string - opensearchCluster: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - required: - - opensearchCluster - type: object - status: - description: OpensearchTenantStatus defines the observed state of OpensearchTenant - properties: - existingTenant: - type: boolean - managedCluster: - description: |- - UID is a type that holds unique ID values, including UUIDs. Because we - don't ONLY use UUIDs, this is an alias to string. Being a type captures - intent and helps make sure that UIDs and names do not get conflated. - type: string - reason: - type: string - state: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchuserrolebindings.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchuserrolebindings.yaml deleted file mode 100644 index 2e9453c6..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchuserrolebindings.yaml +++ /dev/null @@ -1,109 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchuserrolebindings.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpensearchUserRoleBinding - listKind: OpensearchUserRoleBindingList - plural: opensearchuserrolebindings - shortNames: - - opensearchuserrolebinding - singular: opensearchuserrolebinding - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: OpensearchUserRoleBinding is the Schema for the opensearchuserrolebindings - API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: OpensearchUserRoleBindingSpec defines the desired state of - OpensearchUserRoleBinding - properties: - backendRoles: - items: - type: string - type: array - opensearchCluster: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - roles: - items: - type: string - type: array - users: - items: - type: string - type: array - required: - - opensearchCluster - - roles - type: object - status: - description: OpensearchUserRoleBindingStatus defines the observed state - of OpensearchUserRoleBinding - properties: - managedCluster: - description: |- - UID is a type that holds unique ID values, including UUIDs. Because we - don't ONLY use UUIDs, this is an alias to string. Being a type captures - intent and helps make sure that UIDs and names do not get conflated. - type: string - provisionedBackendRoles: - items: - type: string - type: array - provisionedRoles: - items: - type: string - type: array - provisionedUsers: - items: - type: string - type: array - reason: - type: string - state: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchusers.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchusers.yaml deleted file mode 100644 index 8d573ee7..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/files/opensearch.opster.io_opensearchusers.yaml +++ /dev/null @@ -1,117 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: opensearchusers.opensearch.opster.io -spec: - group: opensearch.opster.io - names: - kind: OpensearchUser - listKind: OpensearchUserList - plural: opensearchusers - shortNames: - - opensearchuser - singular: opensearchuser - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: OpensearchUser is the Schema for the opensearchusers API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: OpensearchUserSpec defines the desired state of OpensearchUser - properties: - attributes: - additionalProperties: - type: string - type: object - backendRoles: - items: - type: string - type: array - opendistroSecurityRoles: - items: - type: string - type: array - opensearchCluster: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - passwordFrom: - description: SecretKeySelector selects a key of a Secret. - properties: - key: - description: The key of the secret to select from. Must be a - valid secret key. - type: string - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - optional: - description: Specify whether the Secret or its key must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - required: - - opensearchCluster - - passwordFrom - type: object - status: - description: OpensearchUserStatus defines the observed state of OpensearchUser - properties: - managedCluster: - description: |- - UID is a type that holds unique ID values, including UUIDs. Because we - don't ONLY use UUIDs, this is an alias to string. Being a type captures - intent and helps make sure that UIDs and names do not get conflated. - type: string - reason: - type: string - state: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/_helpers.tpl b/packages/system/opensearch-operator/charts/opensearch-operator/templates/_helpers.tpl deleted file mode 100644 index 32f313e3..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/_helpers.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "opensearch-operator.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "opensearch-operator.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "opensearch-operator.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "opensearch-operator.labels" -}} -helm.sh/chart: {{ include "opensearch-operator.chart" . }} -{{ include "opensearch-operator.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "opensearch-operator.selectorLabels" -}} -app.kubernetes.io/name: {{ include "opensearch-operator.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "opensearch-operator.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (printf "%s-%s" (include "opensearch-operator.fullname" .) "controller-manager") .Values.serviceAccount.name }} -{{- else }} -{{- default "opensearch-operator-controller-manager" .Values.serviceAccount.name }} -{{- end }} -{{- end }} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml deleted file mode 100644 index 114e6b20..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml +++ /dev/null @@ -1,94 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - control-plane: controller-manager - name: {{ include "opensearch-operator.fullname" . }}-controller-manager -spec: - replicas: 1 - selector: - matchLabels: - control-plane: controller-manager - template: - metadata: - labels: - control-plane: controller-manager - {{- with .Values.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - containers: - {{- if or (.Values.kubeRbacProxy.enable) (eq (.Values.kubeRbacProxy.enable | toString) "") }} - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --proxy-endpoints-port=10443 - - --logtostderr=true - - --v=10 - image: "{{ .Values.kubeRbacProxy.image.repository }}:{{ .Values.kubeRbacProxy.image.tag}}" - name: kube-rbac-proxy - resources: -{{- toYaml .Values.kubeRbacProxy.resources | nindent 10 }} - readinessProbe: -{{- toYaml .Values.kubeRbacProxy.readinessProbe | nindent 10 }} - livenessProbe: -{{- toYaml .Values.kubeRbacProxy.livenessProbe | nindent 10 }} - securityContext: -{{- toYaml .Values.kubeRbacProxy.securityContext | nindent 10 }} - ports: - - containerPort: 8443 - name: https - - containerPort: 10443 - name: https-proxy - protocol: TCP - {{- end}} - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - {{- if .Values.manager.watchNamespace }} - - --watch-namespace={{ .Values.manager.watchNamespace }} - {{- end }} - - --loglevel={{ .Values.manager.loglevel }} - command: - - /manager - image: "{{ .Values.manager.image.repository }}:{{ .Values.manager.image.tag | default .Chart.AppVersion }}" - name: operator-controller-manager - imagePullPolicy: "{{ .Values.manager.image.pullPolicy }}" - resources: -{{- toYaml .Values.manager.resources | nindent 10 }} - readinessProbe: -{{- toYaml .Values.manager.readinessProbe | nindent 10 }} - livenessProbe: -{{- toYaml .Values.manager.livenessProbe | nindent 10 }} - env: - - name: DNS_BASE - value: {{ .Values.manager.dnsBase }} - - name: PARALLEL_RECOVERY_ENABLED - value: "{{ .Values.manager.parallelRecoveryEnabled }}" - - name: PPROF_ENDPOINTS_ENABLED - value: "{{ .Values.manager.pprofEndpointsEnabled }}" - {{- if .Values.manager.extraEnv }} - {{- toYaml .Values.manager.extraEnv | nindent 10 }} - {{- end }} - securityContext: -{{- toYaml .Values.manager.securityContext | nindent 10 }} - nodeSelector: -{{- toYaml .Values.nodeSelector | nindent 8 }} - tolerations: -{{- toYaml .Values.tolerations | nindent 8 }} - securityContext: -{{- toYaml .Values.securityContext | nindent 8 }} - {{- if .Values.manager.imagePullSecrets }} - imagePullSecrets: - {{- toYaml .Values.manager.imagePullSecrets | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "opensearch-operator.serviceAccountName" . }} - terminationGracePeriodSeconds: 10 - {{- if .Values.priorityClassName }} - priorityClassName: {{ .Values.priorityClassName }} - {{- end }} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-metrics-service-svc.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-metrics-service-svc.yaml deleted file mode 100644 index e4c6e820..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-metrics-service-svc.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - control-plane: controller-manager - name: {{ include "opensearch-operator.fullname" . }}-controller-manager-metrics-service -spec: - ports: - - name: https - port: 8443 - targetPort: https - selector: - control-plane: controller-manager diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-sa.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-sa.yaml deleted file mode 100644 index ee5a1ca2..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-sa.yaml +++ /dev/null @@ -1,6 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "opensearch-operator.serviceAccountName" . }} -{{- end -}} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-crds.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-crds.yaml deleted file mode 100644 index 21fdeedb..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-crds.yaml +++ /dev/null @@ -1,5 +0,0 @@ -{{- if .Values.installCRDs -}} -{{- range $path, $bytes := .Files.Glob "files/*.yaml" }} -{{ $.Files.Get $path }} -{{- end }} -{{- end }} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-role-role.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-role-role.yaml deleted file mode 100644 index aa8853e0..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-role-role.yaml +++ /dev/null @@ -1,48 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "opensearch-operator.fullname" . }}-leader-election-role -rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch -- apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - create - - delete - - get - - list - - patch - - update - - watch diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-rolebinding-rb.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-rolebinding-rb.yaml deleted file mode 100644 index 654a0a7d..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-leader-election-rolebinding-rb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "opensearch-operator.fullname" . }}-leader-election-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ include "opensearch-operator.fullname" . }}-leader-election-role -subjects: -- kind: ServiceAccount - name: {{ include "opensearch-operator.serviceAccountName" . }} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-config-cm.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-config-cm.yaml deleted file mode 100644 index c2e9a13f..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-config-cm.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -data: - controller_manager_config.yaml: | - apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 - kind: ControllerManagerConfig - health: - healthProbeBindAddress: :8081 - metrics: - bindAddress: 127.0.0.1:8080 - webhook: - port: 9443 - leaderElection: - leaderElect: true - resourceName: a867c7dc.opensearch.opster.io -kind: ConfigMap -metadata: - name: {{ include "opensearch-operator.fullname" . }}-manager-config diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-role-cr.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-role-cr.yaml deleted file mode 100644 index 3daf70d4..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-role-cr.yaml +++ /dev/null @@ -1,414 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - creationTimestamp: null - name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-role -rules: -- apiGroups: - - apps - resources: - - deployments - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - apps - resources: - - statefulsets - - statefulsets/status - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - batch - resources: - - jobs - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - update -- apiGroups: - - "" - resources: - - namespaces - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "policy" - resources: - - poddisruptionbudgets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - events - verbs: - - create - - patch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchactiongroups - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchactiongroups/finalizers - verbs: - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchactiongroups/status - verbs: - - get - - patch - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchclusters - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchclusters/finalizers - verbs: - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchclusters/status - verbs: - - get - - patch - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchcomponenttemplates - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchcomponenttemplates/finalizers - verbs: - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchcomponenttemplates/status - verbs: - - get - - patch - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchindextemplates - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchindextemplates/finalizers - verbs: - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchindextemplates/status - verbs: - - get - - patch - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchroles - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchroles/finalizers - verbs: - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchroles/status - verbs: - - get - - patch - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchtenants - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchtenants/finalizers - verbs: - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchtenants/status - verbs: - - get - - patch - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchuserrolebindings - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchuserrolebindings/finalizers - verbs: - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchuserrolebindings/status - verbs: - - get - - patch - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchismpolicies/status - verbs: - - get - - patch - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchismpolicies/finalizers - verbs: - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchusers - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchismpolicies - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchusers/finalizers - verbs: - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchusers/status - verbs: - - get - - patch - - update -- apiGroups: - - "" - resources: - - persistentvolumeclaims - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchsnapshotpolicies - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - opensearch.opster.io - resources: - - opensearchsnapshotpolicies/status - verbs: - - get - - patch - - update -- apiGroups: - - opensearch.opster.io - resources: - - opensearchsnapshotpolicies/finalizers - verbs: - - update \ No newline at end of file diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml deleted file mode 100644 index a528ffdf..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{- if .Values.useRoleBindings }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-role -subjects: -- kind: ServiceAccount - name: {{ include "opensearch-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- else }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-role -subjects: -- kind: ServiceAccount - name: {{ include "opensearch-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml deleted file mode 100644 index c8f9d89c..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-metrics-reader -rules: -- nonResourceURLs: - - /metrics - verbs: - - get diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-role-cr.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-role-cr.yaml deleted file mode 100644 index cbd6cb77..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-role-cr.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-role -rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml deleted file mode 100644 index 5cba0693..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-role -subjects: -- kind: ServiceAccount - name: {{ include "opensearch-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} diff --git a/packages/system/opensearch-operator/charts/opensearch-operator/values.yaml b/packages/system/opensearch-operator/charts/opensearch-operator/values.yaml deleted file mode 100644 index 1ee839bb..00000000 --- a/packages/system/opensearch-operator/charts/opensearch-operator/values.yaml +++ /dev/null @@ -1,123 +0,0 @@ -nameOverride: "" -fullnameOverride: "" - -podAnnotations: {} -podLabels: {} -nodeSelector: {} -tolerations: [] -securityContext: - runAsNonRoot: true -priorityClassName: "" -manager: - securityContext: - allowPrivilegeEscalation: false - extraEnv: [] - resources: - limits: - cpu: 200m - memory: 500Mi - requests: - cpu: 100m - memory: 350Mi - - livenessProbe: - failureThreshold: 3 - httpGet: - path: /healthz - port: 8081 - periodSeconds: 15 - successThreshold: 1 - timeoutSeconds: 3 - initialDelaySeconds: 10 - - readinessProbe: - failureThreshold: 3 - httpGet: - path: /readyz - port: 8081 - periodSeconds: 15 - successThreshold: 1 - timeoutSeconds: 3 - initialDelaySeconds: 10 - - # Set this to false to disable the experimental parallel recovery in case you are experiencing problems - parallelRecoveryEnabled: true - # Set this to true to enable the standard go pprof endpoints on port 6060 (https://pkg.go.dev/net/http/pprof) - # Should only be used for debugging purposes - pprofEndpointsEnabled: false - - image: - repository: opensearchproject/opensearch-operator - ## tag default uses appVersion from Chart.yaml, to override specify tag tag: "v1.1" - tag: "" - pullPolicy: "Always" - - ## Optional array of imagePullSecrets containing private registry credentials - imagePullSecrets: [] - # - name: secretName - - dnsBase: cluster.local - - # Log level of the operator. Possible values: debug, info, warn, error - loglevel: info - - # If a watchNamespace is specified, the manager's cache will be restricted to - # watch objects in the desired namespace. Defaults is to watch all namespaces. - watchNamespace: - -# Install the Custom Resource Definitions with Helm -installCRDs: true - -serviceAccount: - # Specifies whether a service account should be created - create: true - # Override the service account name. Defaults to opensearch-operator-controller-manager - name: "" - -kubeRbacProxy: - enable: true - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - resources: - limits: - cpu: 50m - memory: 50Mi - requests: - cpu: 25m - memory: 25Mi - - livenessProbe: - failureThreshold: 3 - httpGet: - path: /healthz - port: 10443 - scheme: HTTPS - periodSeconds: 15 - successThreshold: 1 - timeoutSeconds: 3 - initialDelaySeconds: 10 - - readinessProbe: - failureThreshold: 3 - httpGet: - path: /healthz - port: 10443 - scheme: HTTPS - periodSeconds: 15 - successThreshold: 1 - timeoutSeconds: 3 - initialDelaySeconds: 10 - - image: - repository: "gcr.io/kubebuilder/kube-rbac-proxy" - tag: "v0.15.0" - -## If this is set to true, RoleBindings will be used instead of ClusterRoleBindings, inorder to restrict ClusterRoles -## to the namespace where the operator and OpenSearch cluster are in. In that case, specify the namespace where they -## are in in manager.watchNamespace field. -## If false, ClusterRoleBindings will be used -useRoleBindings: false diff --git a/packages/system/opensearch-operator/values.yaml b/packages/system/opensearch-operator/values.yaml deleted file mode 100644 index 619aa99b..00000000 --- a/packages/system/opensearch-operator/values.yaml +++ /dev/null @@ -1,4 +0,0 @@ -opensearch-operator: - manager: - # Enable cluster-wide mode to watch all namespaces - watchNamespace: "" diff --git a/packages/system/opensearch-rd/Chart.yaml b/packages/system/opensearch-rd/Chart.yaml deleted file mode 100644 index c0ca3b86..00000000 --- a/packages/system/opensearch-rd/Chart.yaml +++ /dev/null @@ -1,3 +0,0 @@ -apiVersion: v2 -name: opensearch-rd -version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process diff --git a/packages/system/opensearch-rd/Makefile b/packages/system/opensearch-rd/Makefile deleted file mode 100644 index 7d3c0311..00000000 --- a/packages/system/opensearch-rd/Makefile +++ /dev/null @@ -1,4 +0,0 @@ -export NAME=opensearch-rd -export NAMESPACE=cozy-system - -include ../../../hack/package.mk diff --git a/packages/system/opensearch-rd/cozyrds/opensearch.yaml b/packages/system/opensearch-rd/cozyrds/opensearch.yaml deleted file mode 100644 index d74430c1..00000000 --- a/packages/system/opensearch-rd/cozyrds/opensearch.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: cozystack.io/v1alpha1 -kind: ApplicationDefinition -metadata: - name: opensearch -spec: - application: - kind: OpenSearch - singular: opensearch - plural: opensearches - openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of OpenSearch nodes in the cluster.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"topologySpreadPolicy":{"description":"How strictly to enforce pod distribution across nodes and zones.","type":"string","default":"soft","enum":["soft","hard"]},"version":{"description":"OpenSearch major version to deploy.","type":"string","default":"v2","enum":["v3","v2","v1"]},"images":{"description":"Container images used by the operator.","type":"object","default":{},"required":["opensearch"],"properties":{"opensearch":{"description":"OpenSearch image.","type":"string","default":""}}},"nodeRoles":{"description":"Node roles configuration.","type":"object","default":{},"required":["data","ingest","master","ml"],"properties":{"data":{"description":"Enable data role.","type":"boolean","default":true},"ingest":{"description":"Enable ingest role.","type":"boolean","default":true},"master":{"description":"Enable cluster_manager role.","type":"boolean","default":true},"ml":{"description":"Enable machine learning role.","type":"boolean","default":false}}},"users":{"description":"Custom OpenSearch users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (auto-generated if omitted).","type":"string"},"roles":{"description":"List of OpenSearch roles.","type":"array","items":{"type":"string"}}}}},"dashboards":{"description":"OpenSearch Dashboards configuration.","type":"object","default":{},"required":["enabled","replicas","resourcesPreset"],"properties":{"enabled":{"description":"Enable OpenSearch Dashboards deployment.","type":"boolean","default":false},"replicas":{"description":"Number of Dashboards replicas.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for Dashboards.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each node.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset for Dashboards.","type":"string","default":"medium","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}} - release: - prefix: opensearch- - labels: - sharding.fluxcd.io/key: tenants - chartRef: - kind: ExternalArtifact - name: cozystack-opensearch-application-default-opensearch - namespace: cozy-system - dashboard: - category: PaaS - singular: OpenSearch - plural: OpenSearch Clusters - description: Managed OpenSearch service - tags: - - database - - search - icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl9vcGVuc2VhcmNoKSIvPgo8cGF0aCBkPSJNNzIgMzZDNDQgMzYgMjggNTIgMjggNzJDMjggOTIgNDQgMTA4IDcyIDEwOEMxMDAgMTA4IDExNiA5MiAxMTYgNzIiIHN0cm9rZT0iIzAwNUVCOCIgc3Ryb2tlLXdpZHRoPSI4IiBzdHJva2UtbGluZWNhcD0icm91bmQiIGZpbGw9Im5vbmUiLz4KPGNpcmNsZSBjeD0iMTE2IiBjeT0iNzIiIHI9IjgiIGZpbGw9IiMwMDVFQjgiLz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhcl9vcGVuc2VhcmNoIiB4MT0iMTQwIiB5MT0iMTMwLjUiIHgyPSI0IiB5Mj0iOS40OTk5OSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjMDAzQjVDIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzAwNUVCOCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8L2RlZnM+Cjwvc3ZnPgo= - keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "topologySpreadPolicy"], ["spec", "version"], ["spec", "images"], ["spec", "images", "opensearch"], ["spec", "nodeRoles"], ["spec", "nodeRoles", "master"], ["spec", "nodeRoles", "data"], ["spec", "nodeRoles", "ingest"], ["spec", "nodeRoles", "ml"], ["spec", "users"], ["spec", "dashboards"], ["spec", "dashboards", "enabled"], ["spec", "dashboards", "replicas"], ["spec", "dashboards", "resources"], ["spec", "dashboards", "resourcesPreset"]] - secrets: - exclude: [] - include: - - resourceNames: - - opensearch-{{ .name }}-credentials - services: - exclude: [] - include: - - resourceNames: - - opensearch-{{ .name }} - - opensearch-{{ .name }}-external - - opensearch-{{ .name }}-dashboards - - opensearch-{{ .name }}-dashboards-external diff --git a/packages/system/opensearch-rd/templates/cozyrd.yaml b/packages/system/opensearch-rd/templates/cozyrd.yaml deleted file mode 100644 index e079ddcf..00000000 --- a/packages/system/opensearch-rd/templates/cozyrd.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{- range $path, $_ := .Files.Glob "cozyrds/*" }} ---- -{{ $.Files.Get $path }} -{{- end }} diff --git a/packages/system/opensearch-rd/values.yaml b/packages/system/opensearch-rd/values.yaml deleted file mode 100644 index 0967ef42..00000000 --- a/packages/system/opensearch-rd/values.yaml +++ /dev/null @@ -1 +0,0 @@ -{} diff --git a/packages/system/postgres-operator/Makefile b/packages/system/postgres-operator/Makefile index 5279f8a7..f58f235f 100644 --- a/packages/system/postgres-operator/Makefile +++ b/packages/system/postgres-operator/Makefile @@ -3,12 +3,9 @@ export NAMESPACE=cozy-$(NAME) include ../../../hack/package.mk -test: - helm unittest . - update: rm -rf charts helm repo add cnpg https://cloudnative-pg.github.io/charts helm repo update cnpg - helm pull cnpg/cloudnative-pg --untar --untardir charts --version 0.26.1 + helm pull cnpg/cloudnative-pg --untar --untardir charts rm -rf charts/cloudnative-pg/charts diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml index 31e6afd0..191ae9c9 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml +++ b/packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 1.27.1 +appVersion: 1.25.0 dependencies: - alias: monitoring condition: monitoring.grafanaDashboard.create @@ -22,4 +22,4 @@ name: cloudnative-pg sources: - https://github.com/cloudnative-pg/charts type: application -version: 0.26.1 +version: 0.23.0 diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/README.md b/packages/system/postgres-operator/charts/cloudnative-pg/README.md index 10a69657..9ac1378d 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/README.md +++ b/packages/system/postgres-operator/charts/cloudnative-pg/README.md @@ -1,6 +1,6 @@ # cloudnative-pg -![Version: 0.26.1](https://img.shields.io/badge/Version-0.26.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.27.1](https://img.shields.io/badge/AppVersion-1.27.1-informational?style=flat-square) +![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.25.0](https://img.shields.io/badge/AppVersion-1.25.0-informational?style=flat-square) CloudNativePG Operator Helm Chart @@ -26,7 +26,7 @@ CloudNativePG Operator Helm Chart | Key | Type | Default | Description | |-----|------|---------|-------------| -| additionalArgs | list | `[]` | Additional arguments to be added to the operator's args list. | +| additionalArgs | list | `[]` | Additinal arguments to be added to the operator's args list. | | additionalEnv | list | `[]` | Array containing extra environment variables which can be templated. For example: - name: RELEASE_NAME value: "{{ .Release.Name }}" - name: MY_VAR value: "mySpecialKey" | | affinity | object | `{}` | Affinity for the operator to be installed. | | commonAnnotations | object | `{}` | Annotations to be added to all other resources. | @@ -57,7 +57,7 @@ CloudNativePG Operator Helm Chart | monitoring.podMonitorMetricRelabelings | list | `[]` | Metrics relabel configurations to apply to samples before ingestion. | | monitoring.podMonitorRelabelings | list | `[]` | Relabel configurations to apply to samples before scraping. | | monitoringQueriesConfigMap.name | string | `"cnpg-default-monitoring"` | The name of the default monitoring configmap. | -| monitoringQueriesConfigMap.queries | string | `"backends:\n query: |\n SELECT sa.datname\n , sa.usename\n , sa.application_name\n , states.state\n , COALESCE(sa.count, 0) AS total\n , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds\n FROM ( VALUES ('active')\n , ('idle')\n , ('idle in transaction')\n , ('idle in transaction (aborted)')\n , ('fastpath function call')\n , ('disabled')\n ) AS states(state)\n LEFT JOIN (\n SELECT datname\n , state\n , usename\n , COALESCE(application_name, '') AS application_name\n , COUNT(*)\n , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs\n FROM pg_catalog.pg_stat_activity\n GROUP BY datname, state, usename, application_name\n ) sa ON states.state = sa.state\n WHERE sa.usename IS NOT NULL\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - usename:\n usage: \"LABEL\"\n description: \"Name of the user\"\n - application_name:\n usage: \"LABEL\"\n description: \"Name of the application\"\n - state:\n usage: \"LABEL\"\n description: \"State of the backend\"\n - total:\n usage: \"GAUGE\"\n description: \"Number of backends\"\n - max_tx_duration_seconds:\n usage: \"GAUGE\"\n description: \"Maximum duration of a transaction in seconds\"\n\nbackends_waiting:\n query: |\n SELECT count(*) AS total\n FROM pg_catalog.pg_locks blocked_locks\n JOIN pg_catalog.pg_locks blocking_locks\n ON blocking_locks.locktype = blocked_locks.locktype\n AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database\n AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation\n AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page\n AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple\n AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid\n AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid\n AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid\n AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid\n AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid\n AND blocking_locks.pid != blocked_locks.pid\n JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid\n WHERE NOT blocked_locks.granted\n metrics:\n - total:\n usage: \"GAUGE\"\n description: \"Total number of backends that are currently waiting on other queries\"\n\npg_database:\n query: |\n SELECT datname\n , pg_catalog.pg_database_size(datname) AS size_bytes\n , pg_catalog.age(datfrozenxid) AS xid_age\n , pg_catalog.mxid_age(datminmxid) AS mxid_age\n FROM pg_catalog.pg_database\n WHERE datallowconn\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - size_bytes:\n usage: \"GAUGE\"\n description: \"Disk space used by the database\"\n - xid_age:\n usage: \"GAUGE\"\n description: \"Number of transactions from the frozen XID to the current one\"\n - mxid_age:\n usage: \"GAUGE\"\n description: \"Number of multiple transactions (Multixact) from the frozen XID to the current one\"\n\npg_postmaster:\n query: |\n SELECT EXTRACT(EPOCH FROM pg_postmaster_start_time) AS start_time\n FROM pg_catalog.pg_postmaster_start_time()\n metrics:\n - start_time:\n usage: \"GAUGE\"\n description: \"Time at which postgres started (based on epoch)\"\n\npg_replication:\n query: \"SELECT CASE WHEN (\n NOT pg_catalog.pg_is_in_recovery()\n OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())\n THEN 0\n ELSE GREATEST (0,\n EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))\n END AS lag,\n pg_catalog.pg_is_in_recovery() AS in_recovery,\n EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,\n (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas\"\n metrics:\n - lag:\n usage: \"GAUGE\"\n description: \"Replication lag behind primary in seconds\"\n - in_recovery:\n usage: \"GAUGE\"\n description: \"Whether the instance is in recovery\"\n - is_wal_receiver_up:\n usage: \"GAUGE\"\n description: \"Whether the instance wal_receiver is up\"\n - streaming_replicas:\n usage: \"GAUGE\"\n description: \"Number of streaming replicas connected to the instance\"\n\npg_replication_slots:\n query: |\n SELECT slot_name,\n slot_type,\n database,\n active,\n (CASE pg_catalog.pg_is_in_recovery()\n WHEN TRUE THEN pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_last_wal_receive_lsn(), restart_lsn)\n ELSE pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), restart_lsn)\n END) as pg_wal_lsn_diff\n FROM pg_catalog.pg_replication_slots\n WHERE NOT temporary\n metrics:\n - slot_name:\n usage: \"LABEL\"\n description: \"Name of the replication slot\"\n - slot_type:\n usage: \"LABEL\"\n description: \"Type of the replication slot\"\n - database:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - active:\n usage: \"GAUGE\"\n description: \"Flag indicating whether the slot is active\"\n - pg_wal_lsn_diff:\n usage: \"GAUGE\"\n description: \"Replication lag in bytes\"\n\npg_stat_archiver:\n query: |\n SELECT archived_count\n , failed_count\n , COALESCE(EXTRACT(EPOCH FROM (now() - last_archived_time)), -1) AS seconds_since_last_archival\n , COALESCE(EXTRACT(EPOCH FROM (now() - last_failed_time)), -1) AS seconds_since_last_failure\n , COALESCE(EXTRACT(EPOCH FROM last_archived_time), -1) AS last_archived_time\n , COALESCE(EXTRACT(EPOCH FROM last_failed_time), -1) AS last_failed_time\n , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn\n , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn\n , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n FROM pg_catalog.pg_stat_archiver\n metrics:\n - archived_count:\n usage: \"COUNTER\"\n description: \"Number of WAL files that have been successfully archived\"\n - failed_count:\n usage: \"COUNTER\"\n description: \"Number of failed attempts for archiving WAL files\"\n - seconds_since_last_archival:\n usage: \"GAUGE\"\n description: \"Seconds since the last successful archival operation\"\n - seconds_since_last_failure:\n usage: \"GAUGE\"\n description: \"Seconds since the last failed archival operation\"\n - last_archived_time:\n usage: \"GAUGE\"\n description: \"Epoch of the last time WAL archiving succeeded\"\n - last_failed_time:\n usage: \"GAUGE\"\n description: \"Epoch of the last time WAL archiving failed\"\n - last_archived_wal_start_lsn:\n usage: \"GAUGE\"\n description: \"Archived WAL start LSN\"\n - last_failed_wal_start_lsn:\n usage: \"GAUGE\"\n description: \"Last failed WAL LSN\"\n - stats_reset_time:\n usage: \"GAUGE\"\n description: \"Time at which these statistics were last reset\"\n\npg_stat_bgwriter:\n runonserver: \"<17.0.0\"\n query: |\n SELECT checkpoints_timed\n , checkpoints_req\n , checkpoint_write_time\n , checkpoint_sync_time\n , buffers_checkpoint\n , buffers_clean\n , maxwritten_clean\n , buffers_backend\n , buffers_backend_fsync\n , buffers_alloc\n FROM pg_catalog.pg_stat_bgwriter\n metrics:\n - checkpoints_timed:\n usage: \"COUNTER\"\n description: \"Number of scheduled checkpoints that have been performed\"\n - checkpoints_req:\n usage: \"COUNTER\"\n description: \"Number of requested checkpoints that have been performed\"\n - checkpoint_write_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk, in milliseconds\"\n - checkpoint_sync_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk, in milliseconds\"\n - buffers_checkpoint:\n usage: \"COUNTER\"\n description: \"Number of buffers written during checkpoints\"\n - buffers_clean:\n usage: \"COUNTER\"\n description: \"Number of buffers written by the background writer\"\n - maxwritten_clean:\n usage: \"COUNTER\"\n description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n - buffers_backend:\n usage: \"COUNTER\"\n description: \"Number of buffers written directly by a backend\"\n - buffers_backend_fsync:\n usage: \"COUNTER\"\n description: \"Number of times a backend had to execute its own fsync call (normally the background writer handles those even when the backend does its own write)\"\n - buffers_alloc:\n usage: \"COUNTER\"\n description: \"Number of buffers allocated\"\n\npg_stat_bgwriter_17:\n runonserver: \">=17.0.0\"\n name: pg_stat_bgwriter\n query: |\n SELECT buffers_clean\n , maxwritten_clean\n , buffers_alloc\n , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n FROM pg_catalog.pg_stat_bgwriter\n metrics:\n - buffers_clean:\n usage: \"COUNTER\"\n description: \"Number of buffers written by the background writer\"\n - maxwritten_clean:\n usage: \"COUNTER\"\n description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n - buffers_alloc:\n usage: \"COUNTER\"\n description: \"Number of buffers allocated\"\n - stats_reset_time:\n usage: \"GAUGE\"\n description: \"Time at which these statistics were last reset\"\n\npg_stat_checkpointer:\n runonserver: \">=17.0.0\"\n query: |\n SELECT num_timed AS checkpoints_timed\n , num_requested AS checkpoints_req\n , restartpoints_timed\n , restartpoints_req\n , restartpoints_done\n , write_time\n , sync_time\n , buffers_written\n , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n FROM pg_catalog.pg_stat_checkpointer\n metrics:\n - checkpoints_timed:\n usage: \"COUNTER\"\n description: \"Number of scheduled checkpoints that have been performed\"\n - checkpoints_req:\n usage: \"COUNTER\"\n description: \"Number of requested checkpoints that have been performed\"\n - restartpoints_timed:\n usage: \"COUNTER\"\n description: \"Number of scheduled restartpoints due to timeout or after a failed attempt to perform it\"\n - restartpoints_req:\n usage: \"COUNTER\"\n description: \"Number of requested restartpoints that have been performed\"\n - restartpoints_done:\n usage: \"COUNTER\"\n description: \"Number of restartpoints that have been performed\"\n - write_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are written to disk, in milliseconds\"\n - sync_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are synchronized to disk, in milliseconds\"\n - buffers_written:\n usage: \"COUNTER\"\n description: \"Number of buffers written during checkpoints and restartpoints\"\n - stats_reset_time:\n usage: \"GAUGE\"\n description: \"Time at which these statistics were last reset\"\n\npg_stat_database:\n query: |\n SELECT datname\n , xact_commit\n , xact_rollback\n , blks_read\n , blks_hit\n , tup_returned\n , tup_fetched\n , tup_inserted\n , tup_updated\n , tup_deleted\n , conflicts\n , temp_files\n , temp_bytes\n , deadlocks\n , blk_read_time\n , blk_write_time\n FROM pg_catalog.pg_stat_database\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of this database\"\n - xact_commit:\n usage: \"COUNTER\"\n description: \"Number of transactions in this database that have been committed\"\n - xact_rollback:\n usage: \"COUNTER\"\n description: \"Number of transactions in this database that have been rolled back\"\n - blks_read:\n usage: \"COUNTER\"\n description: \"Number of disk blocks read in this database\"\n - blks_hit:\n usage: \"COUNTER\"\n description: \"Number of times disk blocks were found already in the buffer cache, so that a read was not necessary (this only includes hits in the PostgreSQL buffer cache, not the operating system's file system cache)\"\n - tup_returned:\n usage: \"COUNTER\"\n description: \"Number of rows returned by queries in this database\"\n - tup_fetched:\n usage: \"COUNTER\"\n description: \"Number of rows fetched by queries in this database\"\n - tup_inserted:\n usage: \"COUNTER\"\n description: \"Number of rows inserted by queries in this database\"\n - tup_updated:\n usage: \"COUNTER\"\n description: \"Number of rows updated by queries in this database\"\n - tup_deleted:\n usage: \"COUNTER\"\n description: \"Number of rows deleted by queries in this database\"\n - conflicts:\n usage: \"COUNTER\"\n description: \"Number of queries canceled due to conflicts with recovery in this database\"\n - temp_files:\n usage: \"COUNTER\"\n description: \"Number of temporary files created by queries in this database\"\n - temp_bytes:\n usage: \"COUNTER\"\n description: \"Total amount of data written to temporary files by queries in this database\"\n - deadlocks:\n usage: \"COUNTER\"\n description: \"Number of deadlocks detected in this database\"\n - blk_read_time:\n usage: \"COUNTER\"\n description: \"Time spent reading data file blocks by backends in this database, in milliseconds\"\n - blk_write_time:\n usage: \"COUNTER\"\n description: \"Time spent writing data file blocks by backends in this database, in milliseconds\"\n\npg_stat_replication:\n primary: true\n query: |\n SELECT usename\n , COALESCE(application_name, '') AS application_name\n , COALESCE(client_addr::text, '') AS client_addr\n , COALESCE(client_port::text, '') AS client_port\n , EXTRACT(EPOCH FROM backend_start) AS backend_start\n , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age\n , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes\n , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes\n , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes\n , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes\n , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds\n , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds\n , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds\n FROM pg_catalog.pg_stat_replication\n metrics:\n - usename:\n usage: \"LABEL\"\n description: \"Name of the replication user\"\n - application_name:\n usage: \"LABEL\"\n description: \"Name of the application\"\n - client_addr:\n usage: \"LABEL\"\n description: \"Client IP address\"\n - client_port:\n usage: \"LABEL\"\n description: \"Client TCP port\"\n - backend_start:\n usage: \"COUNTER\"\n description: \"Time when this process was started\"\n - backend_xmin_age:\n usage: \"COUNTER\"\n description: \"The age of this standby's xmin horizon\"\n - sent_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location sent on this connection\"\n - write_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location written to disk by this standby server\"\n - flush_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location flushed to disk by this standby server\"\n - replay_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location replayed into the database on this standby server\"\n - write_lag_seconds:\n usage: \"GAUGE\"\n description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written it\"\n - flush_lag_seconds:\n usage: \"GAUGE\"\n description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written and flushed it\"\n - replay_lag_seconds:\n usage: \"GAUGE\"\n description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written, flushed and applied it\"\n\npg_settings:\n query: |\n SELECT name,\n CASE setting WHEN 'on' THEN '1' WHEN 'off' THEN '0' ELSE setting END AS setting\n FROM pg_catalog.pg_settings\n WHERE vartype IN ('integer', 'real', 'bool')\n ORDER BY 1\n metrics:\n - name:\n usage: \"LABEL\"\n description: \"Name of the setting\"\n - setting:\n usage: \"GAUGE\"\n description: \"Setting value\"\n\npg_extensions:\n query: |\n SELECT\n current_database() as datname,\n name as extname,\n default_version,\n installed_version,\n CASE\n WHEN default_version = installed_version THEN 0\n ELSE 1\n END AS update_available\n FROM pg_catalog.pg_available_extensions\n WHERE installed_version IS NOT NULL\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - extname:\n usage: \"LABEL\"\n description: \"Extension name\"\n - default_version:\n usage: \"LABEL\"\n description: \"Default version\"\n - installed_version:\n usage: \"LABEL\"\n description: \"Installed version\"\n - update_available:\n usage: \"GAUGE\"\n description: \"An update is available\"\n target_databases:\n - '*'\n"` | A string representation of a YAML defining monitoring queries. | +| monitoringQueriesConfigMap.queries | string | `"backends:\n query: |\n SELECT sa.datname\n , sa.usename\n , sa.application_name\n , states.state\n , COALESCE(sa.count, 0) AS total\n , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds\n FROM ( VALUES ('active')\n , ('idle')\n , ('idle in transaction')\n , ('idle in transaction (aborted)')\n , ('fastpath function call')\n , ('disabled')\n ) AS states(state)\n LEFT JOIN (\n SELECT datname\n , state\n , usename\n , COALESCE(application_name, '') AS application_name\n , COUNT(*)\n , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs\n FROM pg_catalog.pg_stat_activity\n GROUP BY datname, state, usename, application_name\n ) sa ON states.state = sa.state\n WHERE sa.usename IS NOT NULL\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - usename:\n usage: \"LABEL\"\n description: \"Name of the user\"\n - application_name:\n usage: \"LABEL\"\n description: \"Name of the application\"\n - state:\n usage: \"LABEL\"\n description: \"State of the backend\"\n - total:\n usage: \"GAUGE\"\n description: \"Number of backends\"\n - max_tx_duration_seconds:\n usage: \"GAUGE\"\n description: \"Maximum duration of a transaction in seconds\"\n\nbackends_waiting:\n query: |\n SELECT count(*) AS total\n FROM pg_catalog.pg_locks blocked_locks\n JOIN pg_catalog.pg_locks blocking_locks\n ON blocking_locks.locktype = blocked_locks.locktype\n AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database\n AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation\n AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page\n AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple\n AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid\n AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid\n AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid\n AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid\n AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid\n AND blocking_locks.pid != blocked_locks.pid\n JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid\n WHERE NOT blocked_locks.granted\n metrics:\n - total:\n usage: \"GAUGE\"\n description: \"Total number of backends that are currently waiting on other queries\"\n\npg_database:\n query: |\n SELECT datname\n , pg_catalog.pg_database_size(datname) AS size_bytes\n , pg_catalog.age(datfrozenxid) AS xid_age\n , pg_catalog.mxid_age(datminmxid) AS mxid_age\n FROM pg_catalog.pg_database\n WHERE datallowconn\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - size_bytes:\n usage: \"GAUGE\"\n description: \"Disk space used by the database\"\n - xid_age:\n usage: \"GAUGE\"\n description: \"Number of transactions from the frozen XID to the current one\"\n - mxid_age:\n usage: \"GAUGE\"\n description: \"Number of multiple transactions (Multixact) from the frozen XID to the current one\"\n\npg_postmaster:\n query: |\n SELECT EXTRACT(EPOCH FROM pg_postmaster_start_time) AS start_time\n FROM pg_catalog.pg_postmaster_start_time()\n metrics:\n - start_time:\n usage: \"GAUGE\"\n description: \"Time at which postgres started (based on epoch)\"\n\npg_replication:\n query: \"SELECT CASE WHEN (\n NOT pg_catalog.pg_is_in_recovery()\n OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())\n THEN 0\n ELSE GREATEST (0,\n EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))\n END AS lag,\n pg_catalog.pg_is_in_recovery() AS in_recovery,\n EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,\n (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas\"\n metrics:\n - lag:\n usage: \"GAUGE\"\n description: \"Replication lag behind primary in seconds\"\n - in_recovery:\n usage: \"GAUGE\"\n description: \"Whether the instance is in recovery\"\n - is_wal_receiver_up:\n usage: \"GAUGE\"\n description: \"Whether the instance wal_receiver is up\"\n - streaming_replicas:\n usage: \"GAUGE\"\n description: \"Number of streaming replicas connected to the instance\"\n\npg_replication_slots:\n query: |\n SELECT slot_name,\n slot_type,\n database,\n active,\n (CASE pg_catalog.pg_is_in_recovery()\n WHEN TRUE THEN pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_last_wal_receive_lsn(), restart_lsn)\n ELSE pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), restart_lsn)\n END) as pg_wal_lsn_diff\n FROM pg_catalog.pg_replication_slots\n WHERE NOT temporary\n metrics:\n - slot_name:\n usage: \"LABEL\"\n description: \"Name of the replication slot\"\n - slot_type:\n usage: \"LABEL\"\n description: \"Type of the replication slot\"\n - database:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - active:\n usage: \"GAUGE\"\n description: \"Flag indicating whether the slot is active\"\n - pg_wal_lsn_diff:\n usage: \"GAUGE\"\n description: \"Replication lag in bytes\"\n\npg_stat_archiver:\n query: |\n SELECT archived_count\n , failed_count\n , COALESCE(EXTRACT(EPOCH FROM (now() - last_archived_time)), -1) AS seconds_since_last_archival\n , COALESCE(EXTRACT(EPOCH FROM (now() - last_failed_time)), -1) AS seconds_since_last_failure\n , COALESCE(EXTRACT(EPOCH FROM last_archived_time), -1) AS last_archived_time\n , COALESCE(EXTRACT(EPOCH FROM last_failed_time), -1) AS last_failed_time\n , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn\n , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn\n , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n FROM pg_catalog.pg_stat_archiver\n metrics:\n - archived_count:\n usage: \"COUNTER\"\n description: \"Number of WAL files that have been successfully archived\"\n - failed_count:\n usage: \"COUNTER\"\n description: \"Number of failed attempts for archiving WAL files\"\n - seconds_since_last_archival:\n usage: \"GAUGE\"\n description: \"Seconds since the last successful archival operation\"\n - seconds_since_last_failure:\n usage: \"GAUGE\"\n description: \"Seconds since the last failed archival operation\"\n - last_archived_time:\n usage: \"GAUGE\"\n description: \"Epoch of the last time WAL archiving succeeded\"\n - last_failed_time:\n usage: \"GAUGE\"\n description: \"Epoch of the last time WAL archiving failed\"\n - last_archived_wal_start_lsn:\n usage: \"GAUGE\"\n description: \"Archived WAL start LSN\"\n - last_failed_wal_start_lsn:\n usage: \"GAUGE\"\n description: \"Last failed WAL LSN\"\n - stats_reset_time:\n usage: \"GAUGE\"\n description: \"Time at which these statistics were last reset\"\n\npg_stat_bgwriter:\n runonserver: \"<17.0.0\"\n query: |\n SELECT checkpoints_timed\n , checkpoints_req\n , checkpoint_write_time\n , checkpoint_sync_time\n , buffers_checkpoint\n , buffers_clean\n , maxwritten_clean\n , buffers_backend\n , buffers_backend_fsync\n , buffers_alloc\n FROM pg_catalog.pg_stat_bgwriter\n metrics:\n - checkpoints_timed:\n usage: \"COUNTER\"\n description: \"Number of scheduled checkpoints that have been performed\"\n - checkpoints_req:\n usage: \"COUNTER\"\n description: \"Number of requested checkpoints that have been performed\"\n - checkpoint_write_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk, in milliseconds\"\n - checkpoint_sync_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk, in milliseconds\"\n - buffers_checkpoint:\n usage: \"COUNTER\"\n description: \"Number of buffers written during checkpoints\"\n - buffers_clean:\n usage: \"COUNTER\"\n description: \"Number of buffers written by the background writer\"\n - maxwritten_clean:\n usage: \"COUNTER\"\n description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n - buffers_backend:\n usage: \"COUNTER\"\n description: \"Number of buffers written directly by a backend\"\n - buffers_backend_fsync:\n usage: \"COUNTER\"\n description: \"Number of times a backend had to execute its own fsync call (normally the background writer handles those even when the backend does its own write)\"\n - buffers_alloc:\n usage: \"COUNTER\"\n description: \"Number of buffers allocated\"\n\npg_stat_bgwriter_17:\n runonserver: \">=17.0.0\"\n name: pg_stat_bgwriter\n query: |\n SELECT buffers_clean\n , maxwritten_clean\n , buffers_alloc\n , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n FROM pg_catalog.pg_stat_bgwriter\n metrics:\n - buffers_clean:\n usage: \"COUNTER\"\n description: \"Number of buffers written by the background writer\"\n - maxwritten_clean:\n usage: \"COUNTER\"\n description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n - buffers_alloc:\n usage: \"COUNTER\"\n description: \"Number of buffers allocated\"\n - stats_reset_time:\n usage: \"GAUGE\"\n description: \"Time at which these statistics were last reset\"\n\npg_stat_checkpointer:\n runonserver: \">=17.0.0\"\n query: |\n SELECT num_timed AS checkpoints_timed\n , num_requested AS checkpoints_req\n , restartpoints_timed\n , restartpoints_req\n , restartpoints_done\n , write_time\n , sync_time\n , buffers_written\n , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n FROM pg_catalog.pg_stat_checkpointer\n metrics:\n - checkpoints_timed:\n usage: \"COUNTER\"\n description: \"Number of scheduled checkpoints that have been performed\"\n - checkpoints_req:\n usage: \"COUNTER\"\n description: \"Number of requested checkpoints that have been performed\"\n - restartpoints_timed:\n usage: \"COUNTER\"\n description: \"Number of scheduled restartpoints due to timeout or after a failed attempt to perform it\"\n - restartpoints_req:\n usage: \"COUNTER\"\n description: \"Number of requested restartpoints that have been performed\"\n - restartpoints_done:\n usage: \"COUNTER\"\n description: \"Number of restartpoints that have been performed\"\n - write_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are written to disk, in milliseconds\"\n - sync_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are synchronized to disk, in milliseconds\"\n - buffers_written:\n usage: \"COUNTER\"\n description: \"Number of buffers written during checkpoints and restartpoints\"\n - stats_reset_time:\n usage: \"GAUGE\"\n description: \"Time at which these statistics were last reset\"\n\npg_stat_database:\n query: |\n SELECT datname\n , xact_commit\n , xact_rollback\n , blks_read\n , blks_hit\n , tup_returned\n , tup_fetched\n , tup_inserted\n , tup_updated\n , tup_deleted\n , conflicts\n , temp_files\n , temp_bytes\n , deadlocks\n , blk_read_time\n , blk_write_time\n FROM pg_catalog.pg_stat_database\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of this database\"\n - xact_commit:\n usage: \"COUNTER\"\n description: \"Number of transactions in this database that have been committed\"\n - xact_rollback:\n usage: \"COUNTER\"\n description: \"Number of transactions in this database that have been rolled back\"\n - blks_read:\n usage: \"COUNTER\"\n description: \"Number of disk blocks read in this database\"\n - blks_hit:\n usage: \"COUNTER\"\n description: \"Number of times disk blocks were found already in the buffer cache, so that a read was not necessary (this only includes hits in the PostgreSQL buffer cache, not the operating system's file system cache)\"\n - tup_returned:\n usage: \"COUNTER\"\n description: \"Number of rows returned by queries in this database\"\n - tup_fetched:\n usage: \"COUNTER\"\n description: \"Number of rows fetched by queries in this database\"\n - tup_inserted:\n usage: \"COUNTER\"\n description: \"Number of rows inserted by queries in this database\"\n - tup_updated:\n usage: \"COUNTER\"\n description: \"Number of rows updated by queries in this database\"\n - tup_deleted:\n usage: \"COUNTER\"\n description: \"Number of rows deleted by queries in this database\"\n - conflicts:\n usage: \"COUNTER\"\n description: \"Number of queries canceled due to conflicts with recovery in this database\"\n - temp_files:\n usage: \"COUNTER\"\n description: \"Number of temporary files created by queries in this database\"\n - temp_bytes:\n usage: \"COUNTER\"\n description: \"Total amount of data written to temporary files by queries in this database\"\n - deadlocks:\n usage: \"COUNTER\"\n description: \"Number of deadlocks detected in this database\"\n - blk_read_time:\n usage: \"COUNTER\"\n description: \"Time spent reading data file blocks by backends in this database, in milliseconds\"\n - blk_write_time:\n usage: \"COUNTER\"\n description: \"Time spent writing data file blocks by backends in this database, in milliseconds\"\n\npg_stat_replication:\n primary: true\n query: |\n SELECT usename\n , COALESCE(application_name, '') AS application_name\n , COALESCE(client_addr::text, '') AS client_addr\n , COALESCE(client_port::text, '') AS client_port\n , EXTRACT(EPOCH FROM backend_start) AS backend_start\n , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age\n , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes\n , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes\n , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes\n , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes\n , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds\n , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds\n , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds\n FROM pg_catalog.pg_stat_replication\n metrics:\n - usename:\n usage: \"LABEL\"\n description: \"Name of the replication user\"\n - application_name:\n usage: \"LABEL\"\n description: \"Name of the application\"\n - client_addr:\n usage: \"LABEL\"\n description: \"Client IP address\"\n - client_port:\n usage: \"LABEL\"\n description: \"Client TCP port\"\n - backend_start:\n usage: \"COUNTER\"\n description: \"Time when this process was started\"\n - backend_xmin_age:\n usage: \"COUNTER\"\n description: \"The age of this standby's xmin horizon\"\n - sent_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location sent on this connection\"\n - write_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location written to disk by this standby server\"\n - flush_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location flushed to disk by this standby server\"\n - replay_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location replayed into the database on this standby server\"\n - write_lag_seconds:\n usage: \"GAUGE\"\n description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written it\"\n - flush_lag_seconds:\n usage: \"GAUGE\"\n description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written and flushed it\"\n - replay_lag_seconds:\n usage: \"GAUGE\"\n description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written, flushed and applied it\"\n\npg_settings:\n query: |\n SELECT name,\n CASE setting WHEN 'on' THEN '1' WHEN 'off' THEN '0' ELSE setting END AS setting\n FROM pg_catalog.pg_settings\n WHERE vartype IN ('integer', 'real', 'bool')\n ORDER BY 1\n metrics:\n - name:\n usage: \"LABEL\"\n description: \"Name of the setting\"\n - setting:\n usage: \"GAUGE\"\n description: \"Setting value\"\n"` | A string representation of a YAML defining monitoring queries. | | nameOverride | string | `""` | | | namespaceOverride | string | `""` | | | nodeSelector | object | `{}` | Nodeselector for the operator to be installed. | @@ -77,7 +77,5 @@ CloudNativePG Operator Helm Chart | serviceAccount.create | bool | `true` | Specifies whether the service account should be created. | | serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template. | | tolerations | list | `[]` | Tolerations for the operator to be installed. | -| topologySpreadConstraints | list | `[]` | Topology Spread Constraints for the operator to be installed. | -| updateStrategy | object | `{}` | Update strategy for the operator. ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy For example: type: RollingUpdate rollingUpdate: maxSurge: 25% maxUnavailable: 25% | -| webhook | object | `{"livenessProbe":{"initialDelaySeconds":3},"mutating":{"create":true,"failurePolicy":"Fail"},"port":9443,"readinessProbe":{"initialDelaySeconds":3},"startupProbe":{"failureThreshold":6,"periodSeconds":5},"validating":{"create":true,"failurePolicy":"Fail"}}` | The webhook configuration. | +| webhook | object | `{"livenessProbe":{"initialDelaySeconds":3},"mutating":{"create":true,"failurePolicy":"Fail"},"port":9443,"readinessProbe":{"initialDelaySeconds":3},"validating":{"create":true,"failurePolicy":"Fail"}}` | The webhook configuration. | diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/NOTES.txt b/packages/system/postgres-operator/charts/cloudnative-pg/templates/NOTES.txt index 4c8ef66d..d0b65b9b 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/NOTES.txt +++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/NOTES.txt @@ -1,5 +1,5 @@ -CloudNativePG operator should be installed in namespace "{{ include "cloudnative-pg.namespace" . }}". +CloudNativePG operator should be installed in namespace "{{ .Release.Namespace }}". You can now create a PostgreSQL cluster with 3 nodes as follows: cat <= v2.36.0. `DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0. @@ -4382,41 +4322,41 @@ spec: type: string modulus: description: |- - modulus to take of the hash of the source label values. + Modulus to take of the hash of the source label values. Only applicable when the action is `HashMod`. format: int64 type: integer regex: - description: regex defines the regular expression against - which the extracted value is matched. + description: Regular expression against which the extracted + value is matched. type: string replacement: description: |- - replacement value against which a Replace action is performed if the + Replacement value against which a Replace action is performed if the regular expression matches. Regex capture groups are available. type: string separator: - description: separator defines the string between concatenated + description: Separator is the string between concatenated SourceLabels. type: string sourceLabels: description: |- - sourceLabels defines the source labels select values from existing labels. Their content is + The source labels select values from existing labels. Their content is concatenated using the configured Separator and matched against the configured regular expression. items: description: |- - LabelName is a valid Prometheus label name. - For Prometheus 3.x, a label name is valid if it contains UTF-8 characters. - For Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores. + LabelName is a valid Prometheus label name which may only contain ASCII + letters, numbers, as well as underscores. + pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ type: string type: array targetLabel: description: |- - targetLabel defines the label to which the resulting string is written in a replacement. + Label to which the resulting string is written in a replacement. It is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and `DropEqual` actions. @@ -4426,11 +4366,8 @@ spec: type: object type: array podMonitorRelabelings: - description: |- - The list of relabelings for the `PodMonitor`. Applied to samples before scraping. - - Deprecated: This feature will be removed in an upcoming release. If - you need this functionality, you can create a PodMonitor manually. + description: The list of relabelings for the `PodMonitor`. Applied + to samples before scraping. items: description: |- RelabelConfig allows dynamic rewriting of the label set for targets, alerts, @@ -4441,7 +4378,7 @@ spec: action: default: replace description: |- - action to perform based on the regex matching. + Action to perform based on the regex matching. `Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0. `DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0. @@ -4473,41 +4410,41 @@ spec: type: string modulus: description: |- - modulus to take of the hash of the source label values. + Modulus to take of the hash of the source label values. Only applicable when the action is `HashMod`. format: int64 type: integer regex: - description: regex defines the regular expression against - which the extracted value is matched. + description: Regular expression against which the extracted + value is matched. type: string replacement: description: |- - replacement value against which a Replace action is performed if the + Replacement value against which a Replace action is performed if the regular expression matches. Regex capture groups are available. type: string separator: - description: separator defines the string between concatenated + description: Separator is the string between concatenated SourceLabels. type: string sourceLabels: description: |- - sourceLabels defines the source labels select values from existing labels. Their content is + The source labels select values from existing labels. Their content is concatenated using the configured Separator and matched against the configured regular expression. items: description: |- - LabelName is a valid Prometheus label name. - For Prometheus 3.x, a label name is valid if it contains UTF-8 characters. - For Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores. + LabelName is a valid Prometheus label name which may only contain ASCII + letters, numbers, as well as underscores. + pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ type: string type: array targetLabel: description: |- - targetLabel defines the label to which the resulting string is written in a replacement. + Label to which the resulting string is written in a replacement. It is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and `DropEqual` actions. @@ -4556,13 +4493,6 @@ spec: default: true description: Enabled is true if this plugin will be used type: boolean - isWALArchiver: - default: false - description: |- - Marks the plugin as the WAL archiver. At most one plugin can be - designated as a WAL archiver. This cannot be enabled if the - `.spec.backup.barmanObjectStore` configuration is present. - type: boolean name: description: Name is the plugin name type: string @@ -4597,67 +4527,6 @@ spec: This should only be used for debugging and troubleshooting. Defaults to false. type: boolean - extensions: - description: The configuration of the extensions to be added - items: - description: |- - ExtensionConfiguration is the configuration used to add - PostgreSQL extensions to the Cluster. - properties: - dynamic_library_path: - description: |- - The list of directories inside the image which should be added to dynamic_library_path. - If not defined, defaults to "/lib". - items: - type: string - type: array - extension_control_path: - description: |- - The list of directories inside the image which should be added to extension_control_path. - If not defined, defaults to "/share". - items: - type: string - type: array - image: - description: The image containing the extension, required - properties: - pullPolicy: - description: |- - Policy for pulling OCI objects. Possible values are: - Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails. - Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present. - IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails. - Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. - type: string - reference: - description: |- - Required: Image or artifact reference to be used. - Behaves in the same way as pod.spec.containers[*].image. - Pull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets. - More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level config management to default or override - container images in workload controllers like Deployments and StatefulSets. - type: string - type: object - x-kubernetes-validations: - - message: An image reference is required - rule: has(self.reference) - ld_library_path: - description: The list of directories inside the image which - should be added to ld_library_path. - items: - type: string - type: array - name: - description: The name of the extension, required - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - image - - name - type: object - type: array ldap: description: Options to specify LDAP configuration properties: @@ -4785,6 +4654,7 @@ spec: feature properties: dataDurability: + default: required description: |- If set to "required", data durability is strictly enforced. Write operations with synchronous commit settings (`on`, `remote_write`, or `remote_apply`) will @@ -4896,30 +4766,6 @@ spec: More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer - isolationCheck: - description: |- - Configure the feature that extends the liveness probe for a primary - instance. In addition to the basic checks, this verifies whether the - primary is isolated from the Kubernetes API server and from its - replicas, ensuring that it can be safely shut down if network - partition or API unavailability is detected. Enabled by default. - properties: - connectionTimeout: - default: 1000 - description: Timeout in milliseconds for connections during - the primary isolation check - type: integer - enabled: - default: true - description: Whether primary isolation checking is enabled - for the liveness probe - type: boolean - requestTimeout: - default: 1000 - description: Timeout in milliseconds for requests during - the primary isolation check - type: integer - type: object periodSeconds: description: |- How often (in seconds) to perform the probe. @@ -4969,13 +4815,6 @@ spec: More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer - maximumLag: - anyOf: - - type: integer - - type: string - description: Lag limit. Used only for `streaming` strategy - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true periodSeconds: description: |- How often (in seconds) to perform the probe. @@ -5009,13 +4848,6 @@ spec: More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer - type: - description: The probe strategy - enum: - - pg_isready - - streaming - - query - type: string type: object startup: description: The startup probe configuration @@ -5032,13 +4864,6 @@ spec: More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer - maximumLag: - anyOf: - - type: integer - - type: string - description: Lag limit. Used only for `streaming` strategy - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true periodSeconds: description: |- How often (in seconds) to perform the probe. @@ -5072,13 +4897,6 @@ spec: More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer - type: - description: The probe strategy - enum: - - pg_isready - - streaming - - query - type: string type: object type: object projectedVolumeTemplate: @@ -5329,111 +5147,6 @@ spec: type: array x-kubernetes-list-type: atomic type: object - podCertificate: - description: |- - Projects an auto-rotating credential bundle (private key and certificate - chain) that the pod can use either as a TLS client or server. - - Kubelet generates a private key and uses it to send a - PodCertificateRequest to the named signer. Once the signer approves the - request and issues a certificate chain, Kubelet writes the key and - certificate chain to the pod filesystem. The pod does not start until - certificates have been issued for each podCertificate projected volume - source in its spec. - - Kubelet will begin trying to rotate the certificate at the time indicated - by the signer using the PodCertificateRequest.Status.BeginRefreshAt - timestamp. - - Kubelet can write a single file, indicated by the credentialBundlePath - field, or separate files, indicated by the keyPath and - certificateChainPath fields. - - The credential bundle is a single file in PEM format. The first PEM - entry is the private key (in PKCS#8 format), and the remaining PEM - entries are the certificate chain issued by the signer (typically, - signers will return their certificate chain in leaf-to-root order). - - Prefer using the credential bundle format, since your application code - can read it atomically. If you use keyPath and certificateChainPath, - your application must make two separate file reads. If these coincide - with a certificate rotation, it is possible that the private key and leaf - certificate you read may not correspond to each other. Your application - will need to check for this condition, and re-read until they are - consistent. - - The named signer controls chooses the format of the certificate it - issues; consult the signer implementation's documentation to learn how to - use the certificates it issues. - properties: - certificateChainPath: - description: |- - Write the certificate chain at this path in the projected volume. - - Most applications should use credentialBundlePath. When using keyPath - and certificateChainPath, your application needs to check that the key - and leaf certificate are consistent, because it is possible to read the - files mid-rotation. - type: string - credentialBundlePath: - description: |- - Write the credential bundle at this path in the projected volume. - - The credential bundle is a single file that contains multiple PEM blocks. - The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private - key. - - The remaining blocks are CERTIFICATE blocks, containing the issued - certificate chain from the signer (leaf and any intermediates). - - Using credentialBundlePath lets your Pod's application code make a single - atomic read that retrieves a consistent key and certificate chain. If you - project them to separate files, your application code will need to - additionally check that the leaf certificate was issued to the key. - type: string - keyPath: - description: |- - Write the key at this path in the projected volume. - - Most applications should use credentialBundlePath. When using keyPath - and certificateChainPath, your application needs to check that the key - and leaf certificate are consistent, because it is possible to read the - files mid-rotation. - type: string - keyType: - description: |- - The type of keypair Kubelet will generate for the pod. - - Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", - "ECDSAP521", and "ED25519". - type: string - maxExpirationSeconds: - description: |- - maxExpirationSeconds is the maximum lifetime permitted for the - certificate. - - Kubelet copies this value verbatim into the PodCertificateRequests it - generates for this projection. - - If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver - will reject values shorter than 3600 (1 hour). The maximum allowable - value is 7862400 (91 days). - - The signer implementation is then free to issue a certificate with any - lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 - seconds (1 hour). This constraint is enforced by kube-apiserver. - `kubernetes.io` signers will never issue certificates with a lifetime - longer than 24 hours. - format: int32 - type: integer - signerName: - description: Kubelet's generated CSRs will be addressed - to this signer. - type: string - required: - - keyType - - signerName - type: object secret: description: secret information about the secret data to project @@ -5596,15 +5309,6 @@ spec: This can only be set at creation time. By default set to `_cnpg_`. pattern: ^[0-9a-z_]*$ type: string - synchronizeLogicalDecoding: - description: |- - When enabled, the operator automatically manages synchronization of logical - decoding (replication) slots across high-availability clusters. - - Requires one of the following conditions: - - PostgreSQL version 17 or later - - PostgreSQL version < 17 with pg_failover_slots extension enabled - type: boolean type: object synchronizeReplicas: description: Configures the synchronization of the user defined @@ -5644,7 +5348,7 @@ spec: Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. - This field depends on the + This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers. @@ -5765,7 +5469,7 @@ spec: description: |- The time in seconds that controls the window of time reserved for the smart shutdown of Postgres to complete. Make sure you reserve enough time for the operator to request a fast shutdown of Postgres - (that is: `stopDelay` - `smartShutdownTimeout`). Default is 180 seconds. + (that is: `stopDelay` - `smartShutdownTimeout`). format: int32 type: integer startDelay: @@ -5965,13 +5669,15 @@ spec: volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. If specified, the CSI driver will create or update the volume with the attributes defined in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, - it can be changed after the claim is created. An empty string or nil value indicates that no - VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, - this field can be reset to its previous value (including nil) to cancel the modification. + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource exists. More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: description: |- @@ -6221,13 +5927,15 @@ spec: volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. If specified, the CSI driver will create or update the volume with the attributes defined in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, - it can be changed after the claim is created. An empty string or nil value indicates that no - VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, - this field can be reset to its previous value (including nil) to cancel the modification. + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource exists. More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: description: |- @@ -6396,6 +6104,7 @@ spec: - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- @@ -6406,6 +6115,7 @@ spec: - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: |- @@ -6629,13 +6339,15 @@ spec: volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. If specified, the CSI driver will create or update the volume with the attributes defined in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, - it can be changed after the claim is created. An empty string or nil value indicates that no - VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, - this field can be reset to its previous value (including nil) to cancel the modification. + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource exists. More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: description: |- @@ -6695,6 +6407,10 @@ spec: - hash type: object type: array + azurePVCUpdateEnabled: + description: AzurePVCUpdateEnabled shows if the PVC online upgrade + is enabled for this cluster + type: boolean certificates: description: The configuration for the CA and related certificates, initialized with defaults. @@ -6856,18 +6572,14 @@ spec: firstRecoverabilityPoint: description: |- The first recoverability point, stored as a date in RFC3339 format. - This field is calculated from the content of FirstRecoverabilityPointByMethod. - - Deprecated: the field is not set for backup plugins. + This field is calculated from the content of FirstRecoverabilityPointByMethod type: string firstRecoverabilityPointByMethod: additionalProperties: format: date-time type: string - description: |- - The first recoverability point, stored as a date in RFC3339 format, per backup method type. - - Deprecated: the field is not set for backup plugins. + description: The first recoverability point, stored as a date in RFC3339 + format, per backup method type type: object healthyPVC: description: List of all the PVCs not dangling nor initializing @@ -6897,9 +6609,6 @@ spec: description: InstanceReportedState describes the last reported state of an instance during a reconciliation loop properties: - ip: - description: IP address of the instance - type: string isPrimary: description: indicates if an instance is the primary one type: boolean @@ -6925,10 +6634,7 @@ spec: format: int32 type: integer lastFailedBackup: - description: |- - Last failed backup, stored as a date in RFC3339 format. - - Deprecated: the field is not set for backup plugins. + description: Stored as a date in RFC3339 format type: string lastPromotionToken: description: |- @@ -6937,19 +6643,15 @@ spec: type: string lastSuccessfulBackup: description: |- - Last successful backup, stored as a date in RFC3339 format. - This field is calculated from the content of LastSuccessfulBackupByMethod. - - Deprecated: the field is not set for backup plugins. + Last successful backup, stored as a date in RFC3339 format + This field is calculated from the content of LastSuccessfulBackupByMethod type: string lastSuccessfulBackupByMethod: additionalProperties: format: date-time type: string - description: |- - Last successful backup, stored as a date in RFC3339 format, per backup method type. - - Deprecated: the field is not set for backup plugins. + description: Last successful backup, stored as a date in RFC3339 format, + per backup method type type: object latestGeneratedNode: description: ID of the latest generated node (used to avoid node name @@ -6997,20 +6699,6 @@ spec: description: OnlineUpdateEnabled shows if the online upgrade is enabled inside the cluster type: boolean - pgDataImageInfo: - description: PGDataImageInfo contains the details of the latest image - that has run on the current data directory. - properties: - image: - description: Image is the image name - type: string - majorVersion: - description: MajorVersion is the major version of the image - type: integer - required: - - image - - majorVersion - type: object phase: description: Current phase of the cluster type: string @@ -7166,9 +6854,6 @@ spec: of switching a cluster to a replica cluster. type: boolean type: object - systemID: - description: SystemID is the latest detected PostgreSQL SystemID - type: string tablespacesStatus: description: TablespacesStatus reports the state of the declarative tablespaces in the cluster @@ -7258,7 +6943,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.16.5 helm.sh/resource-policy: keep name: databases.postgresql.cnpg.io spec: @@ -7380,43 +7065,6 @@ spec: - present - absent type: string - extensions: - description: The list of extensions to be managed in the database - items: - description: ExtensionSpec configures an extension in a database - properties: - ensure: - default: present - description: |- - Specifies whether an extension/schema should be present or absent in - the database. If set to `present`, the extension/schema will be - created if it does not exist. If set to `absent`, the - extension/schema will be removed if it exists. - enum: - - present - - absent - type: string - name: - description: Name of the extension/schema - type: string - schema: - description: |- - The name of the schema in which to install the extension's objects, - in case the extension allows its contents to be relocated. If not - specified (default), and the extension's control file does not - specify a schema either, the current default object creation schema - is used. - type: string - version: - description: |- - The version of the extension to install. If empty, the operator will - install the default version (whatever is specified in the - extension's control file) - type: string - required: - - name - type: object - type: array icuLocale: description: |- Maps to the `ICU_LOCALE` parameter of `CREATE DATABASE`. This @@ -7496,35 +7144,6 @@ spec: Maps to the `OWNER TO` command of `ALTER DATABASE`. The role name of the user who owns the database inside PostgreSQL. type: string - schemas: - description: The list of schemas to be managed in the database - items: - description: SchemaSpec configures a schema in a database - properties: - ensure: - default: present - description: |- - Specifies whether an extension/schema should be present or absent in - the database. If set to `present`, the extension/schema will be - created if it does not exist. If set to `absent`, the - extension/schema will be removed if it exists. - enum: - - present - - absent - type: string - name: - description: Name of the extension/schema - type: string - owner: - description: |- - The role name of the user who owns the schema inside PostgreSQL. - It maps to the `AUTHORIZATION` parameter of `CREATE SCHEMA` and the - `OWNER TO` command of `ALTER SCHEMA`. - type: string - required: - - name - type: object - type: array tablespace: description: |- Maps to the `TABLESPACE` parameter of `CREATE DATABASE`. @@ -7564,28 +7183,6 @@ spec: applied: description: Applied is true if the database was reconciled correctly type: boolean - extensions: - description: Extensions is the status of the managed extensions - items: - description: DatabaseObjectStatus is the status of the managed database - objects - properties: - applied: - description: |- - True of the object has been installed successfully in - the database - type: boolean - message: - description: Message is the object reconciliation message - type: string - name: - description: The name of the object - type: string - required: - - applied - - name - type: object - type: array message: description: Message is the reconciliation output message type: string @@ -7595,28 +7192,6 @@ spec: desired state that was synchronized format: int64 type: integer - schemas: - description: Schemas is the status of the managed schemas - items: - description: DatabaseObjectStatus is the status of the managed database - objects - properties: - applied: - description: |- - True of the object has been installed successfully in - the database - type: boolean - message: - description: Message is the object reconciliation message - type: string - name: - description: The name of the object - type: string - required: - - applied - - name - type: object - type: array type: object required: - metadata @@ -7631,85 +7206,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 - helm.sh/resource-policy: keep - name: failoverquorums.postgresql.cnpg.io -spec: - group: postgresql.cnpg.io - names: - kind: FailoverQuorum - listKind: FailoverQuorumList - plural: failoverquorums - singular: failoverquorum - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - FailoverQuorum contains the information about the current failover - quorum status of a PG cluster. It is updated by the instance manager - of the primary node and reset to zero by the operator to trigger - an update. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - status: - description: Most recently observed status of the failover quorum. - properties: - method: - description: Contains the latest reported Method value. - type: string - primary: - description: |- - Primary is the name of the primary instance that updated - this object the latest time. - type: string - standbyNames: - description: |- - StandbyNames is the list of potentially synchronous - instance names. - items: - type: string - type: array - standbyNumber: - description: |- - StandbyNumber is the number of synchronous standbys that transactions - need to wait for replies from. - type: integer - type: object - required: - - metadata - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.16.5 helm.sh/resource-policy: keep name: imagecatalogs.postgresql.cnpg.io spec: @@ -7790,7 +7287,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.16.5 helm.sh/resource-policy: keep name: poolers.postgresql.cnpg.io spec: @@ -7904,11 +7401,8 @@ spec: format: int32 type: integer monitoring: - description: |- - The configuration of the monitoring infrastructure of this pooler. - - Deprecated: This feature will be removed in an upcoming release. If - you need this functionality, you can create a PodMonitor manually. + description: The configuration of the monitoring infrastructure of + this pooler. properties: enablePodMonitor: default: false @@ -7927,7 +7421,7 @@ spec: action: default: replace description: |- - action to perform based on the regex matching. + Action to perform based on the regex matching. `Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0. `DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0. @@ -7959,41 +7453,41 @@ spec: type: string modulus: description: |- - modulus to take of the hash of the source label values. + Modulus to take of the hash of the source label values. Only applicable when the action is `HashMod`. format: int64 type: integer regex: - description: regex defines the regular expression against - which the extracted value is matched. + description: Regular expression against which the extracted + value is matched. type: string replacement: description: |- - replacement value against which a Replace action is performed if the + Replacement value against which a Replace action is performed if the regular expression matches. Regex capture groups are available. type: string separator: - description: separator defines the string between concatenated + description: Separator is the string between concatenated SourceLabels. type: string sourceLabels: description: |- - sourceLabels defines the source labels select values from existing labels. Their content is + The source labels select values from existing labels. Their content is concatenated using the configured Separator and matched against the configured regular expression. items: description: |- - LabelName is a valid Prometheus label name. - For Prometheus 3.x, a label name is valid if it contains UTF-8 characters. - For Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores. + LabelName is a valid Prometheus label name which may only contain ASCII + letters, numbers, as well as underscores. + pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ type: string type: array targetLabel: description: |- - targetLabel defines the label to which the resulting string is written in a replacement. + Label to which the resulting string is written in a replacement. It is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and `DropEqual` actions. @@ -8015,7 +7509,7 @@ spec: action: default: replace description: |- - action to perform based on the regex matching. + Action to perform based on the regex matching. `Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0. `DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0. @@ -8047,41 +7541,41 @@ spec: type: string modulus: description: |- - modulus to take of the hash of the source label values. + Modulus to take of the hash of the source label values. Only applicable when the action is `HashMod`. format: int64 type: integer regex: - description: regex defines the regular expression against - which the extracted value is matched. + description: Regular expression against which the extracted + value is matched. type: string replacement: description: |- - replacement value against which a Replace action is performed if the + Replacement value against which a Replace action is performed if the regular expression matches. Regex capture groups are available. type: string separator: - description: separator defines the string between concatenated + description: Separator is the string between concatenated SourceLabels. type: string sourceLabels: description: |- - sourceLabels defines the source labels select values from existing labels. Their content is + The source labels select values from existing labels. Their content is concatenated using the configured Separator and matched against the configured regular expression. items: description: |- - LabelName is a valid Prometheus label name. - For Prometheus 3.x, a label name is valid if it contains UTF-8 characters. - For Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores. + LabelName is a valid Prometheus label name which may only contain ASCII + letters, numbers, as well as underscores. + pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ type: string type: array targetLabel: description: |- - targetLabel defines the label to which the resulting string is written in a replacement. + Label to which the resulting string is written in a replacement. It is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and `DropEqual` actions. @@ -8492,12 +7986,13 @@ spec: type: object trafficDistribution: description: |- - TrafficDistribution offers a way to express preferences for how traffic - is distributed to Service endpoints. Implementations can use this field - as a hint, but are not required to guarantee strict adherence. If the - field is not set, the implementation will apply its default routing - strategy. If set to "PreferClose", implementations should prioritize - endpoints that are in the same zone. + TrafficDistribution offers a way to express preferences for how traffic is + distributed to Service endpoints. Implementations can use this field as a + hint, but are not required to guarantee strict adherence. If the field is + not set, the implementation will apply its default routing strategy. If set + to "PreferClose", implementations should prioritize endpoints that are + topologically close (e.g., same zone). + This is a beta field and requires enabling ServiceTrafficDistribution feature. type: string type: description: |- @@ -8851,6 +8346,7 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -8865,6 +8361,7 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -9032,6 +8529,7 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -9046,6 +8544,7 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -9139,8 +8638,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm @@ -9211,6 +8710,7 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -9225,6 +8725,7 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -9392,6 +8893,7 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -9406,6 +8908,7 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -9538,9 +9041,8 @@ spec: present in a Container. properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. + Must be a C_IDENTIFIER. type: string value: description: |- @@ -9599,43 +9101,6 @@ spec: - fieldPath type: object x-kubernetes-map-type: atomic - fileKeyRef: - description: |- - FileKeyRef selects a key of the env file. - Requires the EnvFiles feature gate to be enabled. - properties: - key: - description: |- - The key within the env file. An invalid key will prevent the pod from starting. - The keys defined within a source may consist of any printable ASCII characters except '='. - During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. - type: string - optional: - default: false - description: |- - Specify whether the file or its key must be defined. If the file or key - does not exist, then the env var is not published. - If optional is set to true and the specified key does not exist, - the environment variable will not be set in the Pod's containers. - - If optional is set to false and the specified key does not exist, - an error will be returned during Pod creation. - type: boolean - path: - description: |- - The path within the volume from which to select the file. - Must be relative and may not contain the '..' path or start with '..'. - type: string - volumeName: - description: The name of the volume mount - containing the env file. - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests @@ -9698,14 +9163,14 @@ spec: envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. items: description: EnvFromSource represents the source of - a set of ConfigMaps or Secrets + a set of ConfigMaps properties: configMapRef: description: The ConfigMap to select from @@ -9726,9 +9191,8 @@ spec: type: object x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend + to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -9994,12 +9458,6 @@ spec: - port type: object type: object - stopSignal: - description: |- - StopSignal defines which signal will be sent to a container when it is being stopped. - If not specified, the default is defined by the container runtime in use. - StopSignal can only be set for Pods with a non-empty .spec.os.name - type: string type: object livenessProbe: description: |- @@ -10407,7 +9865,7 @@ spec: Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. - This field depends on the + This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers. @@ -10462,10 +9920,10 @@ spec: restartPolicy: description: |- RestartPolicy defines the restart behavior of individual containers in a pod. - This overrides the pod-level restart policy. When this field is not specified, + This field may only be set for init containers, and the only allowed value is "Always". + For non-init containers or when this field is not specified, the restart behavior is defined by the Pod's restart policy and the container type. - Additionally, setting the RestartPolicy as "Always" for the init container will - have the following effect: + Setting the RestartPolicy as "Always" for the init container will have the following effect: this init container will be continually restarted on exit until all regular containers have terminated. Once all regular containers have completed, all init containers with restartPolicy "Always" @@ -10477,59 +9935,6 @@ spec: init container is started, or after any startupProbe has successfully completed. type: string - restartPolicyRules: - description: |- - Represents a list of rules to be checked to determine if the - container should be restarted on exit. The rules are evaluated in - order. Once a rule matches a container exit condition, the remaining - rules are ignored. If no rule matches the container exit condition, - the Container-level restart policy determines the whether the container - is restarted or not. Constraints on the rules: - - At most 20 rules are allowed. - - Rules can have the same action. - - Identical rules are not forbidden in validations. - When rules are specified, container MUST set RestartPolicy explicitly - even it if matches the Pod's RestartPolicy. - items: - description: ContainerRestartRule describes how a - container exit is handled. - properties: - action: - description: |- - Specifies the action taken on a container exit if the requirements - are satisfied. The only possible value is "Restart" to restart the - container. - type: string - exitCodes: - description: Represents the exit codes to check - on container exits. - properties: - operator: - description: |- - Represents the relationship between the container exit code(s) and the - specified values. Possible values are: - - In: the requirement is satisfied if the container exit code is in the - set of specified values. - - NotIn: the requirement is satisfied if the container exit code is - not in the set of specified values. - type: string - values: - description: |- - Specifies the set of values to check for container exit codes. - At most 255 elements are allowed. - items: - format: int32 - type: integer - type: array - x-kubernetes-list-type: set - required: - - operator - type: object - required: - - action - type: object - type: array - x-kubernetes-list-type: atomic securityContext: description: |- SecurityContext defines the security options the container should be run with. @@ -11150,9 +10555,8 @@ spec: present in a Container. properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. + Must be a C_IDENTIFIER. type: string value: description: |- @@ -11211,43 +10615,6 @@ spec: - fieldPath type: object x-kubernetes-map-type: atomic - fileKeyRef: - description: |- - FileKeyRef selects a key of the env file. - Requires the EnvFiles feature gate to be enabled. - properties: - key: - description: |- - The key within the env file. An invalid key will prevent the pod from starting. - The keys defined within a source may consist of any printable ASCII characters except '='. - During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. - type: string - optional: - default: false - description: |- - Specify whether the file or its key must be defined. If the file or key - does not exist, then the env var is not published. - If optional is set to true and the specified key does not exist, - the environment variable will not be set in the Pod's containers. - - If optional is set to false and the specified key does not exist, - an error will be returned during Pod creation. - type: boolean - path: - description: |- - The path within the volume from which to select the file. - Must be relative and may not contain the '..' path or start with '..'. - type: string - volumeName: - description: The name of the volume mount - containing the env file. - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests @@ -11310,14 +10677,14 @@ spec: envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. items: description: EnvFromSource represents the source of - a set of ConfigMaps or Secrets + a set of ConfigMaps properties: configMapRef: description: The ConfigMap to select from @@ -11338,9 +10705,8 @@ spec: type: object x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend + to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -11603,12 +10969,6 @@ spec: - port type: object type: object - stopSignal: - description: |- - StopSignal defines which signal will be sent to a container when it is being stopped. - If not specified, the default is defined by the container runtime in use. - StopSignal can only be set for Pods with a non-empty .spec.os.name - type: string type: object livenessProbe: description: Probes are not allowed for ephemeral containers. @@ -11999,7 +11359,7 @@ spec: Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. - This field depends on the + This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers. @@ -12055,53 +11415,9 @@ spec: description: |- Restart policy for the container to manage the restart behavior of each container within a pod. - You cannot set this field on ephemeral containers. - type: string - restartPolicyRules: - description: |- - Represents a list of rules to be checked to determine if the - container should be restarted on exit. You cannot set this field on + This may only be set for init containers. You cannot set this field on ephemeral containers. - items: - description: ContainerRestartRule describes how a - container exit is handled. - properties: - action: - description: |- - Specifies the action taken on a container exit if the requirements - are satisfied. The only possible value is "Restart" to restart the - container. - type: string - exitCodes: - description: Represents the exit codes to check - on container exits. - properties: - operator: - description: |- - Represents the relationship between the container exit code(s) and the - specified values. Possible values are: - - In: the requirement is satisfied if the container exit code is in the - set of specified values. - - NotIn: the requirement is satisfied if the container exit code is - not in the set of specified values. - type: string - values: - description: |- - Specifies the set of values to check for container exit codes. - At most 255 elements are allowed. - items: - format: int32 - type: integer - type: array - x-kubernetes-list-type: set - required: - - operator - type: object - required: - - action - type: object - type: array - x-kubernetes-list-type: atomic + type: string securityContext: description: |- Optional: SecurityContext defines the security options the ephemeral container should be run with. @@ -12640,9 +11956,7 @@ spec: hostNetwork: description: |- Host networking requested for this pod. Use the host's network namespace. - When using HostNetwork you should specify ports so the scheduler is aware. - When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`, - and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`. + If this option is set, the ports that will be used must be specified. Default to false. type: boolean hostPID: @@ -12667,19 +11981,6 @@ spec: Specifies the hostname of the Pod If not specified, the pod's hostname will be set to a system-defined value. type: string - hostnameOverride: - description: |- - HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod. - This field only specifies the pod's hostname and does not affect its DNS records. - When this field is set to a non-empty string: - - It takes precedence over the values set in `hostname` and `subdomain`. - - The Pod's hostname will be set to this value. - - `setHostnameAsFQDN` must be nil or set to false. - - `hostNetwork` must be set to false. - - This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters. - Requires the HostnameOverride feature gate to be enabled. - type: string imagePullSecrets: description: |- ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. @@ -12715,7 +12016,7 @@ spec: Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. The resourceRequirements of an init container are taken into account during scheduling by finding the highest request/limit for each resource type, and then using the max of - that value or the sum of the normal containers. Limits are applied to init containers + of that value or the sum of the normal containers. Limits are applied to init containers in a similar fashion. Init containers cannot currently be added or removed. Cannot be updated. @@ -12761,9 +12062,8 @@ spec: present in a Container. properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. + Must be a C_IDENTIFIER. type: string value: description: |- @@ -12822,43 +12122,6 @@ spec: - fieldPath type: object x-kubernetes-map-type: atomic - fileKeyRef: - description: |- - FileKeyRef selects a key of the env file. - Requires the EnvFiles feature gate to be enabled. - properties: - key: - description: |- - The key within the env file. An invalid key will prevent the pod from starting. - The keys defined within a source may consist of any printable ASCII characters except '='. - During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. - type: string - optional: - default: false - description: |- - Specify whether the file or its key must be defined. If the file or key - does not exist, then the env var is not published. - If optional is set to true and the specified key does not exist, - the environment variable will not be set in the Pod's containers. - - If optional is set to false and the specified key does not exist, - an error will be returned during Pod creation. - type: boolean - path: - description: |- - The path within the volume from which to select the file. - Must be relative and may not contain the '..' path or start with '..'. - type: string - volumeName: - description: The name of the volume mount - containing the env file. - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests @@ -12921,14 +12184,14 @@ spec: envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. items: description: EnvFromSource represents the source of - a set of ConfigMaps or Secrets + a set of ConfigMaps properties: configMapRef: description: The ConfigMap to select from @@ -12949,9 +12212,8 @@ spec: type: object x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend + to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -13217,12 +12479,6 @@ spec: - port type: object type: object - stopSignal: - description: |- - StopSignal defines which signal will be sent to a container when it is being stopped. - If not specified, the default is defined by the container runtime in use. - StopSignal can only be set for Pods with a non-empty .spec.os.name - type: string type: object livenessProbe: description: |- @@ -13630,7 +12886,7 @@ spec: Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. - This field depends on the + This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers. @@ -13685,10 +12941,10 @@ spec: restartPolicy: description: |- RestartPolicy defines the restart behavior of individual containers in a pod. - This overrides the pod-level restart policy. When this field is not specified, + This field may only be set for init containers, and the only allowed value is "Always". + For non-init containers or when this field is not specified, the restart behavior is defined by the Pod's restart policy and the container type. - Additionally, setting the RestartPolicy as "Always" for the init container will - have the following effect: + Setting the RestartPolicy as "Always" for the init container will have the following effect: this init container will be continually restarted on exit until all regular containers have terminated. Once all regular containers have completed, all init containers with restartPolicy "Always" @@ -13700,59 +12956,6 @@ spec: init container is started, or after any startupProbe has successfully completed. type: string - restartPolicyRules: - description: |- - Represents a list of rules to be checked to determine if the - container should be restarted on exit. The rules are evaluated in - order. Once a rule matches a container exit condition, the remaining - rules are ignored. If no rule matches the container exit condition, - the Container-level restart policy determines the whether the container - is restarted or not. Constraints on the rules: - - At most 20 rules are allowed. - - Rules can have the same action. - - Identical rules are not forbidden in validations. - When rules are specified, container MUST set RestartPolicy explicitly - even it if matches the Pod's RestartPolicy. - items: - description: ContainerRestartRule describes how a - container exit is handled. - properties: - action: - description: |- - Specifies the action taken on a container exit if the requirements - are satisfied. The only possible value is "Restart" to restart the - container. - type: string - exitCodes: - description: Represents the exit codes to check - on container exits. - properties: - operator: - description: |- - Represents the relationship between the container exit code(s) and the - specified values. Possible values are: - - In: the requirement is satisfied if the container exit code is in the - set of specified values. - - NotIn: the requirement is satisfied if the container exit code is - not in the set of specified values. - type: string - values: - description: |- - Specifies the set of values to check for container exit codes. - At most 255 elements are allowed. - items: - format: int32 - type: integer - type: array - x-kubernetes-list-type: set - required: - - operator - type: object - required: - - action - type: object - type: array - x-kubernetes-list-type: atomic securityContext: description: |- SecurityContext defines the security options the container should be run with. @@ -14286,7 +13489,6 @@ spec: - spec.hostPID - spec.hostIPC - spec.hostUsers - - spec.resources - spec.securityContext.appArmorProfile - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile @@ -14440,7 +13642,7 @@ spec: description: |- Resources is the total amount of CPU and Memory resources required by all containers in the pod. It supports specifying Requests and Limits for - "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported. + "cpu" and "memory" resource names only. ResourceClaims are not supported. This field enables fine-grained control over resource allocation for the entire pod, allowing resource sharing among containers in a pod. @@ -14453,7 +13655,7 @@ spec: Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. - This field depends on the + This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers. @@ -14991,6 +14193,7 @@ spec: - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- @@ -15001,6 +14204,7 @@ spec: - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: |- @@ -15730,13 +14934,15 @@ spec: volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. If specified, the CSI driver will create or update the volume with the attributes defined in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, - it can be changed after the claim is created. An empty string or nil value indicates that no - VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, - this field can be reset to its previous value (including nil) to cancel the modification. + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource exists. More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: description: |- @@ -15918,10 +15124,12 @@ spec: description: |- glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported. + More info: https://examples.k8s.io/volumes/glusterfs/README.md properties: endpoints: - description: endpoints is the endpoint name that - details Glusterfs topology. + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod type: string path: description: |- @@ -15975,7 +15183,7 @@ spec: The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field. The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images. The volume will be mounted read-only (ro) and non-executable files (noexec). - Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33. + Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath). The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type. properties: pullPolicy: @@ -16000,7 +15208,7 @@ spec: description: |- iscsi represents an ISCSI Disk resource that is attached to a kubelet's host machine and then exposed to the pod. - More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi + More info: https://examples.k8s.io/volumes/iscsi/README.md properties: chapAuthDiscovery: description: chapAuthDiscovery defines whether support @@ -16426,111 +15634,6 @@ spec: type: array x-kubernetes-list-type: atomic type: object - podCertificate: - description: |- - Projects an auto-rotating credential bundle (private key and certificate - chain) that the pod can use either as a TLS client or server. - - Kubelet generates a private key and uses it to send a - PodCertificateRequest to the named signer. Once the signer approves the - request and issues a certificate chain, Kubelet writes the key and - certificate chain to the pod filesystem. The pod does not start until - certificates have been issued for each podCertificate projected volume - source in its spec. - - Kubelet will begin trying to rotate the certificate at the time indicated - by the signer using the PodCertificateRequest.Status.BeginRefreshAt - timestamp. - - Kubelet can write a single file, indicated by the credentialBundlePath - field, or separate files, indicated by the keyPath and - certificateChainPath fields. - - The credential bundle is a single file in PEM format. The first PEM - entry is the private key (in PKCS#8 format), and the remaining PEM - entries are the certificate chain issued by the signer (typically, - signers will return their certificate chain in leaf-to-root order). - - Prefer using the credential bundle format, since your application code - can read it atomically. If you use keyPath and certificateChainPath, - your application must make two separate file reads. If these coincide - with a certificate rotation, it is possible that the private key and leaf - certificate you read may not correspond to each other. Your application - will need to check for this condition, and re-read until they are - consistent. - - The named signer controls chooses the format of the certificate it - issues; consult the signer implementation's documentation to learn how to - use the certificates it issues. - properties: - certificateChainPath: - description: |- - Write the certificate chain at this path in the projected volume. - - Most applications should use credentialBundlePath. When using keyPath - and certificateChainPath, your application needs to check that the key - and leaf certificate are consistent, because it is possible to read the - files mid-rotation. - type: string - credentialBundlePath: - description: |- - Write the credential bundle at this path in the projected volume. - - The credential bundle is a single file that contains multiple PEM blocks. - The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private - key. - - The remaining blocks are CERTIFICATE blocks, containing the issued - certificate chain from the signer (leaf and any intermediates). - - Using credentialBundlePath lets your Pod's application code make a single - atomic read that retrieves a consistent key and certificate chain. If you - project them to separate files, your application code will need to - additionally check that the leaf certificate was issued to the key. - type: string - keyPath: - description: |- - Write the key at this path in the projected volume. - - Most applications should use credentialBundlePath. When using keyPath - and certificateChainPath, your application needs to check that the key - and leaf certificate are consistent, because it is possible to read the - files mid-rotation. - type: string - keyType: - description: |- - The type of keypair Kubelet will generate for the pod. - - Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", - "ECDSAP521", and "ED25519". - type: string - maxExpirationSeconds: - description: |- - maxExpirationSeconds is the maximum lifetime permitted for the - certificate. - - Kubelet copies this value verbatim into the PodCertificateRequests it - generates for this projection. - - If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver - will reject values shorter than 3600 (1 hour). The maximum allowable - value is 7862400 (91 days). - - The signer implementation is then free to issue a certificate with any - lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 - seconds (1 hour). This constraint is enforced by kube-apiserver. - `kubernetes.io` signers will never issue certificates with a lifetime - longer than 24 hours. - format: int32 - type: integer - signerName: - description: Kubelet's generated CSRs - will be addressed to this signer. - type: string - required: - - keyType - - signerName - type: object secret: description: secret information about the secret data to project @@ -16665,6 +15768,7 @@ spec: description: |- rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported. + More info: https://examples.k8s.io/volumes/rbd/README.md properties: fsType: description: |- @@ -16962,7 +16066,6 @@ spec: enum: - rw - ro - - r type: string required: - cluster @@ -17043,7 +16146,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.16.5 helm.sh/resource-policy: keep name: publications.postgresql.cnpg.io spec: @@ -17239,7 +16342,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.16.5 helm.sh/resource-policy: keep name: scheduledbackups.postgresql.cnpg.io spec: @@ -17431,7 +16534,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.16.5 helm.sh/resource-policy: keep name: subscriptions.postgresql.cnpg.io spec: @@ -17522,11 +16625,8 @@ spec: additionalProperties: type: string description: |- - Subscription parameters included in the `WITH` clause of the PostgreSQL - `CREATE SUBSCRIPTION` command. Most parameters cannot be changed - after the subscription is created and will be ignored if modified - later, except for a limited set documented at: - https://www.postgresql.org/docs/current/sql-altersubscription.html#SQL-ALTERSUBSCRIPTION-PARAMS-SET + Subscription parameters part of the `WITH` clause as expected by + PostgreSQL `CREATE SUBSCRIPTION` command type: object publicationDBName: description: |- diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml index 760b3768..7e0bce72 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml +++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/deployment.yaml @@ -1,6 +1,5 @@ # -# Copyright © contributors to CloudNativePG, established as -# CloudNativePG a Series of LF Projects, LLC. +# Copyright The CloudNativePG Contributors # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,8 +13,6 @@ # See the License for the specific language governing permissions and # limitations under the License. # -# SPDX-License-Identifier: Apache-2.0 -# --- apiVersion: apps/v1 kind: Deployment @@ -33,10 +30,6 @@ spec: selector: matchLabels: {{- include "cloudnative-pg.selectorLabels" . | nindent 6 }} - {{- if .Values.updateStrategy }} - strategy: - {{- toYaml .Values.updateStrategy | nindent 4 }} - {{- end }} template: metadata: annotations: @@ -91,7 +84,7 @@ spec: value: "{{ .Values.monitoringQueriesConfigMap.name }}" {{- if not .Values.config.clusterWide }} - name: WATCH_NAMESPACE - value: "{{ include "cloudnative-pg.namespace" . }}" + value: "{{ .Release.Namespace }}" {{- end }} {{- if .Values.additionalEnv }} {{- tpl (.Values.additionalEnv | toYaml) . | nindent 8 }} @@ -126,17 +119,6 @@ spec: {{- toYaml .Values.resources | nindent 10 }} securityContext: {{- toYaml .Values.containerSecurityContext | nindent 10 }} - startupProbe: - {{- if .Values.webhook.startupProbe.failureThreshold }} - failureThreshold: {{ .Values.webhook.startupProbe.failureThreshold }} - {{- end }} - httpGet: - path: /readyz - port: {{ .Values.webhook.port }} - scheme: HTTPS - {{- if .Values.webhook.startupProbe.periodSeconds }} - periodSeconds: {{ .Values.webhook.startupProbe.periodSeconds }} - {{- end }} volumeMounts: - mountPath: /controller name: scratch-data @@ -153,10 +135,6 @@ spec: nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- toYaml . | nindent 8 }} - {{- end }} {{- with .Values.affinity }} affinity: {{- toYaml . | nindent 8 }} @@ -173,3 +151,5 @@ spec: defaultMode: 420 optional: true secretName: cnpg-webhook-cert + + diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/monitoring-configmap.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/monitoring-configmap.yaml index d47bc744..aa5937d5 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/monitoring-configmap.yaml +++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/monitoring-configmap.yaml @@ -1,6 +1,5 @@ # -# Copyright © contributors to CloudNativePG, established as -# CloudNativePG a Series of LF Projects, LLC. +# Copyright The CloudNativePG Contributors # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,8 +13,6 @@ # See the License for the specific language governing permissions and # limitations under the License. # -# SPDX-License-Identifier: Apache-2.0 -# --- apiVersion: v1 kind: ConfigMap diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/mutatingwebhookconfiguration.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/mutatingwebhookconfiguration.yaml index c58628a6..200695b1 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/mutatingwebhookconfiguration.yaml +++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/mutatingwebhookconfiguration.yaml @@ -1,6 +1,5 @@ # -# Copyright © contributors to CloudNativePG, established as -# CloudNativePG a Series of LF Projects, LLC. +# Copyright The CloudNativePG Contributors # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,8 +13,6 @@ # See the License for the specific language governing permissions and # limitations under the License. # -# SPDX-License-Identifier: Apache-2.0 -# {{- if .Values.webhook.mutating.create }} --- apiVersion: admissionregistration.k8s.io/v1 @@ -34,7 +31,7 @@ webhooks: clientConfig: service: name: {{ .Values.service.name }} - namespace: {{ include "cloudnative-pg.namespace" . }} + namespace: {{ .Release.Namespace }} path: /mutate-postgresql-cnpg-io-v1-backup port: {{ .Values.service.port }} failurePolicy: {{ .Values.webhook.mutating.failurePolicy }} @@ -55,7 +52,7 @@ webhooks: clientConfig: service: name: {{ .Values.service.name }} - namespace: {{ include "cloudnative-pg.namespace" . }} + namespace: {{ .Release.Namespace }} path: /mutate-postgresql-cnpg-io-v1-cluster port: {{ .Values.service.port }} failurePolicy: {{ .Values.webhook.mutating.failurePolicy }} @@ -76,28 +73,7 @@ webhooks: clientConfig: service: name: {{ .Values.service.name }} - namespace: {{ include "cloudnative-pg.namespace" . }} - path: /mutate-postgresql-cnpg-io-v1-database - port: {{ .Values.service.port }} - failurePolicy: {{ .Values.webhook.mutating.failurePolicy }} - name: mdatabase.cnpg.io - rules: - - apiGroups: - - postgresql.cnpg.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - databases - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: {{ .Values.service.name }} - namespace: {{ include "cloudnative-pg.namespace" . }} + namespace: {{ .Release.Namespace }} path: /mutate-postgresql-cnpg-io-v1-scheduledbackup port: {{ .Values.service.port }} failurePolicy: {{ .Values.webhook.mutating.failurePolicy }} diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/podmonitor.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/podmonitor.yaml index 0d22102b..8984c00f 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/podmonitor.yaml +++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/podmonitor.yaml @@ -1,6 +1,5 @@ # -# Copyright © contributors to CloudNativePG, established as -# CloudNativePG a Series of LF Projects, LLC. +# Copyright The CloudNativePG Contributors # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,8 +13,6 @@ # See the License for the specific language governing permissions and # limitations under the License. # -# SPDX-License-Identifier: Apache-2.0 -# {{- if .Values.monitoring.podMonitorEnabled }} apiVersion: monitoring.coreos.com/v1 kind: PodMonitor diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/rbac.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/rbac.yaml index 0dc17080..cf213f35 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/rbac.yaml +++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/rbac.yaml @@ -1,6 +1,5 @@ # -# Copyright © contributors to CloudNativePG, established as -# CloudNativePG a Series of LF Projects, LLC. +# Copyright The CloudNativePG Contributors # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,8 +13,6 @@ # See the License for the specific language governing permissions and # limitations under the License. # -# SPDX-License-Identifier: Apache-2.0 -# {{- if .Values.serviceAccount.create }} --- apiVersion: v1 @@ -70,7 +67,7 @@ roleRef: subjects: - kind: ServiceAccount name: {{ include "cloudnative-pg.serviceAccountName" . }} - namespace: {{ include "cloudnative-pg.namespace" . }} + namespace: {{ .Release.Namespace }} {{/* If we're doing a single-namespace installation we create a Role with the common rules for the operator, @@ -111,7 +108,7 @@ roleRef: subjects: - kind: ServiceAccount name: {{ include "cloudnative-pg.serviceAccountName" . }} - namespace: {{ include "cloudnative-pg.namespace" . }} + namespace: {{ .Release.Namespace }} {{- end }} --- apiVersion: rbac.authorization.k8s.io/v1 @@ -131,14 +128,10 @@ rules: resources: - backups - clusters - - clusters/status - databases - - failoverquorums - poolers - publications - scheduledbackups - - imagecatalogs - - clusterimagecatalogs - subscriptions verbs: - get @@ -161,14 +154,10 @@ rules: resources: - backups - clusters - - clusters/status - databases - - failoverquorums - poolers - publications - scheduledbackups - - imagecatalogs - - clusterimagecatalogs - subscriptions verbs: - create diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/service.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/service.yaml index 8afa02fc..13be46ae 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/service.yaml +++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/service.yaml @@ -1,6 +1,5 @@ # -# Copyright © contributors to CloudNativePG, established as -# CloudNativePG a Series of LF Projects, LLC. +# Copyright The CloudNativePG Contributors # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,8 +13,6 @@ # See the License for the specific language governing permissions and # limitations under the License. # -# SPDX-License-Identifier: Apache-2.0 -# --- apiVersion: v1 kind: Service diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/templates/validatingwebhookconfiguration.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/templates/validatingwebhookconfiguration.yaml index c171c911..be9fff18 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/templates/validatingwebhookconfiguration.yaml +++ b/packages/system/postgres-operator/charts/cloudnative-pg/templates/validatingwebhookconfiguration.yaml @@ -1,6 +1,5 @@ # -# Copyright © contributors to CloudNativePG, established as -# CloudNativePG a Series of LF Projects, LLC. +# Copyright The CloudNativePG Contributors # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,8 +13,6 @@ # See the License for the specific language governing permissions and # limitations under the License. # -# SPDX-License-Identifier: Apache-2.0 -# {{- if .Values.webhook.validating.create }} --- apiVersion: admissionregistration.k8s.io/v1 @@ -34,7 +31,7 @@ webhooks: clientConfig: service: name: {{ .Values.service.name }} - namespace: {{ include "cloudnative-pg.namespace" . }} + namespace: {{ .Release.Namespace }} path: /validate-postgresql-cnpg-io-v1-backup port: {{ .Values.service.port }} failurePolicy: {{ .Values.webhook.validating.failurePolicy }} @@ -55,7 +52,7 @@ webhooks: clientConfig: service: name: {{ .Values.service.name }} - namespace: {{ include "cloudnative-pg.namespace" . }} + namespace: {{ .Release.Namespace }} path: /validate-postgresql-cnpg-io-v1-cluster port: {{ .Values.service.port }} failurePolicy: {{ .Values.webhook.validating.failurePolicy }} @@ -76,7 +73,7 @@ webhooks: clientConfig: service: name: {{ .Values.service.name }} - namespace: {{ include "cloudnative-pg.namespace" . }} + namespace: {{ .Release.Namespace }} path: /validate-postgresql-cnpg-io-v1-scheduledbackup port: {{ .Values.service.port }} failurePolicy: {{ .Values.webhook.validating.failurePolicy }} @@ -92,33 +89,12 @@ webhooks: resources: - scheduledbackups sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: {{ .Values.service.name }} - namespace: {{ include "cloudnative-pg.namespace" . }} - path: /validate-postgresql-cnpg-io-v1-database - port: {{ .Values.service.port }} - failurePolicy: {{ .Values.webhook.validating.failurePolicy }} - name: vdatabase.cnpg.io - rules: - - apiGroups: - - postgresql.cnpg.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - databases - sideEffects: None - admissionReviewVersions: - v1 clientConfig: service: name: {{ .Values.service.name }} - namespace: {{ include "cloudnative-pg.namespace" . }} + namespace: {{ .Release.Namespace }} path: /validate-postgresql-cnpg-io-v1-pooler port: {{ .Values.service.port }} failurePolicy: {{ .Values.webhook.validating.failurePolicy }} diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/values.schema.json b/packages/system/postgres-operator/charts/cloudnative-pg/values.schema.json index 4c69aae6..4ba70818 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/values.schema.json +++ b/packages/system/postgres-operator/charts/cloudnative-pg/values.schema.json @@ -246,12 +246,6 @@ "tolerations": { "type": "array" }, - "topologySpreadConstraints": { - "type": "array" - }, - "updateStrategy": { - "type": "object" - }, "webhook": { "type": "object", "properties": { @@ -285,17 +279,6 @@ } } }, - "startupProbe": { - "type": "object", - "properties": { - "failureThreshold": { - "type": "integer" - }, - "periodSeconds": { - "type": "integer" - } - } - }, "validating": { "type": "object", "properties": { diff --git a/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml b/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml index cbba7505..cdfb4cf8 100644 --- a/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml +++ b/packages/system/postgres-operator/charts/cloudnative-pg/values.yaml @@ -1,6 +1,5 @@ # -# Copyright © contributors to CloudNativePG, established as -# CloudNativePG a Series of LF Projects, LLC. +# Copyright The CloudNativePG Contributors # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,8 +13,6 @@ # See the License for the specific language governing permissions and # limitations under the License. # -# SPDX-License-Identifier: Apache-2.0 -# # Default values for CloudNativePG. # This is a YAML-formatted file. # Please declare variables to be passed to your templates. @@ -36,15 +33,6 @@ namespaceOverride: "" hostNetwork: false dnsPolicy: "" -# -- Update strategy for the operator. -# ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy -# For example: -# type: RollingUpdate -# rollingUpdate: -# maxSurge: 25% -# maxUnavailable: 25% -updateStrategy: {} - crds: # -- Specifies whether the CRDs should be created when installing the chart. create: true @@ -62,9 +50,6 @@ webhook: initialDelaySeconds: 3 readinessProbe: initialDelaySeconds: 3 - startupProbe: - failureThreshold: 6 - periodSeconds: 5 # Operator configuration. config: @@ -88,7 +73,7 @@ config: # -- The maximum number of concurrent reconciles. Defaults to 10. maxConcurrentReconciles: 10 -# -- Additional arguments to be added to the operator's args list. +# -- Additinal arguments to be added to the operator's args list. additionalArgs: [] # -- Array containing extra environment variables which can be templated. @@ -167,9 +152,6 @@ resources: {} # -- Nodeselector for the operator to be installed. nodeSelector: {} -# -- Topology Spread Constraints for the operator to be installed. -topologySpreadConstraints: [] - # -- Tolerations for the operator to be installed. tolerations: [] @@ -655,35 +637,3 @@ monitoringQueriesConfigMap: - setting: usage: "GAUGE" description: "Setting value" - - pg_extensions: - query: | - SELECT - current_database() as datname, - name as extname, - default_version, - installed_version, - CASE - WHEN default_version = installed_version THEN 0 - ELSE 1 - END AS update_available - FROM pg_catalog.pg_available_extensions - WHERE installed_version IS NOT NULL - metrics: - - datname: - usage: "LABEL" - description: "Name of the database" - - extname: - usage: "LABEL" - description: "Extension name" - - default_version: - usage: "LABEL" - description: "Default version" - - installed_version: - usage: "LABEL" - description: "Installed version" - - update_available: - usage: "GAUGE" - description: "An update is available" - target_databases: - - '*' diff --git a/packages/system/postgres-operator/templates/webhook-ready-hook.yaml b/packages/system/postgres-operator/templates/webhook-ready-hook.yaml deleted file mode 100644 index 51a8ba81..00000000 --- a/packages/system/postgres-operator/templates/webhook-ready-hook.yaml +++ /dev/null @@ -1,148 +0,0 @@ -{{- /* - Post-install gate: block the HelmRelease from reporting Ready until the - cnpg admission webhook actually serves through the cluster Service. Helm - --wait on the controller pod passes once its readinessProbe passes, but - EndpointSlice propagation and kube-proxy/cilium data-plane programming - can lag by a second or two — long enough for any HelmRelease that - depends on postgres-operator (e.g. cozy-keycloak, tenant Postgres apps) - to fire its own install and have kube-apiserver hit the mcluster.cnpg.io - mutating webhook with "dial tcp :443: connect: connection refused". - - The Job uses the apiserver service proxy, which exercises the same - endpoint-resolution and apiserver-initiated pod dial that the admission - webhook path uses. Once /readyz answers through the proxy the data-plane - race is resolved. It does not verify the webhook's TLS CA bundle, so - this gate is scoped to reachability regressions, not cert rotation. - - The service name and port name are hardcoded literals. Upstream cnpg - pins the service name in charts/cloudnative-pg/values.yaml with a - comment "DO NOT CHANGE THE SERVICE NAME as it is currently used to - generate the certificate and can not be configured". The port name is - fixed in charts/cloudnative-pg/templates/service.yaml (ports[0].name: - webhook-server). If a future `make update` ever changes either literal - upstream, the sync-check helm-unittest test - (tests/webhook-ready-hook_test.yaml) renders the subchart Service and - fails if the literal drifts — forcing this template to be updated in - the same change. -*/}} -{{- $_ := required "webhookReady.image.repository must be set to the container image providing kubectl for the post-install readiness Job" .Values.webhookReady.image.repository -}} -{{- $_ := required "webhookReady.image.tag must be set for the post-install readiness Job" .Values.webhookReady.image.tag -}} -{{- /* $svcName and $portName are hardcoded literals; see header comment. */ -}} -{{- $svcName := "cnpg-webhook-service" -}} -{{- /* $portName is the service port NAME, not number — matches ports[0].name in the vendored subchart's Service. */ -}} -{{- $portName := "webhook-server" -}} -{{- $resourceName := printf "https:%s:%s" $svcName $portName -}} -{{- $maxAttempts := .Values.webhookReady.maxAttempts | default 60 -}} -{{- $sleepSeconds := .Values.webhookReady.sleepSeconds | default 2 -}} -{{- /* Derive activeDeadlineSeconds from retries + 60s slack so a values override that raises maxAttempts doesn't get silently cut. */ -}} -{{- $deadline := add (mul (int $maxAttempts) (int $sleepSeconds)) 60 -}} -{{- $image := printf "%s:%s" .Values.webhookReady.image.repository .Values.webhookReady.image.tag -}} -{{- if .Values.webhookReady.image.digest }} -{{- $image = printf "%s@%s" $image .Values.webhookReady.image.digest -}} -{{- end }} ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ .Release.Name }}-webhook-ready - namespace: {{ .Release.Namespace }} - annotations: - helm.sh/hook: post-install,post-upgrade - helm.sh/hook-weight: "0" - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ .Release.Name }}-webhook-ready - namespace: {{ .Release.Namespace }} - annotations: - helm.sh/hook: post-install,post-upgrade - helm.sh/hook-weight: "0" - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded -rules: - - apiGroups: [""] - resources: ["services/proxy"] - resourceNames: [{{ $resourceName | quote }}] - verbs: ["get"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ .Release.Name }}-webhook-ready - namespace: {{ .Release.Namespace }} - annotations: - helm.sh/hook: post-install,post-upgrade - helm.sh/hook-weight: "0" - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ .Release.Name }}-webhook-ready -subjects: - - kind: ServiceAccount - name: {{ .Release.Name }}-webhook-ready - namespace: {{ .Release.Namespace }} ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ .Release.Name }}-webhook-ready - namespace: {{ .Release.Namespace }} - annotations: - helm.sh/hook: post-install,post-upgrade - helm.sh/hook-weight: "10" - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded -spec: - backoffLimit: {{ .Values.webhookReady.backoffLimit | default 2 }} - activeDeadlineSeconds: {{ $deadline }} - template: - spec: - restartPolicy: Never - serviceAccountName: {{ .Release.Name }}-webhook-ready - securityContext: - runAsNonRoot: true - runAsUser: 65532 - runAsGroup: 65532 - seccompProfile: - type: RuntimeDefault - containers: - - name: wait - image: {{ $image }} - imagePullPolicy: {{ if .Values.webhookReady.image.digest }}IfNotPresent{{ else }}Always{{ end }} - resources: - requests: - cpu: 10m - memory: 32Mi - limits: - cpu: 100m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: ["ALL"] - command: - - sh - - -c - - | - set -e - ns={{ .Release.Namespace }} - proxy="/api/v1/namespaces/${ns}/services/{{ $resourceName }}/proxy/readyz" - max_attempts={{ $maxAttempts }} - sleep_seconds={{ $sleepSeconds }} - i=0 - last_err="" - until last_err=$(kubectl get --raw "$proxy" 2>&1 >/dev/null); do - i=$((i + 1)) - if [ $i -gt $max_attempts ]; then - echo "timeout: cnpg webhook did not respond through the apiserver proxy after ${max_attempts} attempts (${sleep_seconds}s each)" - echo "last error: ${last_err}" - exit 1 - fi - if [ $((i % 10)) -eq 1 ]; then - echo "attempt $i/${max_attempts}: ${last_err}" - fi - sleep "$sleep_seconds" - done - echo "cnpg webhook is ready" diff --git a/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml b/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml deleted file mode 100644 index 3253c663..00000000 --- a/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml +++ /dev/null @@ -1,328 +0,0 @@ -suite: cnpg webhook post-install readiness gate - -templates: - - templates/webhook-ready-hook.yaml - - charts/cloudnative-pg/templates/service.yaml - -release: - name: postgres-operator - namespace: cozy-postgres-operator - -tests: - - it: renders four hook objects (SA + Role + RoleBinding + Job) - template: templates/webhook-ready-hook.yaml - asserts: - - hasDocuments: - count: 4 - - - it: every rendered object carries post-install and post-upgrade hook annotations - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 0 - equal: - path: metadata.annotations["helm.sh/hook"] - value: post-install,post-upgrade - - documentIndex: 1 - equal: - path: metadata.annotations["helm.sh/hook"] - value: post-install,post-upgrade - - documentIndex: 2 - equal: - path: metadata.annotations["helm.sh/hook"] - value: post-install,post-upgrade - - documentIndex: 3 - equal: - path: metadata.annotations["helm.sh/hook"] - value: post-install,post-upgrade - - - it: RBAC is created before the Job (hook-weight ordering) - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 0 - equal: - path: kind - value: ServiceAccount - - documentIndex: 0 - equal: - path: metadata.annotations["helm.sh/hook-weight"] - value: "0" - - documentIndex: 1 - equal: - path: kind - value: Role - - documentIndex: 1 - equal: - path: metadata.annotations["helm.sh/hook-weight"] - value: "0" - - documentIndex: 2 - equal: - path: kind - value: RoleBinding - - documentIndex: 2 - equal: - path: metadata.annotations["helm.sh/hook-weight"] - value: "0" - - documentIndex: 3 - equal: - path: kind - value: Job - - documentIndex: 3 - equal: - path: metadata.annotations["helm.sh/hook-weight"] - value: "10" - - - it: RBAC resourceName matches the exact proxy URL segment the Job probes - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 1 - equal: - path: rules[0].resources[0] - value: services/proxy - - documentIndex: 1 - equal: - path: rules[0].resourceNames[0] - value: https:cnpg-webhook-service:webhook-server - - documentIndex: 3 - matchRegex: - path: spec.template.spec.containers[0].command[2] - pattern: "/api/v1/namespaces/\\$\\{ns\\}/services/https:cnpg-webhook-service:webhook-server/proxy/readyz" - - - it: hardcoded service name in the hook matches the vendored cnpg subchart Service (drift guard for make update) - template: charts/cloudnative-pg/templates/service.yaml - asserts: - - equal: - path: metadata.name - value: cnpg-webhook-service - - equal: - path: spec.ports[0].name - value: webhook-server - - - it: Job calls kubectl get --raw on the proxy path - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 3 - matchRegex: - path: spec.template.spec.containers[0].command[2] - pattern: "kubectl get --raw" - - - it: Job image is digest-pinned when webhookReady.image.digest is set - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - image: - repository: docker.io/clastix/kubectl - tag: v1.32 - digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c - asserts: - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].image - value: docker.io/clastix/kubectl:v1.32@sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c - - - it: Job image falls back to tag-only when digest is not configured - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - image: - repository: docker.io/clastix/kubectl - tag: v1.32 - digest: "" - asserts: - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].image - value: docker.io/clastix/kubectl:v1.32 - - - it: backoffLimit defaults to 2 so transient pod-level failures retry instead of killing the HelmRelease - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 3 - equal: - path: spec.backoffLimit - value: 2 - - - it: backoffLimit is overridable - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - backoffLimit: 5 - asserts: - - documentIndex: 3 - equal: - path: spec.backoffLimit - value: 5 - - - it: chart render fails when webhookReady.image.repository is empty - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - image: - repository: "" - tag: v1.32 - asserts: - - failedTemplate: - errorMessage: "webhookReady.image.repository must be set to the container image providing kubectl for the post-install readiness Job" - - - it: chart render fails when webhookReady.image.tag is empty - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - image: - repository: docker.io/clastix/kubectl - tag: "" - asserts: - - failedTemplate: - errorMessage: "webhookReady.image.tag must be set for the post-install readiness Job" - - - it: retry loop bounds default when blanked so a wiped override still produces a working Job - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - image: - repository: docker.io/clastix/kubectl - tag: v1.32 - maxAttempts: null - sleepSeconds: null - asserts: - - documentIndex: 3 - matchRegex: - path: spec.template.spec.containers[0].command[2] - pattern: "max_attempts=60" - - documentIndex: 3 - matchRegex: - path: spec.template.spec.containers[0].command[2] - pattern: "sleep_seconds=2" - - - it: Job pod runs non-root with seccomp RuntimeDefault for restricted-PSA clusters - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 3 - equal: - path: spec.template.spec.securityContext.runAsNonRoot - value: true - - documentIndex: 3 - equal: - path: spec.template.spec.securityContext.seccompProfile.type - value: RuntimeDefault - - - it: wait container declares resource requests and limits for predictable scheduling - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].resources.requests.cpu - value: 10m - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].resources.requests.memory - value: 32Mi - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].resources.limits.cpu - value: 100m - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].resources.limits.memory - value: 64Mi - - - it: Job container drops all capabilities and runs read-only rootfs - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation - value: false - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem - value: true - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].securityContext.capabilities.drop[0] - value: ALL - - - it: imagePullPolicy is IfNotPresent when digest-pinned, Always when tag-only - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - image: - repository: docker.io/clastix/kubectl - tag: v1.32 - digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c - asserts: - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].imagePullPolicy - value: IfNotPresent - - - it: imagePullPolicy is Always when no digest is configured - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - image: - repository: docker.io/clastix/kubectl - tag: v1.32 - digest: "" - asserts: - - documentIndex: 3 - equal: - path: spec.template.spec.containers[0].imagePullPolicy - value: Always - - - it: retry loop captures and surfaces the last kubectl error message on timeout - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 3 - matchRegex: - path: spec.template.spec.containers[0].command[2] - pattern: 'last_err=\$\(kubectl get --raw' - - documentIndex: 3 - matchRegex: - path: spec.template.spec.containers[0].command[2] - pattern: 'last error: \$\{last_err\}' - - - it: retry loop error message stays in sync when maxAttempts is bumped - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - image: - repository: docker.io/clastix/kubectl - tag: v1.32 - maxAttempts: 90 - sleepSeconds: 3 - asserts: - - documentIndex: 3 - matchRegex: - path: spec.template.spec.containers[0].command[2] - pattern: "max_attempts=90" - - documentIndex: 3 - matchRegex: - path: spec.template.spec.containers[0].command[2] - pattern: "sleep_seconds=3" - - documentIndex: 3 - matchRegex: - path: spec.template.spec.containers[0].command[2] - pattern: 'after \$\{max_attempts\} attempts' - - - it: activeDeadlineSeconds scales with retry bounds so an override raise does not silently cut - template: templates/webhook-ready-hook.yaml - set: - webhookReady: - image: - repository: docker.io/clastix/kubectl - tag: v1.32 - maxAttempts: 180 - sleepSeconds: 3 - asserts: - - documentIndex: 3 - equal: - path: spec.activeDeadlineSeconds - value: 600 - - - it: activeDeadlineSeconds defaults include 60s slack over the default retry window - template: templates/webhook-ready-hook.yaml - asserts: - - documentIndex: 3 - equal: - path: spec.activeDeadlineSeconds - value: 180 diff --git a/packages/system/postgres-operator/values.yaml b/packages/system/postgres-operator/values.yaml index c408220e..6bc9595b 100644 --- a/packages/system/postgres-operator/values.yaml +++ b/packages/system/postgres-operator/values.yaml @@ -1,32 +1,3 @@ cloudnative-pg: crds: create: true - image: - tag: "1.27.3" -# Image used by the post-install webhook-readiness Job (see templates/webhook-ready-hook.yaml). -# Any image with kubectl on PATH works; the Job calls the apiserver service proxy with the -# hook ServiceAccount's token to confirm the mcluster.cnpg.io webhook is reachable end-to-end -# before the HelmRelease reports Ready, closing the "connection refused" bootstrap race. -# -# The tag is digest-pinned so an upstream retag does not change what runs on every install -# and upgrade across the fleet. Refresh by resolving the current manifest-list digest -# (`docker manifest inspect docker.io/clastix/kubectl:v1.32`) and updating `digest` below. -# renovate: datasource=docker depName=docker.io/clastix/kubectl -webhookReady: - image: - repository: docker.io/clastix/kubectl - tag: v1.32 - digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c - # Retry loop bounds for the readiness probe. Defaults total ~120s wall clock. - # Both are `default`-coerced in the template so an override that blanks them still - # produces a working Job. - maxAttempts: 60 - sleepSeconds: 2 - # Pod-level retry budget for transient node/registry failures (image pull rate limit, - # OOM, CNI hiccup). The shell loop inside the container only covers reachability retries. - # Pod retries and activeDeadlineSeconds (wall-clock bound on the whole Job across all - # pod retries) are ANDed, so activeDeadlineSeconds is the shorter of the two gates with - # the defaults above: the 60*2+60 = 180s deadline cuts the Job before backoffLimit=2 - # ever matters if pod-level failures eat more than ~60s of the budget. Raise - # maxAttempts/sleepSeconds alongside backoffLimit when tuning for slow image pulls. - backoffLimit: 2 diff --git a/packages/system/postgres-rd/cozyrds/postgres.yaml b/packages/system/postgres-rd/cozyrds/postgres.yaml index 72d013f1..b2980e8c 100644 --- a/packages/system/postgres-rd/cozyrds/postgres.yaml +++ b/packages/system/postgres-rd/cozyrds/postgres.yaml @@ -8,7 +8,7 @@ spec: singular: postgres plural: postgreses openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion.","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""},"serverName":{"description":"Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.","type":"string","default":""}}}}} + {"title":"Chart Values","type":"object","properties":{"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":""},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":""},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion.","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]}}} release: prefix: postgres- labels: @@ -33,7 +33,7 @@ spec: # labelSelector: # helm.toolkit.fluxcd.io/name: "{reqs[0]['metadata','name']}" - keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "version"], ["spec", "postgresql"], ["spec", "postgresql", "parameters"], ["spec", "postgresql", "parameters", "max_connections"], ["spec", "quorum"], ["spec", "quorum", "minSyncReplicas"], ["spec", "quorum", "maxSyncReplicas"], ["spec", "users"], ["spec", "databases"], ["spec", "backup"], ["spec", "backup", "enabled"], ["spec", "backup", "retentionPolicy"], ["spec", "backup", "destinationPath"], ["spec", "backup", "endpointURL"], ["spec", "backup", "schedule"], ["spec", "backup", "s3AccessKey"], ["spec", "backup", "s3SecretKey"], ["spec", "bootstrap"], ["spec", "bootstrap", "enabled"], ["spec", "bootstrap", "recoveryTime"], ["spec", "bootstrap", "oldName"], ["spec", "bootstrap", "serverName"]] + keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "version"], ["spec", "postgresql"], ["spec", "postgresql", "parameters"], ["spec", "postgresql", "parameters", "max_connections"], ["spec", "quorum"], ["spec", "quorum", "minSyncReplicas"], ["spec", "quorum", "maxSyncReplicas"], ["spec", "users"], ["spec", "databases"], ["spec", "backup"], ["spec", "backup", "enabled"], ["spec", "backup", "retentionPolicy"], ["spec", "backup", "destinationPath"], ["spec", "backup", "endpointURL"], ["spec", "backup", "schedule"], ["spec", "backup", "s3AccessKey"], ["spec", "backup", "s3SecretKey"], ["spec", "bootstrap"], ["spec", "bootstrap", "enabled"], ["spec", "bootstrap", "recoveryTime"], ["spec", "bootstrap", "oldName"]] secrets: exclude: [] include: diff --git a/packages/system/qdrant-rd/cozyrds/qdrant.yaml b/packages/system/qdrant-rd/cozyrds/qdrant.yaml index 37a695f0..c89692c0 100644 --- a/packages/system/qdrant-rd/cozyrds/qdrant.yaml +++ b/packages/system/qdrant-rd/cozyrds/qdrant.yaml @@ -8,7 +8,7 @@ spec: plural: qdrants singular: qdrant openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Qdrant replicas. Cluster mode is automatically enabled when replicas > 1.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each Qdrant replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for vector data storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false}}} + {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of Qdrant replicas. Cluster mode is automatically enabled when replicas > 1.","type":"integer","default":1},"resources":{"description":"Explicit CPU and memory configuration for each Qdrant replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for vector data storage.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}} release: prefix: qdrant- labels: diff --git a/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml b/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml index 575c4c4c..6ca2b79f 100644 --- a/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml +++ b/packages/system/rabbitmq-rd/cozyrds/rabbitmq.yaml @@ -8,7 +8,7 @@ spec: plural: rabbitmqs singular: rabbitmq openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of RabbitMQ replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"RabbitMQ major.minor version to deploy","type":"string","default":"v4.2","enum":["v4.2","v4.1","v4.0","v3.13"]},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}},"vhosts":{"description":"Virtual hosts configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["roles"],"properties":{"roles":{"description":"Virtual host roles list.","type":"object","properties":{"admin":{"description":"List of admin users.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of readonly users.","type":"array","items":{"type":"string"}}}}}}}}} + {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of RabbitMQ replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"}}}},"version":{"description":"RabbitMQ major.minor version to deploy","type":"string","default":"v4.2","enum":["v4.2","v4.1","v4.0","v3.13"]},"vhosts":{"description":"Virtual hosts configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","required":["roles"],"properties":{"roles":{"description":"Virtual host roles list.","type":"object","properties":{"admin":{"description":"List of admin users.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of readonly users.","type":"array","items":{"type":"string"}}}}}}}}} release: prefix: rabbitmq- labels: diff --git a/packages/system/redis-rd/cozyrds/redis.yaml b/packages/system/redis-rd/cozyrds/redis.yaml index e5191aa4..0a9aa989 100644 --- a/packages/system/redis-rd/cozyrds/redis.yaml +++ b/packages/system/redis-rd/cozyrds/redis.yaml @@ -8,7 +8,7 @@ spec: plural: redises singular: redis openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each Redis replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"Redis major version to deploy","type":"string","default":"v8","enum":["v8","v7"]},"authEnabled":{"description":"Enable password generation.","type":"boolean","default":true}}} + {"title":"Chart Values","type":"object","properties":{"authEnabled":{"description":"Enable password generation.","type":"boolean","default":true},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"replicas":{"description":"Number of Redis replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each Redis replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"1Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"version":{"description":"Redis major version to deploy","type":"string","default":"v8","enum":["v8","v7"]}}} release: prefix: redis- labels: diff --git a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml index 8b23b9ed..e31c3f3a 100644 --- a/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml +++ b/packages/system/seaweedfs-rd/cozyrds/seaweedfs.yaml @@ -8,7 +8,7 @@ spec: singular: seaweedfs plural: seaweedfses openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"pools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"dataCenter":{"description":"SeaweedFS data center name for this zone. Defaults to the zone name.","type":"string"},"nodeSelector":{"description":"YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: ).","type":"string"},"pools":{"description":"A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.","type":"object","additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store zone data. Defaults to volume.storageClass.","type":"string"}}}}}},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}} + {"title":"Chart Values","type":"object","properties":{"db":{"description":"Database configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of database replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""}}},"filer":{"description":"Filer service configuration.","type":"object","default":{},"properties":{"grpcHost":{"description":"The hostname used to expose or access the filer service externally.","type":"string","default":""},"grpcPort":{"description":"The port used to access the filer service externally.","type":"integer","default":443},"replicas":{"description":"Number of filer replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"A list of IP addresses or CIDR ranges that are allowed to access the filer service.","type":"array","default":[],"items":{"type":"string"}}}},"host":{"description":"The hostname used to access SeaweedFS externally (defaults to 's3' subdomain for the tenant host).","type":"string","default":""},"master":{"description":"Master service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of master replicas.","type":"integer","default":3},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"replicationFactor":{"description":"Replication factor: number of replicas for each volume in the SeaweedFS cluster.","type":"integer","default":2},"s3":{"description":"S3 service configuration.","type":"object","default":{},"properties":{"replicas":{"description":"Number of S3 replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"topology":{"description":"The topology of the SeaweedFS cluster.","type":"string","default":"Simple","enum":["Simple","MultiZone","Client"]},"volume":{"description":"Volume service configuration.","type":"object","default":{},"properties":{"diskType":{"description":"SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").","type":"string","default":""},"pools":{"description":"A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of volume replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"small","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"zones":{"description":"A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"dataCenter":{"description":"SeaweedFS data center name for this zone. Defaults to the zone name.","type":"string"},"nodeSelector":{"description":"YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: ).","type":"string"},"pools":{"description":"A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.","type":"object","additionalProperties":{"type":"object","required":["diskType"],"properties":{"diskType":{"description":"SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").","type":"string"},"replicas":{"description":"Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).","type":"integer"},"resources":{"description":"Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.","type":"string","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Kubernetes StorageClass for the pool. Defaults to volume.storageClass.","type":"string"}}}},"replicas":{"description":"Number of replicas in the zone.","type":"integer"},"size":{"description":"Zone storage size.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store zone data. Defaults to volume.storageClass.","type":"string"}}}}}}}} release: prefix: "" labels: diff --git a/packages/system/seaweedfs/templates/database.yaml b/packages/system/seaweedfs/templates/database.yaml index b9b50c49..e78caa89 100644 --- a/packages/system/seaweedfs/templates/database.yaml +++ b/packages/system/seaweedfs/templates/database.yaml @@ -5,9 +5,6 @@ metadata: name: seaweedfs-db spec: instances: {{ .Values.db.replicas }} - {{- $existingCluster := lookup "postgresql.cnpg.io/v1" "Cluster" .Release.Namespace "seaweedfs-db" }} - {{- $image := dig "spec" "imageName" "ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie" $existingCluster }} - imageName: {{ if regexMatch ":17\\." $image }}ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie{{ else if regexMatch ":[0-9]+\\.[0-9]+$" $image }}{{ printf "%s-standard-trixie" $image }}{{ else }}{{ $image }}{{ end }} storage: size: {{ .Values.db.size }} {{- with .Values.db.storageClass }} diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml index 3542a77f..9250e982 100644 --- a/packages/system/seaweedfs/values.yaml +++ b/packages/system/seaweedfs/values.yaml @@ -177,7 +177,7 @@ seaweedfs: bucketClassName: "seaweedfs" region: "" sidecar: - image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.3.0@sha256:5bcccbdb13979a16cee535eb5fbcdf0d87973689010a10b7b25e55c5be3edaa6" + image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.1.7@sha256:fd3571e746efbc65fab342ca557beb2d0ad46fc0183772605fe84c6d3dd446a4" certificates: commonName: "SeaweedFS CA" ipAddresses: [] diff --git a/packages/system/tcp-balancer-rd/cozyrds/tcp-balancer.yaml b/packages/system/tcp-balancer-rd/cozyrds/tcp-balancer.yaml index cabeedb3..4f87f888 100644 --- a/packages/system/tcp-balancer-rd/cozyrds/tcp-balancer.yaml +++ b/packages/system/tcp-balancer-rd/cozyrds/tcp-balancer.yaml @@ -8,7 +8,7 @@ spec: plural: tcpbalancers singular: tcpbalancer openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of HAProxy replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"httpAndHttps":{"description":"HTTP and HTTPS configuration.","type":"object","default":{},"required":["mode","targetPorts"],"properties":{"endpoints":{"description":"Endpoint addresses list.","type":"array","default":[],"items":{"type":"string"}},"mode":{"description":"Mode for balancer.","type":"string","default":"tcp","enum":["tcp","tcp-with-proxy"]},"targetPorts":{"description":"Target ports configuration.","type":"object","default":{},"required":["http","https"],"properties":{"http":{"description":"HTTP port number.","type":"integer","default":80},"https":{"description":"HTTPS port number.","type":"integer","default":443}}}}},"whitelistHTTP":{"description":"Secure HTTP by whitelisting client networks (default: false).","type":"boolean","default":false},"whitelist":{"description":"List of allowed client networks.","type":"array","default":[],"items":{"type":"string"}}}} + {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"httpAndHttps":{"description":"HTTP and HTTPS configuration.","type":"object","default":{},"required":["mode","targetPorts"],"properties":{"endpoints":{"description":"Endpoint addresses list.","type":"array","default":[],"items":{"type":"string"}},"mode":{"description":"Mode for balancer.","type":"string","default":"tcp","enum":["tcp","tcp-with-proxy"]},"targetPorts":{"description":"Target ports configuration.","type":"object","default":{},"required":["http","https"],"properties":{"http":{"description":"HTTP port number.","type":"integer","default":80},"https":{"description":"HTTPS port number.","type":"integer","default":443}}}}},"replicas":{"description":"Number of HAProxy replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"whitelist":{"description":"List of allowed client networks.","type":"array","default":[],"items":{"type":"string"}},"whitelistHTTP":{"description":"Secure HTTP by whitelisting client networks (default: false).","type":"boolean","default":false}}} release: prefix: tcp-balancer- labels: diff --git a/packages/system/tenant-rd/cozyrds/tenant.yaml b/packages/system/tenant-rd/cozyrds/tenant.yaml index 9af11af0..9b09692c 100644 --- a/packages/system/tenant-rd/cozyrds/tenant.yaml +++ b/packages/system/tenant-rd/cozyrds/tenant.yaml @@ -8,7 +8,7 @@ spec: singular: tenant plural: tenants openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"host":{"description":"The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).","type":"string","default":""},"etcd":{"description":"Deploy own Etcd cluster.","type":"boolean","default":false},"monitoring":{"description":"Deploy own Monitoring Stack.","type":"boolean","default":false},"ingress":{"description":"Deploy own Ingress Controller.","type":"boolean","default":false},"seaweedfs":{"description":"Deploy own SeaweedFS.","type":"boolean","default":false},"schedulingClass":{"description":"The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.","type":"string","default":""},"resourceQuotas":{"description":"Define resource quotas for the tenant.","type":"object","default":{},"additionalProperties":{"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}} + {"title":"Chart Values","type":"object","properties":{"etcd":{"description":"Deploy own Etcd cluster.","type":"boolean","default":false},"host":{"description":"The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).","type":"string","default":""},"ingress":{"description":"Deploy own Ingress Controller.","type":"boolean","default":false},"monitoring":{"description":"Deploy own Monitoring Stack.","type":"boolean","default":false},"resourceQuotas":{"description":"Define resource quotas for the tenant.","type":"object","default":{},"additionalProperties":{"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}},"seaweedfs":{"description":"Deploy own SeaweedFS.","type":"boolean","default":false}}} release: prefix: tenant- labels: @@ -23,7 +23,7 @@ spec: plural: Tenants description: Separated tenant namespace icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODdfMzQwMykiLz4KPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzY4N18zNDAzKSI+CjxwYXRoIGQ9Ik03MiAyOUM2Ni4zOTI2IDI5IDYxLjAxNDggMzEuMjM4OCA1Ny4wNDk3IDM1LjIyNEM1My4wODQ3IDM5LjIwOTEgNTAuODU3MSA0NC42MTQxIDUwLjg1NzEgNTAuMjVDNTAuODU3MSA1NS44ODU5IDUzLjA4NDcgNjEuMjkwOSA1Ny4wNDk3IDY1LjI3NkM2MS4wMTQ4IDY5LjI2MTIgNjYuMzkyNiA3MS41IDcyIDcxLjVDNzcuNjA3NCA3MS41IDgyLjk4NTIgNjkuMjYxMiA4Ni45NTAzIDY1LjI3NkM5MC45MTUzIDYxLjI5MDkgOTMuMTQyOSA1NS44ODU5IDkzLjE0MjkgNTAuMjVDOTMuMTQyOSA0NC42MTQxIDkwLjkxNTMgMzkuMjA5MSA4Ni45NTAzIDM1LjIyNEM4Mi45ODUyIDMxLjIzODggNzcuNjA3NCAyOSA3MiAyOVpNNjAuOTgyNiA4My4zMDM3QzYwLjQ1NCA4Mi41ODk4IDU5LjU5NTEgODIuMTkxNCA1OC43MTk2IDgyLjI3NDRDNDUuMzg5NyA4My43MzU0IDM1IDk1LjEwNzQgMzUgMTA4LjkwM0MzNSAxMTEuNzI2IDM3LjI3OTUgMTE0IDQwLjA3MSAxMTRIMTAzLjkyOUMxMDYuNzM3IDExNCAxMDkgMTExLjcwOSAxMDkgMTA4LjkwM0MxMDkgOTUuMTA3NCA5OC42MTAzIDgzLjc1MiA4NS4yNjM4IDgyLjI5MUM4NC4zODg0IDgyLjE5MTQgODMuNTI5NSA4Mi42MDY0IDgzLjAwMDkgODMuMzIwM0w3NC4wOTc4IDk1LjI0MDJDNzMuMDQwNiA5Ni42NTE0IDcwLjkyNjMgOTYuNjUxNCA2OS44NjkyIDk1LjI0MDJMNjAuOTY2MSA4My4zMjAzTDYwLjk4MjYgODMuMzAzN1oiIGZpbGw9ImJsYWNrIi8+CjwvZz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhcl82ODdfMzQwMyIgeDE9IjcyIiB5MT0iMTQ0IiB4Mj0iLTEuMjgxN2UtMDUiIHkyPSI0IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wIHN0b3AtY29sb3I9IiNDMEQ2RkYiLz4KPHN0b3Agb2Zmc2V0PSIwLjMiIHN0b3AtY29sb3I9IiNDNERBRkYiLz4KPHN0b3Agb2Zmc2V0PSIwLjY1IiBzdG9wLWNvbG9yPSIjRDNFOUZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iI0U5RkZGRiIvPgo8L2xpbmVhckdyYWRpZW50Pgo8Y2xpcFBhdGggaWQ9ImNsaXAwXzY4N18zNDAzIj4KPHJlY3Qgd2lkdGg9Ijc0IiBoZWlnaHQ9Ijg1IiBmaWxsPSJ3aGl0ZSIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMzUgMjkpIi8+CjwvY2xpcFBhdGg+CjwvZGVmcz4KPC9zdmc+Cg== - keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "etcd"], ["spec", "monitoring"], ["spec", "ingress"], ["spec", "seaweedfs"], ["spec", "schedulingClass"], ["spec", "resourceQuotas"]] + keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "etcd"], ["spec", "monitoring"], ["spec", "ingress"], ["spec", "seaweedfs"], ["spec", "resourceQuotas"]] secrets: exclude: [] include: [] diff --git a/packages/system/velero/templates/backupstrategy-controller-rbac.yaml b/packages/system/velero/templates/backupstrategy-controller-rbac.yaml deleted file mode 100644 index 43c51cd7..00000000 --- a/packages/system/velero/templates/backupstrategy-controller-rbac.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# Grants the backupstrategy-controller permission to manage ResourceModifier -# ConfigMaps in the Velero install namespace. Lives here (not in the -# backupstrategy-controller chart) so that the Role is only created when -# velero is actually installed — otherwise the chart would try to create it -# in a namespace that does not exist. -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: backups.cozystack.io:strategy-controller:velero-configmaps -rules: -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["create", "get", "list", "delete", "deletecollection", "patch", "update"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: backups.cozystack.io:strategy-controller:velero-configmaps -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: backups.cozystack.io:strategy-controller:velero-configmaps -subjects: -- kind: ServiceAccount - name: backupstrategy-controller - namespace: cozy-backup-controller diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/.helmignore b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/.helmignore index a181e3c7..2ccbd54f 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/.helmignore +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/.helmignore @@ -20,10 +20,5 @@ .idea/ *.tmproj .vscode/ +*.md *.md.gotmpl -CHANGELOG.md -_changelog.md -_index.md -e2e/ -lint/ -tests/ diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock index 2868e66f..6c7b4c55 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock @@ -1,9 +1,9 @@ dependencies: - name: victoria-metrics-common - repository: oci://ghcr.io/victoriametrics/helm-charts - version: 0.3.0 + repository: https://victoriametrics.github.io/helm-charts + version: 0.0.42 - name: crds repository: "" version: 0.0.* -digest: sha256:adec954bf2814f744f5b69fcf67c8b246bf21f416adb0ab37d91c9b42f72d353 -generated: "2026-04-16T10:14:10.795552631Z" +digest: sha256:d186ad6f54d64a2f828cd80a136e06dcf1f30dbc8ae94964bb9b166ee32eb30e +generated: "2025-03-19T09:59:22.84209872Z" diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml index 030af8f0..b6574d02 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml @@ -1,7 +1,7 @@ annotations: artifacthub.io/category: monitoring-logging artifacthub.io/changes: | - - revert change in Deployment's matchLabels, that was introduced in release 0.60.0 + - updates operator to [v0.55.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.55.0) version artifacthub.io/license: Apache-2.0 artifacthub.io/links: | - name: Sources @@ -9,26 +9,21 @@ annotations: - name: Charts repo url: https://victoriametrics.github.io/helm-charts/ - name: Docs - url: https://docs.victoriametrics.com/operator/ + url: https://docs.victoriametrics.com/operator - name: Changelog - url: https://docs.victoriametrics.com/operator/changelog/ + url: https://docs.victoriametrics.com/operator/changelog artifacthub.io/operator: "true" - artifacthub.io/readme: | - # VictoriaMetrics Operator Helm chart - - Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/). - Changelog is [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/changelog/). apiVersion: v2 -appVersion: v0.68.4 +appVersion: v0.55.0 dependencies: - name: victoria-metrics-common - repository: oci://ghcr.io/victoriametrics/helm-charts - version: 0.3.* + repository: https://victoriametrics.github.io/helm-charts + version: 0.0.* - condition: crds.plain name: crds repository: "" version: 0.0.* -description: VictoriaMetrics Operator +description: Victoria Metrics Operator home: https://github.com/VictoriaMetrics/operator icon: https://avatars.githubusercontent.com/u/43720803?s=200&v=4 keywords: @@ -47,4 +42,4 @@ sources: - https://github.com/VictoriaMetrics/helm-charts - https://github.com/VictoriaMetrics/operator type: application -version: 0.61.0 +version: 0.44.0 diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md deleted file mode 100644 index 6a080424..00000000 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md +++ /dev/null @@ -1,4 +0,0 @@ -# VictoriaMetrics Operator Helm chart - -Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/). -Changelog is [here](https://docs.victoriametrics.com/helm/victoria-metrics-operator/changelog/). diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES index 3529783a..55ceea77 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES @@ -1,7 +1,7 @@ -# Release notes for version 0.61.0 +# Release notes for version 0.44.0 -**Release date:** 16 Apr 2026 +**Release date:** 02 Apr 2025 -![Helm: v3](https://img.shields.io/badge/Helm-v3.14%2B-informational?color=informational&logo=helm&link=https%3A%2F%2Fgithub.com%2Fhelm%2Fhelm%2Freleases%2Ftag%2Fv3.14.0) ![AppVersion: v0.68.4](https://img.shields.io/badge/v0.68.4-success?logo=VictoriaMetrics&labelColor=gray&link=https%3A%2F%2Fdocs.victoriametrics.com%2Foperator%2Fchangelog%2F%23v0684) +![Helm: v3](https://img.shields.io/badge/Helm-v3.14%2B-informational?color=informational&logo=helm&link=https%3A%2F%2Fgithub.com%2Fhelm%2Fhelm%2Freleases%2Ftag%2Fv3.14.0) ![AppVersion: v0.55.0](https://img.shields.io/badge/v0.55.0-success?logo=VictoriaMetrics&labelColor=gray&link=https%3A%2F%2Fdocs.victoriametrics.com%2Foperator%2Fchangelog%23v0550) -- revert change in Deployment's matchLabels, that was introduced in release 0.60.0 +- updates operator to [v0.55.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.55.0) version diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/README.md b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/README.md deleted file mode 100644 index e2bc8e0b..00000000 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/README.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -build: - list: never - publishResources: false - render: never -sitemap: - disable: true ---- -# Subchart for VictoriaMetrics Operator CRDs diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml index bdf7e8d0..038cc276 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/crds/crd.yaml @@ -2,3185 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vlagents.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VLAgent - listKind: VLAgentList - plural: vlagents - singular: vlagent - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: current number of replicas - jsonPath: .status.replicas - name: Replica Count - type: integer - - description: Current status of update rollout - jsonPath: .status.updateStatus - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - claimTemplates: - items: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - x-kubernetes-preserve-unknown-fields: true - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - status: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - allocatedResourceStatuses: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: granular - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - conditions: - items: - properties: - lastProbeTime: - format: date-time - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentVolumeAttributesClassName: - type: string - modifyVolumeStatus: - properties: - status: - type: string - targetVolumeAttributesClassName: - type: string - required: - - status - type: object - phase: - type: string - type: object - type: object - type: array - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - k8sCollector: - properties: - checkpointsPath: - type: string - decolorizeFields: - items: - type: string - type: array - enabled: - type: boolean - excludeFilter: - type: string - extraFields: - type: string - ignoreFields: - items: - type: string - type: array - includeNodeAnnotations: - type: boolean - includeNodeLabels: - type: boolean - includePodAnnotations: - type: boolean - includePodLabels: - type: boolean - logsPath: - type: string - msgFields: - items: - type: string - type: array - streamFields: - items: - type: string - type: array - tenantID: - type: string - timeFields: - items: - type: string - type: array - type: object - license: - properties: - forceOffline: - type: boolean - key: - type: string - keyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - reloadInterval: - type: string - type: object - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - managedMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: - type: string - whenScaled: - type: string - type: object - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - remoteWrite: - items: - properties: - bearerTokenPath: - type: string - bearerTokenSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - headers: - items: - type: string - type: array - maxDiskUsage: - x-kubernetes-preserve-unknown-fields: true - oauth2: - properties: - clientIDFile: - type: string - clientIDSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - clientSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - clientSecretFile: - type: string - endpointParams: - additionalProperties: - type: string - type: object - scopes: - items: - type: string - type: array - tokenURL: - minLength: 1 - type: string - required: - - tokenURL - type: object - proxyURL: - type: string - sendTimeout: - pattern: '[0-9]+(ms|s|m|h)' - type: string - tlsConfig: - properties: - caFile: - type: string - caSecretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - certFile: - type: string - certSecretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - insecureSkipVerify: - type: boolean - keyFile: - type: string - keySecretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - serverName: - type: string - type: object - url: - type: string - required: - - url - type: object - type: array - remoteWriteSettings: - properties: - flushInterval: - pattern: '[0-9]+(ms|s|m|h)' - type: string - maxBlockSize: - x-kubernetes-preserve-unknown-fields: true - maxDiskUsagePerURL: - x-kubernetes-preserve-unknown-fields: true - queues: - format: int32 - type: integer - showURL: - type: boolean - tmpDataPath: - type: string - type: object - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdateStrategy: - type: string - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceAccountName: - type: string - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - storage: - properties: - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - volumeClaimTemplate: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - status: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - allocatedResourceStatuses: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: granular - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - conditions: - items: - properties: - lastProbeTime: - format: date-time - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentVolumeAttributesClassName: - type: string - modifyVolumeStatus: - properties: - status: - type: string - targetVolumeAttributesClassName: - type: string - required: - - status - type: object - phase: - type: string - type: object - type: object - type: object - syslogSpec: - properties: - tcpListeners: - items: - properties: - compressMethod: - pattern: ^(none|zstd|gzip|deflate)$ - type: string - decolorizeFields: - type: string - ignoreFields: - type: string - listenPort: - format: int32 - type: integer - streamFields: - type: string - tenantID: - type: string - tlsConfig: - properties: - certFile: - type: string - certSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - keyFile: - type: string - keySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - listenPort - type: object - type: array - udpListeners: - items: - properties: - compressMethod: - pattern: ^(none|zstd|gzip|deflate)$ - type: string - decolorizeFields: - type: string - ignoreFields: - type: string - listenPort: - format: int32 - type: integer - streamFields: - type: string - tenantID: - type: string - required: - - listenPort - type: object - type: array - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - tmpDataPath: - type: string - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - required: - - remoteWrite - type: object - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - replicas: - format: int32 - type: integer - selector: - type: string - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - scale: - labelSelectorPath: .status.selector - specReplicasPath: .spec.shardCount - statusReplicasPath: .status.shards - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vlclusters.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VLCluster - listKind: VLClusterList - plural: vlclusters - singular: vlcluster - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: replicas of VLInsert - jsonPath: .spec.vlinsert.replicaCount - name: Insert Count - type: string - - description: replicas of VLStorage - jsonPath: .spec.vlstorage.replicaCount - name: Storage Count - type: string - - description: replicas of VLSelect - jsonPath: .spec.vlselect.replicaCount - name: Select Count - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Current status of cluster - jsonPath: .status.updateStatus - name: Status - type: string - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - clusterDomainName: - type: string - clusterVersion: - type: string - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - license: - properties: - forceOffline: - type: boolean - key: - type: string - keyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - reloadInterval: - type: string - type: object - managedMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - paused: - type: boolean - requestsLoadBalancer: - properties: - disableInsertBalancing: - type: boolean - disableSelectBalancing: - type: boolean - enabled: - type: boolean - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - serviceAccountName: - type: string - useStrictSecurity: - type: boolean - vlinsert: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - hpa: - type: object - x-kubernetes-preserve-unknown-fields: true - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdate: - properties: - maxSurge: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - syslogSpec: - properties: - tcpListeners: - items: - properties: - compressMethod: - pattern: ^(none|zstd|gzip|deflate)$ - type: string - decolorizeFields: - type: string - ignoreFields: - type: string - listenPort: - format: int32 - type: integer - streamFields: - type: string - tenantID: - type: string - tlsConfig: - properties: - certFile: - type: string - certSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - keyFile: - type: string - keySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - listenPort - type: object - type: array - udpListeners: - items: - properties: - compressMethod: - pattern: ^(none|zstd|gzip|deflate)$ - type: string - decolorizeFields: - type: string - ignoreFields: - type: string - listenPort: - format: int32 - type: integer - streamFields: - type: string - tenantID: - type: string - required: - - listenPort - type: object - type: array - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - updateStrategy: - enum: - - Recreate - - RollingUpdate - type: string - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object - type: object - vlselect: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - extraStorageNodes: - items: - properties: - addr: - type: string - required: - - addr - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - hpa: - type: object - x-kubernetes-preserve-unknown-fields: true - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdate: - properties: - maxSurge: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - updateStrategy: - enum: - - Recreate - - RollingUpdate - type: string - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object - type: object - vlstorage: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - claimTemplates: - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - futureRetention: - pattern: ^[0-9]+(h|d|w|y)?$ - type: string - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - hpa: - properties: - behaviour: - properties: - scaleDown: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - scaleUp: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - maxReplicas: - format: int32 - type: integer - metrics: - items: - properties: - containerResource: - properties: - container: - type: string - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - container - - name - - target - type: object - external: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - object: - properties: - describedObject: - properties: - apiVersion: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - describedObject - - metric - - target - type: object - pods: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - resource: - properties: - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - name - - target - type: object - type: - type: string - required: - - type - type: object - type: array - minReplicas: - format: int32 - type: integer - type: object - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logIngestedRows: - type: boolean - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - logNewStreams: - type: boolean - maintenanceInsertNodeIDs: - items: - format: int32 - type: integer - type: array - maintenanceSelectNodeIDs: - items: - format: int32 - type: integer - type: array - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: - type: string - whenScaled: - type: string - type: object - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - retentionMaxDiskSpaceUsageBytes: - type: string - retentionPeriod: - pattern: ^[0-9]+(h|d|w|y)?$ - type: string - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdateStrategy: - type: string - rollingUpdateStrategyBehavior: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - storage: - properties: - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - volumeClaimTemplate: - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - storageDataPath: - type: string - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object - type: object - type: object - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vlogs.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -3202,164 +24,146 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VLogs is fast, cost-effective and scalable logs database. + VLogs is the Schema for the vlogs API properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: - required: - - retentionPeriod - type: object - x-kubernetes-preserve-unknown-fields: true - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vlsingles.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VLSingle - listKind: VLSingleList - plural: vlsingles - singular: vlsingle - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: Current status of logs instance update process - jsonPath: .status.status - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: + description: VLogsSpec defines the desired state of VLogs properties: affinity: + description: Affinity If specified, the pod's scheduling constraints. type: object x-kubernetes-preserve-unknown-fields: true configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder items: type: string type: array containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. type: boolean disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable type: boolean dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. items: x-kubernetes-preserve-unknown-fields: true properties: nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array x-kubernetes-list-type: atomic options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: |- + Name is this DNS resolver option's name. + Required. type: string value: + description: Value is this DNS resolver option's value. type: string type: object type: array x-kubernetes-list-type: atomic searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. items: type: string type: array x-kubernetes-list-type: atomic type: object dnsPolicy: + description: DNSPolicy sets DNS policy for the pod type: string extraArgs: additionalProperties: type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp type: object extraEnvs: + description: ExtraEnvs that will be passed to the application container items: + description: EnvVar represents an environment variable present in + a Container. properties: name: + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string required: - name @@ -3367,121 +171,175 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap items: + description: EnvFromSource represents the source of a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap must be defined type: boolean type: object x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret must be defined type: boolean type: object x-kubernetes-map-type: atomic type: object type: array futureRetention: - pattern: ^[0-9]+(h|d|y)?$ + description: |- + FutureRetention for the stored logs + Log entries with timestamps bigger than now+futureRetention are rejected during data ingestion; see https://docs.victoriametrics.com/victorialogs/#retention type: string host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace type: boolean image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config properties: pullPolicy: + description: PullPolicy describes how to pull docker image type: string repository: + description: Repository contains name of docker image + it's repository + if needed type: string tag: + description: Tag contains desired docker image version type: string type: object imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic type: array initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array - license: - properties: - forceOffline: - type: boolean - key: - type: string - keyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - reloadInterval: - type: string - type: object livenessProbe: + description: LivenessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true logFormat: + description: LogFormat for VLogs to be configured with. enum: - default - json type: string logIngestedRows: + description: Whether to log all the ingested log entries; this can + be useful for debugging of data ingestion; see https://docs.victoriametrics.com/victorialogs/data-ingestion/ type: boolean logLevel: + description: LogLevel for VictoriaLogs to be configured with. enum: - INFO - WARN @@ -3490,67 +348,144 @@ spec: - PANIC type: string logNewStreams: + description: LogNewStreams Whether to log creation of new streams; + this can be useful for debugging of high cardinality issues with + log streams; see https://docs.victoriametrics.com/victorialogs/keyconcepts/#stream-fields type: boolean managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object type: object minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle format: int32 type: integer nodeSelector: additionalProperties: type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. type: object paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. type: boolean podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the VLogs pods. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object port: + description: Port listen address type: string priorityClassName: + description: PriorityClassName class assigned to the Pods type: string readinessGates: + description: ReadinessGates defines pod readiness gates items: + description: PodReadinessGate contains the reference to a pod condition properties: conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. type: string required: - conditionType type: object type: array readinessProbe: + description: ReadinessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true + removePvcAfterDelete: + description: |- + RemovePvcAfterDelete - if true, controller adds ownership to pvc + and after VLogs object deletion - pvc will be garbage collected + by controller manager + type: boolean replicaCount: + description: ReplicaCount is the expected size of the Application. format: int32 type: integer resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -3566,6 +501,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -3574,74 +512,145 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object - retentionMaxDiskSpaceUsageBytes: - type: string retentionPeriod: - pattern: ^[0-9]+(h|d|w|y)?$ + description: RetentionPeriod for the stored logs type: string revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. format: int32 type: integer runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ type: string schedulerName: + description: SchedulerName - defines kubernetes scheduler name type: string secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder items: type: string type: array securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods type: string serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vlogs VMServiceScrape + spec required: - endpoints type: object x-kubernetes-preserve-unknown-fields: true serviceSpec: + description: ServiceSpec that will be added to vlogs service spec properties: metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ type: object x-kubernetes-preserve-unknown-fields: true useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication type: boolean required: - spec type: object startupProbe: + description: StartupProbe that will be added to CRD pod type: object x-kubernetes-preserve-unknown-fields: true storage: + description: |- + Storage is the definition of how storage will be used by the VLogs + by default it`s empty dir properties: accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string required: - kind @@ -3649,20 +658,60 @@ spec: type: object x-kubernetes-map-type: atomic dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. type: string required: - kind - name type: object resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: limits: additionalProperties: @@ -3671,6 +720,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -3679,18 +731,40 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object selector: + description: selector is a label query over volumes to consider + for binding. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -3704,132 +778,133 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. type: string volumeName: + description: volumeName is the binding reference to the PersistentVolume + backing this claim. type: string type: object storageDataPath: + description: |- + StorageDataPath disables spec.storage option and overrides arg for victoria-logs binary --storageDataPath, + its users responsibility to mount proper device into given path. type: string storageMetadata: + description: StorageMeta defines annotations and labels attached to + PVC for given vlogs CR properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object - syslogSpec: - properties: - tcpListeners: - items: - properties: - compressMethod: - pattern: ^(none|zstd|gzip|deflate)$ - type: string - decolorizeFields: - type: string - ignoreFields: - type: string - listenPort: - format: int32 - type: integer - streamFields: - type: string - tenantID: - type: string - tlsConfig: - properties: - certFile: - type: string - certSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - keyFile: - type: string - keySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - listenPort - type: object - type: array - udpListeners: - items: - properties: - compressMethod: - pattern: ^(none|zstd|gzip|deflate)$ - type: string - decolorizeFields: - type: string - ignoreFields: - type: string - listenPort: - format: int32 - type: integer - streamFields: - type: string - tenantID: - type: string - required: - - listenPort - type: object - type: array - type: object terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination format: int64 type: integer tolerations: + description: Tolerations If specified, the pod's tolerations. items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . properties: effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. required: - maxSkew - topologyKey @@ -3838,25 +913,77 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements type: boolean useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions type: boolean volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container items: + description: VolumeMount describes a mounting of a Volume within + a container. properties: mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. type: string mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. type: boolean recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. type: string subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -3864,42 +991,74 @@ spec: type: object type: array volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array + required: + - retentionPeriod type: object status: + description: VLogsStatus defines the observed state of VLogs properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -3914,11 +1073,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -3931,7 +1095,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmagents.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -3961,78 +1125,170 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMAgent - is a tiny but brave agent, which helps you collect metrics from various sources and stores them in VictoriaMetrics + or any other Prometheus-compatible storage system that supports the remote_write protocol. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMAgentSpec defines the desired state of VMAgent properties: + aPIServerConfig: + description: |- + APIServerConfig allows specifying a host and auth methods to access apiserver. + If left empty, VMAgent is assumed to run inside of the cluster + and will discover API servers automatically and use the pod's CA certificate + and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/. + aPIServerConfig is deprecated use apiServerConfig instead + required: + - host + type: object + x-kubernetes-preserve-unknown-fields: true additionalScrapeConfigs: + description: |- + AdditionalScrapeConfigs As scrape configs are appended, the user is responsible to make sure it + is valid. Note that using this feature may expose the possibility to + break upgrades of VMAgent. It is advised to review VMAgent release + notes to ensure that no incompatible scrape configs are going to break + VMAgent after the upgrade. properties: key: + description: The key of the secret to select from. Must be a + valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic affinity: + description: Affinity If specified, the pod's scheduling constraints. type: object x-kubernetes-preserve-unknown-fields: true apiServerConfig: + description: |- + APIServerConfig allows specifying a host and auth methods to access apiserver. + If left empty, VMAgent is assumed to run inside of the cluster + and will discover API servers automatically and use the pod's CA certificate + and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/. properties: authorization: + description: Authorization configures generic authorization params properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -4040,36 +1296,66 @@ spec: x-kubernetes-map-type: atomic type: object bearerToken: + description: Bearer token for accessing apiserver. type: string bearerTokenFile: + description: File to read bearer token for accessing apiserver. type: string host: + description: |- + Host of apiserver. + A valid string consisting of a hostname or IP followed by an optional port number type: string tlsConfig: + description: TLSConfig Config to use for accessing apiserver. properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -4077,30 +1363,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use for + the targets. type: string cert: + description: Struct containing the client cert file for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -4108,59 +1420,120 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object required: - host type: object arbitraryFSAccessThroughSMs: + description: |- + ArbitraryFSAccessThroughSMs configures whether configuration + based on EndpointAuth can access arbitrary files on the file system + of the VMAgent container e.g. bearer token files, basic auth, tls certs properties: deny: type: boolean type: object claimTemplates: + description: ClaimTemplates allows adding additional VolumeClaimTemplates + for VMAgent in StatefulMode items: + description: PersistentVolumeClaim is a user's request for and claim + to a persistent volume properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata type: object x-kubernetes-preserve-unknown-fields: true spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string required: - kind @@ -4168,20 +1541,60 @@ spec: type: object x-kubernetes-map-type: atomic dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. type: string required: - kind - name type: object resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: limits: additionalProperties: @@ -4190,6 +1603,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -4198,18 +1614,40 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object selector: + description: selector is a label query over volumes to consider + for binding. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4223,28 +1661,99 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. type: string volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. type: string type: object status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic allocatedResourceStatuses: additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. type: string + description: "allocatedResourceStatuses stores status of + resource being resized for the given PVC.\nKey names follow + standard Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus + can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with a + terminal error.\n\t- NodeResizePending:\n\t\tState set + when resize controller has finished resizing the volume + but further resizing of\n\t\tvolume is needed on the node.\n\t- + NodeResizeInProgress:\n\t\tState set when kubelet starts + resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, it + means that no resize operation is in progress for the + given PVC.\n\nA controller that receives PVC update with + previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." type: object x-kubernetes-map-type: granular allocatedResources: @@ -4254,6 +1763,30 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources allocated + to a PVC including its capacity.\nKey names follow standard + Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nCapacity + reported here may be larger than the actual capacity when + a volume expansion operation\nis requested.\nFor storage + quota, the larger value from allocatedResources and PVC.spec.resources + is used.\nIf allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and if + the actual volume capacity\nis equal or lower than the + requested capacity.\n\nA controller that receives PVC + update with previously unknown resourceName\nshould ignore + the update for the purpose it was designed. For example + - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." type: object capacity: additionalProperties: @@ -4262,23 +1795,47 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: capacity represents the actual resources of + the underlying volume. type: object conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. items: + description: PersistentVolumeClaimCondition contains details + about state of pvc properties: lastProbeTime: + description: lastProbeTime is the time we probed the + condition. format: date-time type: string lastTransitionTime: + description: lastTransitionTime is the time the condition + transitioned from one status to another. format: date-time type: string message: + description: message is the human-readable message + indicating details about last transition. type: string reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. type: string status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required type: string type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about type: string required: - status @@ -4289,54 +1846,92 @@ spec: - type x-kubernetes-list-type: map currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). type: string modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). properties: status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible indicates + that the request has been rejected as invalid by the + CSI driver. To\n\t resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can be + added in the future. Consumers should check for unknown + statuses and fail appropriately." type: string targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled type: string required: - status type: object phase: + description: phase represents the current phase of PersistentVolumeClaim. type: string type: object type: object type: array configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder items: type: string type: array - configReloadAuthKeySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic configReloaderExtraArgs: additionalProperties: type: string + description: |- + ConfigReloaderExtraArgs that will be passed to VMAuths config-reloader container + for example resyncInterval: "30s" type: object - configReloaderImage: - type: string configReloaderImageTag: + description: ConfigReloaderImageTag defines image:tag for config-reloader + container type: string configReloaderResources: + description: |- + ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -4352,6 +1947,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -4360,68 +1958,144 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array daemonSetMode: + description: |- + DaemonSetMode enables DaemonSet deployment mode instead of Deployment. + Supports only VMPodScrape + (available from v0.55.0). + Cannot be used with statefulMode type: boolean disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. type: boolean disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable type: boolean dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. items: x-kubernetes-preserve-unknown-fields: true properties: nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array x-kubernetes-list-type: atomic options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: |- + Name is this DNS resolver option's name. + Required. type: string value: + description: Value is this DNS resolver option's value. type: string type: object type: array x-kubernetes-list-type: atomic searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. items: type: string type: array x-kubernetes-list-type: atomic type: object dnsPolicy: + description: DNSPolicy sets DNS policy for the pod type: string enableKubernetesAPISelectors: + description: |- + EnableKubernetesAPISelectors instructs vmagent to use CRD scrape objects spec.selectors for + Kubernetes API list and watch requests. + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#list-and-watch-filtering + It could be useful to reduce Kubernetes API server resource usage for serving less than 100 CRD scrape objects in total. type: boolean enforcedNamespaceLabel: - type: string - externalLabelName: + description: |- + EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert + and metric that is user created. The label value will always be the namespace of the object that is + being created. type: string externalLabels: additionalProperties: type: string + description: |- + ExternalLabels The labels to add to any time series scraped by vmagent. + it doesn't affect metrics ingested directly by push API's type: object extraArgs: additionalProperties: type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp type: object extraEnvs: + description: ExtraEnvs that will be passed to the application container items: + description: EnvVar represents an environment variable present in + a Container. properties: name: + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string required: - name @@ -4429,241 +2103,330 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap items: + description: EnvFromSource represents the source of a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap must be defined type: boolean type: object x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret must be defined type: boolean type: object x-kubernetes-map-type: atomic type: object type: array - globalScrapeMetricRelabelConfigs: - items: - properties: - action: - type: string - if: - x-kubernetes-preserve-unknown-fields: true - labels: - additionalProperties: - type: string - type: object - match: - type: string - modulus: - format: int64 - type: integer - regex: - x-kubernetes-preserve-unknown-fields: true - replacement: - type: string - separator: - type: string - source_labels: - items: - type: string - type: array - sourceLabels: - items: - type: string - type: array - target_label: - type: string - targetLabel: - type: string - type: object - type: array - globalScrapeRelabelConfigs: - items: - properties: - action: - type: string - if: - x-kubernetes-preserve-unknown-fields: true - labels: - additionalProperties: - type: string - type: object - match: - type: string - modulus: - format: int64 - type: integer - regex: - x-kubernetes-preserve-unknown-fields: true - replacement: - type: string - separator: - type: string - source_labels: - items: - type: string - type: array - sourceLabels: - items: - type: string - type: array - target_label: - type: string - targetLabel: - type: string - type: object - type: array host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace type: boolean ignoreNamespaceSelectors: + description: |- + IgnoreNamespaceSelectors if set to true will ignore NamespaceSelector settings from + scrape objects, and they will only discover endpoints + within their current namespace. Defaults to false. type: boolean image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config properties: pullPolicy: + description: PullPolicy describes how to pull docker image type: string repository: + description: Repository contains name of docker image + it's repository + if needed type: string tag: + description: Tag contains desired docker image version type: string type: object imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic type: array ingestOnlyMode: + description: |- + IngestOnlyMode switches vmagent into unmanaged mode + it disables any config generation for scraping + Currently it prevents vmagent from managing tls and auth options for remote write type: boolean initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array inlineRelabelConfig: + description: InlineRelabelConfig - defines GlobalRelabelConfig for + vmagent, can be defined directly at CRD. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array inlineScrapeConfig: + description: |- + InlineScrapeConfig As scrape configs are appended, the user is responsible to make sure it + is valid. Note that using this feature may expose the possibility to + break upgrades of VMAgent. It is advised to review VMAgent release + notes to ensure that no incompatible scrape configs are going to break + VMAgent after the upgrade. + it should be defined as single yaml file. + inlineScrapeConfig: | + - job_name: "prometheus" + static_configs: + - targets: ["localhost:9090"] type: string insertPorts: + description: InsertPorts - additional listen ports for data ingestion. properties: graphitePort: + description: GraphitePort listen port type: string influxPort: + description: InfluxPort listen port type: string openTSDBHTTPPort: + description: OpenTSDBHTTPPort for http connections. type: string openTSDBPort: + description: OpenTSDBPort for tcp and udp listen type: string type: object license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) properties: forceOffline: + description: Enforce offline verification of the license key. type: boolean key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) type: string keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. type: string type: object livenessProbe: + description: LivenessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true logFormat: + description: LogFormat for VMAgent to be configured with. enum: - default - json type: string logLevel: + description: |- + LogLevel for VMAgent to be configured with. + INFO, WARN, ERROR, FATAL, PANIC enum: - INFO - WARN @@ -4672,33 +2435,76 @@ spec: - PANIC type: string managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object type: object maxScrapeInterval: + description: |- + MaxScrapeInterval allows limiting maximum scrape interval for VMServiceScrape, VMPodScrape and other scrapes + If interval is higher than defined limit, `maxScrapeInterval` will be used. type: string minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle format: int32 type: integer minScrapeInterval: + description: |- + MinScrapeInterval allows limiting minimal scrape interval for VMServiceScrape, VMPodScrape and other scrapes + If interval is lower than defined limit, `minScrapeInterval` will be used. type: string nodeScrapeNamespaceSelector: + description: |- + NodeScrapeNamespaceSelector defines Namespaces to be selected for VMNodeScrape discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4712,55 +2518,122 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic nodeScrapeRelabelTemplate: + description: |- + NodeScrapeRelabelTemplate defines relabel config, that will be added to each VMNodeScrape. + it's useful for adding specific labels to all targets items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array nodeScrapeSelector: + description: |- + NodeScrapeSelector defines VMNodeScrape to be selected for scraping. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4774,71 +2647,127 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic nodeSelector: additionalProperties: type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. type: object overrideHonorLabels: + description: |- + OverrideHonorLabels if set to true overrides all user configured honor_labels. + If HonorLabels is set in scrape objects to true, this overrides honor_labels to false. type: boolean overrideHonorTimestamps: + description: OverrideHonorTimestamps allows to globally enforce honoring + timestamps in all scrape configs. type: boolean paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: - type: string - whenScaled: - type: string - type: object podDisruptionBudget: + description: PodDisruptionBudget created by operator properties: maxUnavailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". x-kubernetes-int-or-string: true minAvailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". x-kubernetes-int-or-string: true selectorLabels: additionalProperties: type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string type: object podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the vmagent pods. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object podScrapeNamespaceSelector: + description: |- + PodScrapeNamespaceSelector defines Namespaces to be selected for VMPodScrape discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4852,55 +2781,122 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic podScrapeRelabelTemplate: + description: |- + PodScrapeRelabelTemplate defines relabel config, that will be added to each VMPodScrape. + it's useful for adding specific labels to all targets items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array podScrapeSelector: + description: |- + PodScrapeSelector defines PodScrapes to be selected for target discovery. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4914,23 +2910,50 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic port: + description: Port listen address type: string priorityClassName: + description: PriorityClassName class assigned to the Pods type: string probeNamespaceSelector: + description: |- + ProbeNamespaceSelector defines Namespaces to be selected for VMProbe discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4944,55 +2967,122 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic probeScrapeRelabelTemplate: + description: |- + ProbeScrapeRelabelTemplate defines relabel config, that will be added to each VMProbeScrape. + it's useful for adding specific labels to all targets items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array probeSelector: + description: |- + ProbeSelector defines VMProbe to be selected for target probing. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -5006,77 +3096,121 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic readinessGates: + description: ReadinessGates defines pod readiness gates items: + description: PodReadinessGate contains the reference to a pod condition properties: conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. type: string required: - conditionType type: object type: array readinessProbe: + description: ReadinessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true relabelConfig: + description: |- + RelabelConfig ConfigMap with global relabel config -remoteWrite.relabelConfig + This relabeling is applied to all the collected metrics before sending them to remote storage. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic remoteWrite: + description: |- + RemoteWrite list of victoria metrics /some other remote write system + for vm it must looks like: http://victoria-metrics-single:8429/api/v1/write + or for cluster different url + https://github.com/VictoriaMetrics/VictoriaMetrics/tree/master/app/vmagent#splitting-data-streams-among-multiple-systems items: + description: VMAgentRemoteWriteSpec defines the remote storage configuration + for VmAgent properties: - aws: - properties: - ec2Endpoint: - type: string - region: - type: string - roleARN: - type: string - service: - type: string - stsEndpoint: - type: string - useSigv4: - type: boolean - type: object basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -5084,87 +3218,175 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic forceVMProto: + description: ForceVMProto forces using VictoriaMetrics protocol + for sending data to -remoteWrite.url type: boolean headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName: headerValue + vmagent supports since 1.79.0 version items: type: string type: array inlineUrlRelabelConfig: + description: InlineUrlRelabelConfig defines relabeling config + for remoteWriteURL, it can be defined at crd spec. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source + label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array maxDiskUsage: + description: |- + MaxDiskUsage defines the maximum file-based buffer size in bytes for the given remoteWrite + It overrides global configuration defined at remoteWriteSettings.maxDiskUsagePerURL x-kubernetes-preserve-unknown-fields: true oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 + client id properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -5172,187 +3394,385 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret + file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: - client_id - token_url type: object - proxyURL: - type: string sendTimeout: + description: Timeout for sending a single block of data to -remoteWrite.url + (default 1m0s) pattern: '[0-9]+(ms|s|m|h)' type: string streamAggrConfig: + description: StreamAggrConfig defines stream aggregation configuration + for VMAgent for -remoteWrite.url properties: configmap: + description: ConfigMap with stream aggregation rules properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic dedupInterval: + description: Allows setting different de-duplication intervals + per each configured remote storage type: string dropInput: + description: Allow drop all the input samples after the + aggregation type: boolean dropInputLabels: + description: labels to drop from samples for aggregator + before stream de-duplication and aggregation items: type: string type: array enableWindows: + description: EnableWindows enables aggregating data in separate + windows ( available from v0.54.0). type: boolean ignoreFirstIntervals: + description: IgnoreFirstIntervals instructs to ignore first + interval type: integer - ignoreFirstSampleInterval: - type: string ignoreOldSamples: + description: IgnoreOldSamples instructs to ignore samples + with old timestamps outside the current aggregation interval. type: boolean keepInput: + description: Allows writing both raw and aggregate data type: boolean rules: + description: Stream aggregation rules items: + description: StreamAggrRule defines the rule in stream + aggregation config properties: by: + description: |- + By is an optional list of labels for grouping input series. + + See also Without. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. items: type: string type: array dedup_interval: + description: DedupInterval is an optional interval + for deduplication. type: string drop_input_labels: + description: |- + DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples. + + Labels are dropped before de-duplication and aggregation. items: type: string type: array enable_windows: + description: EnableWindows enables aggregating data + in separate windows type: boolean flush_on_shutdown: + description: |- + FlushOnShutdown defines whether to flush the aggregation state on process termination + or config reload. Is `false` by default. + It is not recommended changing this setting, unless unfinished aggregations states + are preferred to missing data points. type: boolean ignore_first_intervals: type: integer ignore_old_samples: + description: IgnoreOldSamples instructs to ignore + samples with old timestamps outside the current + aggregation interval. type: boolean - ignoreFirstSampleInterval: - type: string input_relabel_configs: + description: |- + InputRelabelConfigs is an optional relabeling rules, which are applied on the input + before aggregation. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex + matching. Default is 'replace' type: string if: + description: 'If represents metricsQL match + expression (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match + for `action: graphite`' type: object match: + description: 'Match is used together with Labels + for `action: graphite`' type: string modulus: + description: Modulus to take of the hash of + the source label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated + source label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array interval: + description: Interval is the interval between aggregations. type: string keep_metric_names: + description: KeepMetricNames instructs to leave metric + names as is for the output time series without adding + any suffix. type: boolean match: + description: |- + Match is a label selector (or list of label selectors) for filtering time series for the given selector. + + If the match isn't set, then all the input time series are processed. x-kubernetes-preserve-unknown-fields: true no_align_flush_to_interval: + description: |- + NoAlignFlushToInterval disables aligning of flushes to multiples of Interval. + By default flushes are aligned to Interval. type: boolean output_relabel_configs: + description: |- + OutputRelabelConfigs is an optional relabeling rules, which are applied + on the aggregated output before being sent to remote storage. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex + matching. Default is 'replace' type: string if: + description: 'If represents metricsQL match + expression (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match + for `action: graphite`' type: object match: + description: 'Match is used together with Labels + for `action: graphite`' type: string modulus: + description: Modulus to take of the hash of + the source label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated + source label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array outputs: + description: |- + Outputs is a list of output aggregate functions to produce. + + The following names are allowed: + + - total - aggregates input counters + - increase - counts the increase over input counters + - count_series - counts the input series + - count_samples - counts the input samples + - sum_samples - sums the input samples + - last - the last biggest sample value + - min - the minimum sample value + - max - the maximum sample value + - avg - the average value across all the samples + - stddev - standard deviation across all the samples + - stdvar - standard variance across all the samples + - histogram_bucket - creates VictoriaMetrics histogram for input samples + - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1] + + The output time series will have the following names: + + input_name:aggr__ items: type: string type: array staleness_interval: + description: |- + Staleness interval is interval after which the series state will be reset if no samples have been sent during it. + The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket. type: string without: + description: |- + Without is an optional list of labels, which must be excluded when grouping input series. + + See also By. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. items: type: string type: array @@ -5363,30 +3783,56 @@ spec: type: array type: object tlsConfig: + description: TLSConfig describes tls configuration for remote + write target properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -5394,30 +3840,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use + for the targets. type: string cert: + description: Struct containing the client cert file for + the targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -5425,37 +3897,67 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object url: + description: URL of the endpoint to send samples to. type: string urlRelabelConfig: + description: ConfigMap with relabeling config which is applied + to metrics before sending them to the corresponding -remoteWrite.url properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key must + be defined type: boolean required: - key @@ -5466,40 +3968,81 @@ spec: type: object type: array remoteWriteSettings: + description: RemoteWriteSettings defines global settings for all remoteWrite + urls. properties: flushInterval: + description: Interval for flushing the data to remote storage. + (default 1s) pattern: '[0-9]+(ms|s|m|h)' type: string label: additionalProperties: type: string + description: Labels in the form 'name=value' to add to all the + metrics before sending them. This overrides the label if it + already exists. type: object maxBlockSize: + description: The maximum size in bytes of unpacked request to + send to remote storage format: int32 type: integer maxDiskUsagePerURL: + description: The maximum file-based buffer size in bytes at -remoteWrite.tmpDataPath x-kubernetes-preserve-unknown-fields: true queues: + description: The number of concurrent queues format: int32 type: integer showURL: + description: Whether to show -remoteWrite.url in the exported + metrics. It is hidden by default, since it can contain sensitive + auth info type: boolean tmpDataPath: + description: Path to directory where temporary data for remote + write component is stored (default vmagent-remotewrite-data) type: string useMultiTenantMode: + description: |- + Configures vmagent accepting data via the same multitenant endpoints as vminsert at VictoriaMetrics cluster does, + see [here](https://docs.victoriametrics.com/vmagent/#multitenancy). + it's global setting and affects all remote storage configurations type: boolean type: object replicaCount: + description: ReplicaCount is the expected size of the Application. format: int32 type: integer resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -5515,6 +4058,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -5523,350 +4069,97 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. format: int32 type: integer rollingUpdate: + description: RollingUpdate - overrides deployment update params. properties: maxSurge: anyOf: - type: integer - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. x-kubernetes-int-or-string: true maxUnavailable: anyOf: - type: integer - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. x-kubernetes-int-or-string: true type: object runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ type: string - sampleLimit: - type: integer schedulerName: + description: SchedulerName - defines kubernetes scheduler name type: string - scrapeClasses: - items: - properties: - attachMetadata: - properties: - namespace: - type: boolean - node: - type: boolean - type: object - authorization: - properties: - credentials: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - credentialsFile: - type: string - type: - type: string - type: object - basicAuth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - password_file: - type: string - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - bearerTokenFile: - type: string - bearerTokenSecret: - nullable: true - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - default: - type: boolean - metricRelabelConfigs: - items: - properties: - action: - type: string - if: - x-kubernetes-preserve-unknown-fields: true - labels: - additionalProperties: - type: string - type: object - match: - type: string - modulus: - format: int64 - type: integer - regex: - x-kubernetes-preserve-unknown-fields: true - replacement: - type: string - separator: - type: string - source_labels: - items: - type: string - type: array - sourceLabels: - items: - type: string - type: array - target_label: - type: string - targetLabel: - type: string - type: object - type: array - name: - minLength: 1 - type: string - oauth2: - properties: - client_id: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - client_secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - client_secret_file: - type: string - endpoint_params: - additionalProperties: - type: string - type: object - proxy_url: - type: string - scopes: - items: - type: string - type: array - tls_config: - x-kubernetes-preserve-unknown-fields: true - token_url: - minLength: 1 - type: string - required: - - client_id - - token_url - type: object - relabelConfigs: - items: - properties: - action: - type: string - if: - x-kubernetes-preserve-unknown-fields: true - labels: - additionalProperties: - type: string - type: object - match: - type: string - modulus: - format: int64 - type: integer - regex: - x-kubernetes-preserve-unknown-fields: true - replacement: - type: string - separator: - type: string - source_labels: - items: - type: string - type: array - sourceLabels: - items: - type: string - type: array - target_label: - type: string - targetLabel: - type: string - type: object - type: array - tlsConfig: - properties: - ca: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - caFile: - type: string - cert: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - certFile: - type: string - insecureSkipVerify: - type: boolean - keyFile: - type: string - keySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - serverName: - type: string - type: object - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map scrapeConfigNamespaceSelector: + description: |- + ScrapeConfigNamespaceSelector defines Namespaces to be selected for VMScrapeConfig discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -5880,55 +4173,119 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic scrapeConfigRelabelTemplate: + description: |- + ScrapeConfigRelabelTemplate defines relabel config, that will be added to each VMScrapeConfig. + it's useful for adding specific labels to all targets items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array scrapeConfigSelector: + description: |- + ScrapeConfigSelector defines VMScrapeConfig to be selected for target discovery. + Works in combination with NamespaceSelector. properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -5942,36 +4299,77 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic scrapeInterval: + description: ScrapeInterval defines how often scrape targets by default pattern: '[0-9]+(ms|s|m|h)' type: string scrapeTimeout: + description: ScrapeTimeout defines global timeout for targets scrape pattern: '[0-9]+(ms|s|m|h)' type: string secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder items: type: string type: array securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. type: object x-kubernetes-preserve-unknown-fields: true selectAllByDefault: + description: |- + SelectAllByDefault changes default behavior for empty CRD selectors, such ServiceScrapeSelector. + with selectAllByDefault: true and empty serviceScrapeSelector and ServiceScrapeNamespaceSelector + Operator selects all exist serviceScrapes + with selectAllByDefault: false - selects nothing type: boolean serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods type: string serviceScrapeNamespaceSelector: + description: |- + ServiceScrapeNamespaceSelector Namespaces to be selected for VMServiceScrape discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -5985,55 +4383,122 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic serviceScrapeRelabelTemplate: + description: |- + ServiceScrapeRelabelTemplate defines relabel config, that will be added to each VMServiceScrape. + it's useful for adding specific labels to all targets items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array serviceScrapeSelector: + description: |- + ServiceScrapeSelector defines ServiceScrapes to be selected for target discovery. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -6047,101 +4512,209 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmagent VMServiceScrape + spec required: - endpoints type: object x-kubernetes-preserve-unknown-fields: true serviceSpec: + description: ServiceSpec that will be added to vmagent service spec properties: metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ type: object x-kubernetes-preserve-unknown-fields: true useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication type: boolean required: - spec type: object shardCount: - format: int32 + description: |- + ShardCount - numbers of shards of VMAgent + in this case operator will use 1 deployment/sts per shard with + replicas count according to spec.replicas, + see [here](https://docs.victoriametrics.com/vmagent/#scraping-big-number-of-targets) type: integer startupProbe: + description: StartupProbe that will be added to CRD pod type: object x-kubernetes-preserve-unknown-fields: true statefulMode: + description: |- + StatefulMode enables StatefulSet for `VMAgent` instead of Deployment + it allows using persistent storage for vmagent's persistentQueue type: boolean statefulRollingUpdateStrategy: + description: |- + StatefulRollingUpdateStrategy allows configuration for strategyType + set it to RollingUpdate for disabling operator statefulSet rollingUpdate type: string - statefulRollingUpdateStrategyBehavior: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object statefulStorage: + description: StatefulStorage configures storage for StatefulSet properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir properties: medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string sizeLimit: anyOf: - type: integer - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: + description: EmbeddedMetadata contains metadata relevant to + an EmbeddedResource. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object spec: + description: |- + Spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string required: - kind @@ -6149,20 +4722,60 @@ spec: type: object x-kubernetes-map-type: atomic dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. type: string required: - kind - name type: object resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: limits: additionalProperties: @@ -6171,6 +4784,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -6179,18 +4795,40 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object selector: + description: selector is a label query over volumes to + consider for binding. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -6204,28 +4842,100 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. type: string volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. type: string type: object status: + description: |- + Status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic allocatedResourceStatuses: additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. type: string + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage - + the capacity of the volume.\n\t* Custom resources must + use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have + kubernetes.io prefix are considered\nreserved and hence + may not be used.\n\nClaimResourceStatus can be in any + of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with + a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing the + volume but further resizing of\n\t\tvolume is needed + on the node.\n\t- NodeResizeInProgress:\n\t\tState set + when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this + field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress for + the given PVC.\n\nA controller that receives PVC update + with previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for + resizing capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." type: object x-kubernetes-map-type: granular allocatedResources: @@ -6235,6 +4945,31 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage - + the capacity of the volume.\n\t* Custom resources must + use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have + kubernetes.io prefix are considered\nreserved and hence + may not be used.\n\nCapacity reported here may be larger + than the actual capacity when a volume expansion operation\nis + requested.\nFor storage quota, the larger value from + allocatedResources and PVC.spec.resources is used.\nIf + allocatedResources is not set, PVC.spec.resources alone + is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and + if the actual volume capacity\nis equal or lower than + the requested capacity.\n\nA controller that receives + PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for + resizing capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." type: object capacity: additionalProperties: @@ -6243,23 +4978,47 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. type: object conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. items: + description: PersistentVolumeClaimCondition contains + details about state of pvc properties: lastProbeTime: + description: lastProbeTime is the time we probed + the condition. format: date-time type: string lastTransitionTime: + description: lastTransitionTime is the time the + condition transitioned from one status to another. format: date-time type: string message: + description: message is the human-readable message + indicating details about last transition. type: string reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. type: string status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required type: string type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about type: string required: - status @@ -6270,31 +5029,76 @@ spec: - type x-kubernetes-list-type: map currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). type: string modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). properties: status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible + indicates that the request has been rejected as + invalid by the CSI driver. To\n\t resolve the error, + a valid VolumeAttributesClass needs to be specified.\nNote: + New statuses can be added in the future. Consumers + should check for unknown statuses and fail appropriately." type: string targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled type: string required: - status type: object phase: + description: phase represents the current phase of PersistentVolumeClaim. type: string type: object type: object type: object staticScrapeNamespaceSelector: + description: |- + StaticScrapeNamespaceSelector defines Namespaces to be selected for VMStaticScrape discovery. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -6308,55 +5112,122 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic staticScrapeRelabelTemplate: + description: |- + StaticScrapeRelabelTemplate defines relabel config, that will be added to each VMStaticScrape. + it's useful for adding specific labels to all targets items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array staticScrapeSelector: + description: |- + StaticScrapeSelector defines VMStaticScrape to be selected for target discovery. + Works in combination with NamespaceSelector. + If both nil - match everything. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -6370,152 +5241,325 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic streamAggrConfig: + description: StreamAggrConfig defines global stream aggregation configuration + for VMAgent properties: configmap: + description: ConfigMap with stream aggregation rules properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic dedupInterval: + description: Allows setting different de-duplication intervals + per each configured remote storage type: string dropInput: + description: Allow drop all the input samples after the aggregation type: boolean dropInputLabels: + description: labels to drop from samples for aggregator before + stream de-duplication and aggregation items: type: string type: array enableWindows: + description: EnableWindows enables aggregating data in separate + windows ( available from v0.54.0). type: boolean ignoreFirstIntervals: + description: IgnoreFirstIntervals instructs to ignore first interval type: integer - ignoreFirstSampleInterval: - type: string ignoreOldSamples: + description: IgnoreOldSamples instructs to ignore samples with + old timestamps outside the current aggregation interval. type: boolean keepInput: + description: Allows writing both raw and aggregate data type: boolean rules: + description: Stream aggregation rules items: + description: StreamAggrRule defines the rule in stream aggregation + config properties: by: + description: |- + By is an optional list of labels for grouping input series. + + See also Without. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. items: type: string type: array dedup_interval: + description: DedupInterval is an optional interval for deduplication. type: string drop_input_labels: + description: |- + DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples. + + Labels are dropped before de-duplication and aggregation. items: type: string type: array enable_windows: + description: EnableWindows enables aggregating data in separate + windows type: boolean flush_on_shutdown: + description: |- + FlushOnShutdown defines whether to flush the aggregation state on process termination + or config reload. Is `false` by default. + It is not recommended changing this setting, unless unfinished aggregations states + are preferred to missing data points. type: boolean ignore_first_intervals: type: integer ignore_old_samples: + description: IgnoreOldSamples instructs to ignore samples + with old timestamps outside the current aggregation interval. type: boolean - ignoreFirstSampleInterval: - type: string input_relabel_configs: + description: |- + InputRelabelConfigs is an optional relabeling rules, which are applied on the input + before aggregation. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for + `action: graphite`' type: object match: + description: 'Match is used together with Labels for + `action: graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated + source label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array interval: + description: Interval is the interval between aggregations. type: string keep_metric_names: + description: KeepMetricNames instructs to leave metric names + as is for the output time series without adding any suffix. type: boolean match: + description: |- + Match is a label selector (or list of label selectors) for filtering time series for the given selector. + + If the match isn't set, then all the input time series are processed. x-kubernetes-preserve-unknown-fields: true no_align_flush_to_interval: + description: |- + NoAlignFlushToInterval disables aligning of flushes to multiples of Interval. + By default flushes are aligned to Interval. type: boolean output_relabel_configs: + description: |- + OutputRelabelConfigs is an optional relabeling rules, which are applied + on the aggregated output before being sent to remote storage. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for + `action: graphite`' type: object match: + description: 'Match is used together with Labels for + `action: graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated + source label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array outputs: + description: |- + Outputs is a list of output aggregate functions to produce. + + The following names are allowed: + + - total - aggregates input counters + - increase - counts the increase over input counters + - count_series - counts the input series + - count_samples - counts the input samples + - sum_samples - sums the input samples + - last - the last biggest sample value + - min - the minimum sample value + - max - the maximum sample value + - avg - the average value across all the samples + - stddev - standard deviation across all the samples + - stdvar - standard variance across all the samples + - histogram_bucket - creates VictoriaMetrics histogram for input samples + - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1] + + The output time series will have the following names: + + input_name:aggr__ items: type: string type: array staleness_interval: + description: |- + Staleness interval is interval after which the series state will be reset if no samples have been sent during it. + The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket. type: string without: + description: |- + Without is an optional list of labels, which must be excluded when grouping input series. + + See also By. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. items: type: string type: array @@ -6526,26 +5570,58 @@ spec: type: array type: object terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination format: int64 type: integer tolerations: + description: Tolerations If specified, the pod's tolerations. items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . properties: effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. required: - maxSkew - topologyKey @@ -6554,34 +5630,97 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array updateStrategy: + description: |- + UpdateStrategy - overrides default update strategy. + works only for deployments, statefulset always use OnDelete. enum: - Recreate - RollingUpdate type: string useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements type: boolean useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions type: boolean useVMConfigReloader: + description: |- + UseVMConfigReloader replaces prometheus-like config-reloader + with vm one. It uses secrets watch instead of file watch + which greatly increases speed of config updates type: boolean vmAgentExternalLabelName: + description: |- + VMAgentExternalLabelName Name of vmAgent external label used to denote vmAgent instance + name. Defaults to the value of `prometheus`. External label will + _not_ be added when value is set to empty string (`""`). type: string volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container items: + description: VolumeMount describes a mounting of a Volume within + a container. properties: mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. type: string mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. type: boolean recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. type: string subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -6589,7 +5728,13 @@ spec: type: object type: array volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. required: - name type: object @@ -6599,34 +5744,58 @@ spec: - remoteWrite type: object status: + description: VMAgentStatus defines the observed state of VMAgent properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -6641,19 +5810,28 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string replicas: + description: ReplicaCount Total number of pods targeted by this VMAgent format: int32 type: integer selector: + description: Selector string form of label value set for autoscaling type: string shards: + description: Shards represents total number of vmagent deployments + with uniq scrape targets format: int32 type: integer updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -6670,7 +5848,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmalertmanagerconfigs.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -6694,90 +5872,180 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMAlertmanagerConfig is the Schema for the vmalertmanagerconfigs + API properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: |- + VMAlertmanagerConfigSpec defines configuration for VMAlertmanagerConfig + it must reference only locally defined objects properties: inhibit_rules: + description: |- + InhibitRules will only apply for alerts matching + the resource's namespace. items: + description: |- + InhibitRule defines an inhibition rule that allows to mute alerts when other + alerts are already firing. + Note, it doesn't support deprecated alertmanager config options. + See https://prometheus.io/docs/alerting/latest/configuration/#inhibit_rule properties: equal: + description: |- + Labels that must have an equal value in the source and target alert for + the inhibition to take effect. items: type: string type: array source_matchers: + description: |- + SourceMatchers defines a list of matchers for which one or more alerts have + to exist for the inhibition to take effect. items: type: string type: array target_matchers: + description: |- + TargetMatchers defines a list of matchers that have to be fulfilled by the target + alerts to be muted. items: type: string type: array type: object type: array receivers: + description: Receivers defines alert receivers items: + description: Receiver defines one or more notification integrations. properties: discord_configs: items: properties: avatar_url: + description: |- + AvatarURL defines message avatar URL + Available from operator v0.55.0 and alertmanager v0.28.0 type: string content: + description: |- + Content defines message content template + Available from operator v0.55.0 and alertmanager v0.28.0 maxLength: 2000 type: string http_config: + description: HTTP client configuration. properties: authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. properties: credentials: + description: Reference to the secret with value + for authorization properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to + bearer type: string type: object basic_auth: + description: BasicAuth for the client. properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key @@ -6785,45 +6053,88 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. type: string bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. properties: client_id: + description: The secret or configmap containing + the OAuth2 client id properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -6831,33 +6142,60 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 + client secret properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for + client secret file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token + URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token + request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -6865,32 +6203,60 @@ spec: - token_url type: object proxyURL: + description: Optional proxy URL. type: string tls_config: + description: TLS configuration for the client. properties: ca: + description: Struct containing the CA cert to + use for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -6898,30 +6264,58 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container + to use for the targets. type: string cert: + description: Struct containing the client cert + file for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -6929,46 +6323,89 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the + container for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the + container for the targets. type: string keySecret: + description: Secret containing the client key + file for the targets. properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the + targets. type: string type: object type: object message: + description: The message body template type: string send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean title: + description: The message title template type: string username: + description: |- + Username defines message username + Available from operator v0.55.0 and alertmanager v0.28.0 type: string webhook_url: + description: |- + The discord webhook URL + one of `urlSecret` and `url` must be defined. type: string webhook_url_secret: + description: |- + URLSecret defines secret name and key at the CRD namespace. + It must contain the webhook URL. + one of `urlSecret` and `url` must be defined. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -6977,81 +6414,153 @@ spec: type: object type: array email_configs: + description: EmailConfigs defines email notification configurations. items: + description: EmailConfig configures notifications via Email. properties: auth_identity: + description: The identity to use for authentication. type: string auth_password: + description: AuthPassword defines secret name and key + at CRD namespace. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic auth_secret: + description: |- + AuthSecret defines secrent name and key at CRD namespace. + It must contain the CRAM-MD5 secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic auth_username: + description: The username to use for authentication. type: string from: + description: |- + The sender address. + fallback to global setting if empty type: string headers: additionalProperties: type: string + description: |- + Further headers email header key/value pairs. Overrides any headers + previously set by the notification implementation. type: object hello: + description: The hostname to identify to the SMTP server. type: string html: + description: The HTML body of the email notification. type: string require_tls: + description: |- + The SMTP TLS requirement. + Note that Go does not support unencrypted connections to remote SMTP endpoints. type: boolean send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean smarthost: + description: |- + The SMTP host through which emails are sent. + fallback to global setting if empty type: string text: + description: The text body of the email notification. type: string tls_config: + description: TLS configuration properties: ca: + description: Struct containing the CA cert to use + for the targets. properties: configMap: + description: ConfigMap containing data to use + for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for + the targets. properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key @@ -7059,30 +6568,57 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container + to use for the targets. type: string cert: + description: Struct containing the client cert file + for the targets. properties: configMap: + description: ConfigMap containing data to use + for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for + the targets. properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key @@ -7090,94 +6626,121 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file + for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object to: - type: string - type: object - type: array - incidentio_configs: - items: - properties: - alert_source_token: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - http_config: - x-kubernetes-preserve-unknown-fields: true - max_alerts: - type: integer - send_resolved: - type: boolean - timeout: - type: string - url: + description: The email address to send notifications to. type: string type: object type: array jira_configs: items: + description: |- + JiraConfig represent alertmanager's jira_config entry + https://prometheus.io/docs/alerting/latest/configuration/#jira_config + available from v0.55.0 operator version + and v0.28.0 alertmanager version properties: api_url: + description: |- + The URL to send API requests to. The full API path must be included. + Example: https://company.atlassian.net/rest/api/2/ type: string custom_fields: additionalProperties: x-kubernetes-preserve-unknown-fields: true + description: |- + Other issue and custom fields. + Jira issue field can have multiple types. + Depends on the field type, the values must be provided differently. + See https://developer.atlassian.com/server/jira/platform/jira-rest-api-examples/#setting-custom-field-data-for-other-field-types for further examples. type: object description: + description: Issue description template. type: string http_config: + description: |- + The HTTP client's configuration. You must use this configuration to supply the personal access token (PAT) as part of the HTTP `Authorization` header. + For Jira Cloud, use basic_auth with the email address as the username and the PAT as the password. + For Jira Data Center, use the 'authorization' field with 'credentials: '. x-kubernetes-preserve-unknown-fields: true issue_type: + description: Type of the issue (e.g. Bug) type: string labels: + description: Labels to be added to the issue items: type: string type: array priority: + description: Priority of the issue type: string project: + description: The project key where issues are created type: string reopen_duration: + description: |- + If reopen_transition is defined, reopen the issue when it is not older than this value (rounded down to the nearest minute). + The resolutiondate field is used to determine the age of the issue. pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ type: string reopen_transition: + description: |- + Name of the workflow transition to resolve an issue. + The target status must have the category "done". type: string resolve_transition: + description: |- + Name of the workflow transition to reopen an issue. + The target status should not have the category "done". type: string send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean summary: + description: Issue summary template type: string wont_fix_resolution: + description: If reopen_transition is defined, ignore issues + with that resolution. type: string required: - issue_type @@ -7188,52 +6751,101 @@ spec: items: properties: http_config: + description: HTTP client configuration. properties: authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. properties: credentials: + description: Reference to the secret with value + for authorization properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to + bearer type: string type: object basic_auth: + description: BasicAuth for the client. properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key @@ -7241,45 +6853,88 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. type: string bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. properties: client_id: + description: The secret or configmap containing + the OAuth2 client id properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -7287,33 +6942,60 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 + client secret properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for + client secret file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token + URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token + request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -7321,32 +7003,60 @@ spec: - token_url type: object proxyURL: + description: Optional proxy URL. type: string tls_config: + description: TLS configuration for the client. properties: ca: + description: Struct containing the CA cert to + use for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -7354,30 +7064,58 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container + to use for the targets. type: string cert: + description: Struct containing the client cert + file for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -7385,44 +7123,84 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the + container for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the + container for the targets. type: string keySecret: + description: Secret containing the client key + file for the targets. properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the + targets. type: string type: object type: object send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean text: + description: The text body of the teams notification. type: string title: + description: The title of the teams notification. type: string webhook_url: + description: |- + The incoming webhook URL + one of `urlSecret` and `url` must be defined. type: string webhook_url_secret: + description: |- + URLSecret defines secret name and key at the CRD namespace. + It must contain the webhook URL. + one of `urlSecret` and `url` must be defined. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -7432,25 +7210,51 @@ spec: type: array msteamsv2_configs: items: + description: |- + MSTeamsV2Config sends notifications using the new message format with adaptive cards as required by flows. + https://support.microsoft.com/en-gb/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498 + available from v0.55.0 operator version + and v0.28.0 alertmanager version properties: http_config: x-kubernetes-preserve-unknown-fields: true send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean text: + description: Message body template. type: string title: + description: Message title template. type: string webhook_url: + description: |- + The incoming webhook URL + one of `urlSecret` and `url` must be defined. type: string webhook_url_secret: + description: |- + URLSecret defines secret name and key at the CRD namespace. + It must contain the webhook URL. + one of `webhook_url` or `webhook_url_secret` must be defined. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -7459,95 +7263,165 @@ spec: type: object type: array name: + description: Name of the receiver. Must be unique across all + items from the list. minLength: 1 type: string opsgenie_configs: + description: OpsGenieConfigs defines ops genie notification + configurations. items: + description: |- + OpsGenieConfig configures notifications via OpsGenie. + See https://prometheus.io/docs/alerting/latest/configuration/#opsgenie_config properties: actions: + description: Comma separated list of actions that will + be available for the alert. type: string api_key: + description: |- + The secret's key that contains the OpsGenie API key. + It must be at them same namespace as CRD + fallback to global setting if empty properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic apiURL: + description: The URL to send OpsGenie API requests to. type: string description: + description: Description of the incident. type: string details: additionalProperties: type: string + description: A set of arbitrary key/value pairs that provide + further detail about the incident. type: object entity: + description: Optional field that can be used to specify + which domain alert is related to. type: string http_config: + description: HTTP client configuration. type: object x-kubernetes-preserve-unknown-fields: true message: + description: Alert text limited to 130 characters. type: string note: + description: Additional alert note. type: string priority: + description: Priority level of alert. Possible values + are P1, P2, P3, P4, and P5. type: string responders: + description: List of responders responsible for notifications. items: + description: |- + OpsGenieConfigResponder defines a responder to an incident. + One of `id`, `name` or `username` has to be defined. properties: id: + description: ID of the responder. type: string name: + description: Name of the responder. type: string type: + description: Type of responder. minLength: 1 type: string username: + description: Username of the responder. type: string required: - type type: object type: array send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean source: + description: Backlink to the sender of the notification. type: string tags: + description: Comma separated list of tags attached to + the notifications. type: string update_alerts: + description: |- + Whether to update message and description of the alert in OpsGenie if it already exists + By default, the alert is never updated in OpsGenie, the new message only appears in activity log. type: boolean type: object type: array pagerduty_configs: + description: PagerDutyConfigs defines pager duty notification + configurations. items: + description: |- + PagerDutyConfig configures notifications via PagerDuty. + See https://prometheus.io/docs/alerting/latest/configuration/#pagerduty_config properties: class: + description: The class/type of the event. type: string client: + description: Client identification. type: string client_url: + description: Backlink to the sender of notification. type: string component: + description: The part or component of the affected system + that is broken. type: string description: + description: Description of the incident. type: string details: additionalProperties: type: string + description: Arbitrary key/value pairs that provide further + detail about the incident. type: object group: + description: A cluster or grouping of sources. type: string http_config: + description: HTTP client configuration. type: object x-kubernetes-preserve-unknown-fields: true images: + description: Images to attach to the incident. items: + description: |- + ImageConfig is used to attach images to the incident. + See https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event#the-images-property + for more information. properties: alt: type: string @@ -7560,7 +7434,12 @@ spec: type: object type: array links: + description: Links to attach to the incident. items: + description: |- + LinkConfig is used to attach text links to the incident. + See https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event#the-links-property + for more information. properties: href: type: string @@ -7571,86 +7450,170 @@ spec: type: object type: array routing_key: + description: |- + The secret's key that contains the PagerDuty integration key (when using + Events API v2). Either this field or `serviceKey` needs to be defined. + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean service_key: + description: |- + The secret's key that contains the PagerDuty service key (when using + integration type "Prometheus"). Either this field or `routingKey` needs to + be defined. + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic severity: + description: Severity of the incident. type: string url: + description: The URL to send requests to. type: string type: object type: array pushover_configs: + description: PushoverConfigs defines push over notification + configurations. items: + description: |- + PushoverConfig configures notifications via Pushover. + See https://prometheus.io/docs/alerting/latest/configuration/#pushover_config properties: expire: + description: |- + How long your notification will continue to be retried for, unless the user + acknowledges the notification. type: string html: + description: Whether notification message is HTML or plain + text. type: boolean http_config: + description: HTTP client configuration. type: object x-kubernetes-preserve-unknown-fields: true message: + description: Notification message. type: string priority: + description: Priority, see https://pushover.net/api#priority type: string retry: + description: |- + How often the Pushover servers will send the same notification to the user. + Must be at least 30 seconds. type: string send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean sound: + description: The name of one of the sounds supported by + device clients to override the user's default sound + choice type: string title: + description: Notification title. type: string token: + description: |- + The secret's key that contains the registered application’s API token, see https://pushover.net/apps. + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic url: + description: A supplementary URL shown alongside the message. type: string url_title: + description: A title for supplementary URL, otherwise + just the URL is shown type: string user_key: + description: |- + The secret's key that contains the recipient user’s user key. + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -7660,9 +7623,17 @@ spec: type: array rocketchat_configs: items: + description: |- + RocketchatConfig configures notifications via Rocketchat. + https://prometheus.io/docs/alerting/latest/configuration/#rocketchat_config + available from v0.55.0 operator version + and v0.28.0 alertmanager version properties: actions: items: + description: |- + RocketchatAttachmentAction defines message attachements + https://github.com/RocketChat/Rocket.Chat.Go.SDK/blob/master/models/message.go properties: msg: type: string @@ -7677,6 +7648,8 @@ spec: api_url: type: string channel: + description: 'RocketChat channel override, (like #other-channel + or @username).' type: string color: type: string @@ -7684,6 +7657,9 @@ spec: type: string fields: items: + description: |- + RocketchatAttachmentField defines API fields + https://developer.rocket.chat/reference/api/rest-api/endpoints/messaging/chat-endpoints/postmessage#attachment-field-objects properties: short: type: boolean @@ -7702,6 +7678,8 @@ spec: link_names: type: boolean send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean short_fields: type: boolean @@ -7714,26 +7692,50 @@ spec: title_link: type: string token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic token_id: + description: |- + The sender token and token_id + See https://docs.rocket.chat/use-rocket.chat/user-guides/user-panel/my-account#personal-access-tokens properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -7742,12 +7744,29 @@ spec: type: object type: array slack_configs: + description: SlackConfigs defines slack notification configurations. items: + description: |- + SlackConfig configures notifications via Slack. + See https://prometheus.io/docs/alerting/latest/configuration/#slack_config properties: actions: + description: A list of Slack actions that are sent with + each notification. items: + description: |- + SlackAction configures a single Slack action that is sent with each + notification. + See https://api.slack.com/docs/message-attachments#action_fields and + https://api.slack.com/docs/message-buttons for more information. properties: confirm: + description: |- + SlackConfirmationField protect users from destructive actions or + particularly distinguished decisions by asking them to confirm their button + click one more time. + See https://api.slack.com/docs/interactive-message-field-guide#confirmation_fields + for more information. properties: dismiss_text: type: string @@ -7781,13 +7800,27 @@ spec: type: object type: array api_url: + description: |- + The secret's key that contains the Slack webhook URL. + It must be at them same namespace as CRD + fallback to global setting if empty properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -7796,13 +7829,20 @@ spec: callback_id: type: string channel: + description: The channel or user to send notifications + to. type: string color: type: string fallback: type: string fields: + description: A list of Slack fields that are sent with + each notification. items: + description: |- + SlackField configures a single Slack field that is sent with each notification. + See https://api.slack.com/docs/message-attachments#fields for more information. properties: short: type: boolean @@ -7820,6 +7860,7 @@ spec: footer: type: string http_config: + description: HTTP client configuration. type: object x-kubernetes-preserve-unknown-fields: true icon_emoji: @@ -7837,6 +7878,8 @@ spec: pretext: type: string send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean short_fields: type: boolean @@ -7856,58 +7899,109 @@ spec: items: properties: api_url: + description: The api URL type: string attributes: additionalProperties: type: string + description: SNS message attributes type: object http_config: + description: HTTP client configuration. properties: authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. properties: credentials: + description: Reference to the secret with value + for authorization properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to + bearer type: string type: object basic_auth: + description: BasicAuth for the client. properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key @@ -7915,45 +8009,88 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. type: string bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. properties: client_id: + description: The secret or configmap containing + the OAuth2 client id properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -7961,33 +8098,60 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 + client secret properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for + client secret file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token + URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token + request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -7995,32 +8159,60 @@ spec: - token_url type: object proxyURL: + description: Optional proxy URL. type: string tls_config: + description: TLS configuration for the client. properties: ca: + description: Struct containing the CA cert to + use for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8028,30 +8220,58 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container + to use for the targets. type: string cert: + description: Struct containing the client cert + file for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8059,65 +8279,124 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the + container for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the + container for the targets. type: string keySecret: + description: Secret containing the client key + file for the targets. properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the + targets. type: string type: object type: object message: + description: The message content of the SNS notification. type: string phone_number: + description: |- + Phone number if message is delivered via SMS + Specify this, topic_arn or target_arn type: string send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean sigv4: + description: Configure the AWS Signature Verification + 4 signing process properties: access_key: + description: |- + The AWS API keys. Both access_key and secret_key must be supplied or both must be blank. + If blank the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are used. type: string access_key_selector: + description: secret key selector to get the keys from + a Kubernetes Secret properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic profile: + description: Named AWS profile used to authenticate type: string region: + description: AWS region, if blank the region from + the default credentials chain is used type: string role_arn: + description: AWS Role ARN, an alternative to using + AWS API keys type: string secret_key_selector: + description: secret key selector to get the keys from + a Kubernetes Secret properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key @@ -8125,45 +8404,81 @@ spec: x-kubernetes-map-type: atomic type: object subject: + description: The subject line if message is delivered + to an email endpoint. type: string target_arn: + description: |- + Mobile platform endpoint ARN if message is delivered via mobile notifications + Specify this, topic_arn or phone_number type: string topic_arn: + description: SNS topic ARN, either specify this, phone_number + or target_arn type: string type: object type: array telegram_configs: items: + description: |- + TelegramConfig configures notification via telegram + https://prometheus.io/docs/alerting/latest/configuration/#telegram_config properties: api_url: + description: APIUrl the Telegram API URL i.e. https://api.telegram.org. type: string bot_token: + description: |- + BotToken token for the bot + https://core.telegram.org/bots/api properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic chat_id: + description: ChatID is ID of the chat where to send the + messages. type: integer disable_notifications: + description: DisableNotifications type: boolean http_config: + description: HTTP client configuration. type: object x-kubernetes-preserve-unknown-fields: true message: + description: Message is templated message type: string message_thread_id: + description: MessageThreadID defines ID of the message + thread where to send the messages. type: integer parse_mode: + description: |- + ParseMode for telegram message, + supported values are MarkdownV2, Markdown, Markdown and empty string for plain text. type: string send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean required: - bot_token @@ -8171,76 +8486,149 @@ spec: type: object type: array victorops_configs: + description: VictorOpsConfigs defines victor ops notification + configurations. items: + description: |- + VictorOpsConfig configures notifications via VictorOps. + See https://prometheus.io/docs/alerting/latest/configuration/#victorops_config properties: api_key: + description: |- + The secret's key that contains the API key to use when talking to the VictorOps API. + It must be at them same namespace as CRD + fallback to global setting if empty properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic api_url: + description: The VictorOps API URL. type: string custom_fields: additionalProperties: type: string + description: |- + Adds optional custom fields + https://github.com/prometheus/alertmanager/blob/v0.24.0/config/notifiers.go#L537 type: object entity_display_name: + description: Contains summary of the alerted problem. type: string http_config: + description: The HTTP client's configuration. properties: authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. properties: credentials: + description: Reference to the secret with value + for authorization properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to + bearer type: string type: object basic_auth: + description: BasicAuth for the client. properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key @@ -8248,45 +8636,88 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. type: string bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. properties: client_id: + description: The secret or configmap containing + the OAuth2 client id properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8294,33 +8725,60 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 + client secret properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for + client secret file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token + URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token + request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -8328,32 +8786,60 @@ spec: - token_url type: object proxyURL: + description: Optional proxy URL. type: string tls_config: + description: TLS configuration for the client. properties: ca: + description: Struct containing the CA cert to + use for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8361,30 +8847,58 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container + to use for the targets. type: string cert: + description: Struct containing the client cert + file for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8392,37 +8906,65 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the + container for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the + container for the targets. type: string keySecret: + description: Secret containing the client key + file for the targets. properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the + targets. type: string type: object type: object message_type: + description: Describes the behavior of the alert (CRITICAL, + WARNING, INFO). type: string monitoring_tool: + description: The monitoring tool the state message is + from. type: string routing_key: + description: A key used to map the alert to a team. type: string send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean state_message: + description: Contains long explanation of the alerted + problem. type: string required: - routing_key @@ -8432,54 +8974,106 @@ spec: items: properties: api_url: + description: The Webex Teams API URL, i.e. https://webexapis.com/v1/messages type: string http_config: + description: HTTP client configuration. You must use this + configuration to supply the bot token as part of the + HTTP `Authorization` header. properties: authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. properties: credentials: + description: Reference to the secret with value + for authorization properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to + bearer type: string type: object basic_auth: + description: BasicAuth for the client. properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key @@ -8487,45 +9081,88 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. type: string bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. properties: client_id: + description: The secret or configmap containing + the OAuth2 client id properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8533,33 +9170,60 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 + client secret properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for + client secret file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token + URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token + request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -8567,32 +9231,60 @@ spec: - token_url type: object proxyURL: + description: Optional proxy URL. type: string tls_config: + description: TLS configuration for the client. properties: ca: + description: Struct containing the CA cert to + use for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8600,30 +9292,58 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container + to use for the targets. type: string cert: + description: Struct containing the client cert + file for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8631,63 +9351,110 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the + container for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the + container for the targets. type: string keySecret: + description: Secret containing the client key + file for the targets. properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the + targets. type: string type: object type: object message: + description: The message body template type: string room_id: + description: The ID of the Webex Teams room where to send + the messages type: string send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean required: - room_id type: object type: array webhook_configs: + description: WebhookConfigs defines webhook notification configurations. items: + description: |- + WebhookConfig configures notifications via a generic receiver supporting the webhook payload. + See https://prometheus.io/docs/alerting/latest/configuration/#webhook_config properties: http_config: + description: HTTP client configuration. type: object x-kubernetes-preserve-unknown-fields: true max_alerts: + description: Maximum number of alerts to be sent per webhook + message. When 0, all alerts are included. format: int32 minimum: 0 type: integer send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean - timeout: - pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ - type: string url: + description: |- + URL to send requests to, + one of `urlSecret` and `url` must be defined. type: string url_secret: + description: |- + URLSecret defines secret name and key at the CRD namespace. + It must contain the webhook URL. + one of `urlSecret` and `url` must be defined. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -8696,74 +9463,147 @@ spec: type: object type: array wechat_configs: + description: WeChatConfigs defines wechat notification configurations. items: + description: |- + WeChatConfig configures notifications via WeChat. + See https://prometheus.io/docs/alerting/latest/configuration/#wechat_config properties: agent_id: type: string api_secret: + description: |- + The secret's key that contains the WeChat API key. + The secret needs to be in the same namespace as the AlertmanagerConfig + fallback to global alertmanager setting if empty properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic api_url: + description: |- + The WeChat API URL. + fallback to global alertmanager setting if empty type: string corp_id: + description: |- + The corp id for authentication. + fallback to global alertmanager setting if empty type: string http_config: + description: HTTP client configuration. properties: authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. properties: credentials: + description: Reference to the secret with value + for authorization properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to + bearer type: string type: object basic_auth: + description: BasicAuth for the client. properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key @@ -8771,45 +9611,88 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. type: string bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. properties: client_id: + description: The secret or configmap containing + the OAuth2 client id properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8817,33 +9700,60 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 + client secret properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for + client secret file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token + URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token + request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -8851,32 +9761,60 @@ spec: - token_url type: object proxyURL: + description: Optional proxy URL. type: string tls_config: + description: TLS configuration for the client. properties: ca: + description: Struct containing the CA cert to + use for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8884,30 +9822,58 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container + to use for the targets. type: string cert: + description: Struct containing the client cert + file for the targets. properties: configMap: + description: ConfigMap containing data to + use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use + for the targets. properties: key: + description: The key of the secret to + select from. Must be a valid secret + key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key @@ -8915,33 +9881,56 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the + container for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the + container for the targets. type: string keySecret: + description: Secret containing the client key + file for the targets. properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or + its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the + targets. type: string type: object type: object message: + description: API request data as defined by the WeChat + API. type: string message_type: type: string send_resolved: + description: SendResolved controls notify about resolved + alerts. type: boolean to_party: type: string @@ -8956,37 +9945,59 @@ spec: type: object type: array route: + description: Route definition for alertmanager, may include nested + routes. properties: active_time_intervals: + description: |- + ActiveTimeIntervals Times when the route should be active + These must match the name at time_intervals items: type: string type: array continue: + description: |- + Continue indicating whether an alert should continue matching subsequent + sibling nodes. It will always be true for the first-level route if disableRouteContinueEnforce for vmalertmanager not set. type: boolean group_by: + description: List of labels to group by. items: type: string type: array group_interval: + description: How long to wait before sending an updated notification. pattern: '[0-9]+(ms|s|m|h)' type: string group_wait: + description: How long to wait before sending the initial notification. pattern: '[0-9]+(ms|s|m|h)' type: string matchers: + description: |- + List of matchers that the alert’s labels should match. For the first + level route, the operator adds a namespace: "CRD_NS" matcher. + https://prometheus.io/docs/alerting/latest/configuration/#matcher items: type: string type: array mute_time_intervals: + description: MuteTimeIntervals is a list of interval names that + will mute matched alert items: type: string type: array receiver: + description: Name of the receiver for this route. type: string repeat_interval: + description: How long to wait before repeating the last notification. pattern: '[0-9]+(ms|s|m|h)' type: string routes: + description: |- + Child routes. + https://prometheus.io/docs/alerting/latest/configuration/#route items: x-kubernetes-preserve-unknown-fields: true type: array @@ -8994,29 +10005,49 @@ spec: - receiver type: object time_intervals: + description: |- + TimeIntervals defines named interval for active/mute notifications interval + See https://prometheus.io/docs/alerting/latest/configuration/#time_interval items: + description: TimeIntervals for alerts properties: name: + description: Name of interval type: string time_intervals: + description: TimeIntervals interval configuration items: + description: TimeInterval defines intervals of time properties: days_of_month: + description: |- + DayOfMonth defines list of numerical days in the month. Days begin at 1. Negative values are also accepted. + for example, ['1:5', '-3:-1'] items: type: string type: array location: + description: Location in golang time location form, e.g. + UTC type: string months: + description: |- + Months defines list of calendar months identified by a case-insensitive name (e.g. ‘January’) or numeric 1. + For example, ['1:3', 'may:august', 'december'] items: type: string type: array times: + description: Times defines time range for mute items: + description: TimeRange ranges inclusive of the starting + time and exclusive of the end time properties: end_time: + description: EndTime for example HH:MM type: string start_time: + description: StartTime for example HH:MM type: string required: - end_time @@ -9024,10 +10055,15 @@ spec: type: object type: array weekdays: + description: Weekdays defines list of days of the week, + where the week begins on Sunday and ends on Saturday. items: type: string type: array years: + description: |- + Years defines numerical list of years, ranges are accepted. + For example, ['2020:2022', '2030'] items: type: string type: array @@ -9038,36 +10074,64 @@ spec: - time_intervals type: object type: array + required: + - receivers + - route type: object status: + description: VMAlertmanagerConfigStatus defines the observed state of + VMAlertmanagerConfig properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -9084,11 +10148,16 @@ spec: lastErrorParentAlertmanagerName: type: string observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -9101,7 +10170,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmalertmanagers.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -9129,46 +10198,103 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMAlertmanager represents Victoria-Metrics deployment for Alertmanager. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: |- + Specification of the desired behavior of the VMAlertmanager cluster. More info: + https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status properties: additionalPeers: + description: AdditionalPeers allows injecting a set of additional + Alertmanagers to peer with to form a highly available cluster. items: type: string type: array affinity: + description: Affinity If specified, the pod's scheduling constraints. type: object x-kubernetes-preserve-unknown-fields: true claimTemplates: + description: ClaimTemplates allows adding additional VolumeClaimTemplates + for StatefulSet items: + description: PersistentVolumeClaim is a user's request for and claim + to a persistent volume properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata type: object x-kubernetes-preserve-unknown-fields: true spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string required: - kind @@ -9176,20 +10302,60 @@ spec: type: object x-kubernetes-map-type: atomic dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. type: string required: - kind - name type: object resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: limits: additionalProperties: @@ -9198,6 +10364,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -9206,18 +10375,40 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object selector: + description: selector is a label query over volumes to consider + for binding. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -9231,28 +10422,99 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. type: string volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. type: string type: object status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic allocatedResourceStatuses: additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. type: string + description: "allocatedResourceStatuses stores status of + resource being resized for the given PVC.\nKey names follow + standard Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus + can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with a + terminal error.\n\t- NodeResizePending:\n\t\tState set + when resize controller has finished resizing the volume + but further resizing of\n\t\tvolume is needed on the node.\n\t- + NodeResizeInProgress:\n\t\tState set when kubelet starts + resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, it + means that no resize operation is in progress for the + given PVC.\n\nA controller that receives PVC update with + previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." type: object x-kubernetes-map-type: granular allocatedResources: @@ -9262,6 +10524,30 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources allocated + to a PVC including its capacity.\nKey names follow standard + Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nCapacity + reported here may be larger than the actual capacity when + a volume expansion operation\nis requested.\nFor storage + quota, the larger value from allocatedResources and PVC.spec.resources + is used.\nIf allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and if + the actual volume capacity\nis equal or lower than the + requested capacity.\n\nA controller that receives PVC + update with previously unknown resourceName\nshould ignore + the update for the purpose it was designed. For example + - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." type: object capacity: additionalProperties: @@ -9270,23 +10556,47 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: capacity represents the actual resources of + the underlying volume. type: object conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. items: + description: PersistentVolumeClaimCondition contains details + about state of pvc properties: lastProbeTime: + description: lastProbeTime is the time we probed the + condition. format: date-time type: string lastTransitionTime: + description: lastTransitionTime is the time the condition + transitioned from one status to another. format: date-time type: string message: + description: message is the human-readable message + indicating details about last transition. type: string reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. type: string status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required type: string type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about type: string required: - status @@ -9297,39 +10607,96 @@ spec: - type x-kubernetes-list-type: map currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). type: string modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). properties: status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible indicates + that the request has been rejected as invalid by the + CSI driver. To\n\t resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can be + added in the future. Consumers should check for unknown + statuses and fail appropriately." type: string targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled type: string required: - status type: object phase: + description: phase represents the current phase of PersistentVolumeClaim. type: string type: object type: object type: array clusterAdvertiseAddress: + description: |- + ClusterAdvertiseAddress is the explicit address to advertise in cluster. + Needs to be provided for non RFC1918 [1] (public) addresses. + [1] RFC1918: https://tools.ietf.org/html/rfc1918 type: string clusterDomainName: + description: |- + ClusterDomainName defines domain name suffix for in-cluster dns addresses + aka .cluster.local + used to build pod peer addresses for in-cluster communication type: string configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder items: type: string type: array configNamespaceSelector: + description: |2- + ConfigNamespaceSelector defines namespace selector for VMAlertmanagerConfig. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAlertmanager namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -9343,40 +10710,58 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic configRawYaml: + description: |- + ConfigRawYaml - raw configuration for alertmanager, + it helps it to start without secret. + priority -> hardcoded ConfigRaw -> ConfigRaw, provided by user -> ConfigSecret. type: string - configReloadAuthKeySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic configReloaderExtraArgs: additionalProperties: type: string + description: |- + ConfigReloaderExtraArgs that will be passed to VMAuths config-reloader container + for example resyncInterval: "30s" type: object - configReloaderImage: - type: string configReloaderImageTag: + description: ConfigReloaderImageTag defines image:tag for config-reloader + container type: string configReloaderResources: + description: |- + ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -9392,6 +10777,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -9400,20 +10788,53 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object configSecret: + description: |- + ConfigSecret is the name of a Kubernetes Secret in the same namespace as the + VMAlertmanager object, which contains configuration for this VMAlertmanager, + configuration must be inside secret key: alertmanager.yaml. + It must be created by user. + instance. Defaults to 'vmalertmanager-' + The secret is mounted into /etc/alertmanager/config. type: string configSelector: + description: |- + ConfigSelector defines selector for VMAlertmanagerConfig, result config will be merged with with Raw or Secret config. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAlertmanager namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -9427,69 +10848,141 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. type: boolean disableNamespaceMatcher: + description: |- + DisableNamespaceMatcher disables top route namespace label matcher for VMAlertmanagerConfig + It may be useful if alert doesn't have namespace label for some reason type: boolean disableRouteContinueEnforce: + description: DisableRouteContinueEnforce cancel the behavior for VMAlertmanagerConfig + that always enforce first-level route continue to true type: boolean disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable type: boolean dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. items: x-kubernetes-preserve-unknown-fields: true properties: nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array x-kubernetes-list-type: atomic options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: |- + Name is this DNS resolver option's name. + Required. type: string value: + description: Value is this DNS resolver option's value. type: string type: object type: array x-kubernetes-list-type: atomic searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. items: type: string type: array x-kubernetes-list-type: atomic type: object dnsPolicy: - type: string - enforcedNamespaceLabel: + description: DNSPolicy sets DNS policy for the pod type: string enforcedTopRouteMatchers: + description: |- + EnforcedTopRouteMatchers defines label matchers to be added for the top route + of VMAlertmanagerConfig + It allows to make some set of labels required for alerts. + https://prometheus.io/docs/alerting/latest/configuration/#matcher items: type: string type: array externalURL: + description: |- + ExternalURL the VMAlertmanager instances will be available under. This is + necessary to generate correct URLs. This is necessary if VMAlertmanager is not + served from root of a DNS name. type: string extraArgs: additionalProperties: type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp type: object extraEnvs: + description: ExtraEnvs that will be passed to the application container items: + description: EnvVar represents an environment variable present in + a Container. properties: name: + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string required: - name @@ -9497,145 +10990,286 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap items: + description: EnvFromSource represents the source of a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap must be defined type: boolean type: object x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret must be defined type: boolean type: object x-kubernetes-map-type: atomic type: object type: array gossipConfig: + description: GossipConfig defines gossip TLS configuration for Alertmanager + cluster properties: tls_client_config: + description: TLSClientConfig defines client TLS configuration + for alertmanager properties: ca_file: + description: |- + CAFile defines path to the pre-mounted file with CA + mutually exclusive with CASecretRef type: string ca_secret_ref: + description: |- + CA defines reference for secret with CA content under given key + mutually exclusive with CAFile properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic cert_file: + description: |- + CertFile defines path to the pre-mounted file with certificate + mutually exclusive with CertSecretRef type: string cert_secret_ref: + description: |- + CertSecretRef defines reference for secret with certificate content under given key + mutually exclusive with CertFile properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic insecure_skip_verify: + description: |- + Cert defines reference for secret with CA content under given key + mutually exclusive with CertFile type: boolean key_file: + description: |- + KeyFile defines path to the pre-mounted file with certificate key + mutually exclusive with KeySecretRef type: string key_secret_ref: + description: |- + Key defines reference for secret with certificate key content under given key + mutually exclusive with KeyFile properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic server_name: + description: ServerName indicates a name of a server type: string type: object tls_server_config: + description: TLSServerConfig defines server TLS configuration + for alertmanager properties: cert_file: + description: |- + CertFile defines path to the pre-mounted file with certificate + mutually exclusive with CertSecretRef type: string cert_secret_ref: + description: |- + CertSecretRef defines reference for secret with certificate content under given key + mutually exclusive with CertFile properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic cipher_suites: + description: |- + CipherSuites defines list of supported cipher suites for TLS versions up to TLS 1.2 + https://golang.org/pkg/crypto/tls/#pkg-constants items: type: string type: array client_auth_type: + description: |- + Cert defines reference for secret with CA content under given key + mutually exclusive with CertFile + ClientAuthType defines server policy for client authentication + If you want to enable client authentication (aka mTLS), you need to use RequireAndVerifyClientCert + Note, mTLS is supported only at enterprise version of VictoriaMetrics components enum: - NoClientCert - RequireAndVerifyClientCert type: string client_ca_file: + description: |- + ClientCAFile defines path to the pre-mounted file with CA + mutually exclusive with ClientCASecretRef type: string client_ca_secret_ref: + description: |- + ClientCASecretRef defines reference for secret with CA content under given key + mutually exclusive with ClientCAFile properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic curve_preferences: + description: |- + CurvePreferences defines elliptic curves that will be used in an ECDHE handshake, in preference order. + https://golang.org/pkg/crypto/tls/#CurveID items: type: string type: array key_file: + description: |- + KeyFile defines path to the pre-mounted file with certificate key + mutually exclusive with KeySecretRef type: string key_secret_ref: + description: |- + Key defines reference for secret with certificate key content under given key + mutually exclusive with KeyFile properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic max_version: + description: MaxVersion maximum TLS version that is acceptable. enum: - TLS10 - TLS11 @@ -9643,6 +11277,7 @@ spec: - TLS13 type: string min_version: + description: MinVersion minimum TLS version that is acceptable. enum: - TLS10 - TLS11 @@ -9650,75 +11285,132 @@ spec: - TLS13 type: string prefer_server_cipher_suites: + description: |- + PreferServerCipherSuites controls whether the server selects the + client's most preferred ciphersuite type: boolean type: object type: object host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace type: boolean image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config properties: pullPolicy: + description: PullPolicy describes how to pull docker image type: string repository: + description: Repository contains name of docker image + it's repository + if needed type: string tag: + description: Tag contains desired docker image version type: string type: object imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic type: array initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array listenLocal: + description: |- + ListenLocal makes the VMAlertmanager server listen on loopback, so that it + does not bind against the Pod IP. Note this is only for the VMAlertmanager + UI, not the gossip communication. type: boolean livenessProbe: + description: LivenessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true logFormat: + description: LogFormat for VMAlertmanager to be configured with. enum: - logfmt - json type: string logLevel: + description: Log level for VMAlertmanager to be configured with. enum: - debug - info @@ -9730,96 +11422,169 @@ spec: - ERROR type: string managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object type: object minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle format: int32 type: integer nodeSelector: additionalProperties: type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. type: object paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: - type: string - whenScaled: - type: string - type: object podDisruptionBudget: + description: PodDisruptionBudget created by operator properties: maxUnavailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". x-kubernetes-int-or-string: true minAvailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". x-kubernetes-int-or-string: true selectorLabels: additionalProperties: type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string type: object podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the alertmanager pods. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object port: + description: Port listen address type: string portName: + description: |- + PortName used for the pods and governing service. + This defaults to web type: string priorityClassName: + description: PriorityClassName class assigned to the Pods type: string readinessGates: + description: ReadinessGates defines pod readiness gates items: + description: PodReadinessGate contains the reference to a pod condition properties: conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. type: string required: - conditionType type: object type: array readinessProbe: + description: ReadinessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true replicaCount: + description: ReplicaCount is the expected size of the Application. format: int32 type: integer resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -9835,6 +11600,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -9843,110 +11611,255 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object retention: + description: |- + Retention Time duration VMAlertmanager shall retain data for. Default is '120h', + and must match the regular expression `[0-9]+(ms|s|m|h)` (milliseconds seconds minutes hours). pattern: '[0-9]+(ms|s|m|h)' type: string revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. format: int32 type: integer rollingUpdateStrategy: + description: |- + RollingUpdateStrategy defines strategy for application updates + Default is OnDelete, in this case operator handles update process + Can be changed for RollingUpdate type: string routePrefix: + description: |- + RoutePrefix VMAlertmanager registers HTTP handlers for. This is useful, + if using ExternalURL and a proxy is rewriting HTTP routes of a request, + and the actual ExternalURL is still true, but the server serves requests + under a different route prefix. For example for use with `kubectl proxy`. type: string runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ type: string schedulerName: + description: SchedulerName - defines kubernetes scheduler name type: string secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder items: type: string type: array securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. type: object x-kubernetes-preserve-unknown-fields: true selectAllByDefault: + description: |- + SelectAllByDefault changes default behavior for empty CRD selectors, such ConfigSelector. + with selectAllByDefault: true and undefined ConfigSelector and ConfigNamespaceSelector + Operator selects all exist alertManagerConfigs + with selectAllByDefault: false - selects nothing type: boolean serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods type: string serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmalertmanager + VMServiceScrape spec required: - endpoints type: object x-kubernetes-preserve-unknown-fields: true serviceSpec: + description: ServiceSpec that will be added to vmalertmanager service + spec properties: metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ type: object x-kubernetes-preserve-unknown-fields: true useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication type: boolean required: - spec type: object startupProbe: + description: StartupProbe that will be added to CRD pod type: object x-kubernetes-preserve-unknown-fields: true storage: + description: |- + Storage is the definition of how storage will be used by the VMAlertmanager + instances. properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir properties: medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string sizeLimit: anyOf: - type: integer - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: + description: EmbeddedMetadata contains metadata relevant to + an EmbeddedResource. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object spec: + description: |- + Spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string required: - kind @@ -9954,20 +11867,60 @@ spec: type: object x-kubernetes-map-type: atomic dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. type: string required: - kind - name type: object resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: limits: additionalProperties: @@ -9976,6 +11929,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -9984,18 +11940,40 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object selector: + description: selector is a label query over volumes to + consider for binding. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -10009,28 +11987,100 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. type: string volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. type: string type: object status: + description: |- + Status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic allocatedResourceStatuses: additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. type: string + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage - + the capacity of the volume.\n\t* Custom resources must + use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have + kubernetes.io prefix are considered\nreserved and hence + may not be used.\n\nClaimResourceStatus can be in any + of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with + a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing the + volume but further resizing of\n\t\tvolume is needed + on the node.\n\t- NodeResizeInProgress:\n\t\tState set + when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this + field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress for + the given PVC.\n\nA controller that receives PVC update + with previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for + resizing capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." type: object x-kubernetes-map-type: granular allocatedResources: @@ -10040,6 +12090,31 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage - + the capacity of the volume.\n\t* Custom resources must + use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have + kubernetes.io prefix are considered\nreserved and hence + may not be used.\n\nCapacity reported here may be larger + than the actual capacity when a volume expansion operation\nis + requested.\nFor storage quota, the larger value from + allocatedResources and PVC.spec.resources is used.\nIf + allocatedResources is not set, PVC.spec.resources alone + is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and + if the actual volume capacity\nis equal or lower than + the requested capacity.\n\nA controller that receives + PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for + resizing capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." type: object capacity: additionalProperties: @@ -10048,23 +12123,47 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. type: object conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. items: + description: PersistentVolumeClaimCondition contains + details about state of pvc properties: lastProbeTime: + description: lastProbeTime is the time we probed + the condition. format: date-time type: string lastTransitionTime: + description: lastTransitionTime is the time the + condition transitioned from one status to another. format: date-time type: string message: + description: message is the human-readable message + indicating details about last transition. type: string reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. type: string status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required type: string type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about type: string required: - status @@ -10075,28 +12174,64 @@ spec: - type x-kubernetes-list-type: map currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). type: string modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). properties: status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible + indicates that the request has been rejected as + invalid by the CSI driver. To\n\t resolve the error, + a valid VolumeAttributesClass needs to be specified.\nNote: + New statuses can be added in the future. Consumers + should check for unknown statuses and fail appropriately." type: string targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled type: string required: - status type: object phase: + description: phase represents the current phase of PersistentVolumeClaim. type: string type: object type: object type: object templates: + description: |- + Templates is a list of ConfigMap key references for ConfigMaps in the same namespace as the VMAlertmanager + object, which shall be mounted into the VMAlertmanager Pods. + The Templates are mounted into /etc/vm/templates//. items: + description: ConfigMapKeyReference refers to a key in a ConfigMap. properties: key: + description: The ConfigMap key to refer to. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string required: - key @@ -10104,26 +12239,58 @@ spec: x-kubernetes-map-type: atomic type: array terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination format: int64 type: integer tolerations: + description: Tolerations If specified, the pod's tolerations. items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . properties: effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. required: - maxSkew - topologyKey @@ -10131,104 +12298,84 @@ spec: type: object x-kubernetes-preserve-unknown-fields: true type: array - tracingConfig: - properties: - client_type: - enum: - - http - - grpc - type: string - compression: - type: string - endpoint: - type: string - http_headers: - additionalProperties: - type: string - type: object - insecure: - type: boolean - sampling_fraction: - type: string - timeout: - type: string - tls_config: - properties: - ca_file: - type: string - ca_secret_ref: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - cert_file: - type: string - cert_secret_ref: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - insecure_skip_verify: - type: boolean - key_file: - type: string - key_secret_ref: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - server_name: - type: string - type: object - required: - - endpoint - type: object useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements type: boolean useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions type: boolean useVMConfigReloader: + description: |- + UseVMConfigReloader replaces prometheus-like config-reloader + with vm one. It uses secrets watch instead of file watch + which greatly increases speed of config updates type: boolean volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container items: + description: VolumeMount describes a mounting of a Volume within + a container. properties: mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. type: string mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. type: boolean recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. type: string subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -10236,88 +12383,170 @@ spec: type: object type: array volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array webConfig: + description: |- + WebConfig defines configuration for webserver + https://github.com/prometheus/alertmanager/blob/main/docs/https.md properties: basic_auth_users: additionalProperties: type: string + description: |- + BasicAuthUsers Usernames and hashed passwords that have full access to the web server + Passwords must be hashed with bcrypt type: object http_server_config: + description: HTTPServerConfig defines http server configuration + for alertmanager web server properties: headers: additionalProperties: type: string + description: Headers defines list of headers that can be added + to HTTP responses. type: object http2: + description: |- + HTTP2 enables HTTP/2 support. Note that HTTP/2 is only supported with TLS. + This can not be changed on the fly. type: boolean type: object tls_server_config: + description: TLSServerConfig defines server TLS configuration + for alertmanager properties: cert_file: + description: |- + CertFile defines path to the pre-mounted file with certificate + mutually exclusive with CertSecretRef type: string cert_secret_ref: + description: |- + CertSecretRef defines reference for secret with certificate content under given key + mutually exclusive with CertFile properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic cipher_suites: + description: |- + CipherSuites defines list of supported cipher suites for TLS versions up to TLS 1.2 + https://golang.org/pkg/crypto/tls/#pkg-constants items: type: string type: array client_auth_type: + description: |- + Cert defines reference for secret with CA content under given key + mutually exclusive with CertFile + ClientAuthType defines server policy for client authentication + If you want to enable client authentication (aka mTLS), you need to use RequireAndVerifyClientCert + Note, mTLS is supported only at enterprise version of VictoriaMetrics components enum: - NoClientCert - RequireAndVerifyClientCert type: string client_ca_file: + description: |- + ClientCAFile defines path to the pre-mounted file with CA + mutually exclusive with ClientCASecretRef type: string client_ca_secret_ref: + description: |- + ClientCASecretRef defines reference for secret with CA content under given key + mutually exclusive with ClientCAFile properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic curve_preferences: + description: |- + CurvePreferences defines elliptic curves that will be used in an ECDHE handshake, in preference order. + https://golang.org/pkg/crypto/tls/#CurveID items: type: string type: array key_file: + description: |- + KeyFile defines path to the pre-mounted file with certificate key + mutually exclusive with KeySecretRef type: string key_secret_ref: + description: |- + Key defines reference for secret with certificate key content under given key + mutually exclusive with KeyFile properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic max_version: + description: MaxVersion maximum TLS version that is acceptable. enum: - TLS10 - TLS11 @@ -10325,6 +12554,7 @@ spec: - TLS13 type: string min_version: + description: MinVersion minimum TLS version that is acceptable. enum: - TLS10 - TLS11 @@ -10332,39 +12562,69 @@ spec: - TLS13 type: string prefer_server_cipher_suites: + description: |- + PreferServerCipherSuites controls whether the server selects the + client's most preferred ciphersuite type: boolean type: object type: object type: object status: + description: |- + Most recent observed status of the VMAlertmanager cluster. + Operator API itself. More info: + https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -10379,11 +12639,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -10398,7 +12663,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmalerts.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -10414,7 +12679,7 @@ spec: jsonPath: .status.updateStatus name: Status type: string - - description: The desired replicas number of VMAlerts + - description: The desired replicas number of Alertmanagers jsonPath: .spec.replicaCount name: ReplicaCount type: integer @@ -10424,51 +12689,80 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMAlert executes a list of given alerting or recording rules + against configured address. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMAlertSpec defines the desired state of VMAlert properties: affinity: + description: Affinity If specified, the pod's scheduling constraints. type: object x-kubernetes-preserve-unknown-fields: true configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder items: type: string type: array - configReloadAuthKeySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic configReloaderExtraArgs: additionalProperties: type: string + description: |- + ConfigReloaderExtraArgs that will be passed to VMAuths config-reloader container + for example resyncInterval: "30s" type: object - configReloaderImage: - type: string configReloaderImageTag: + description: ConfigReloaderImageTag defines image:tag for config-reloader + container type: string configReloaderResources: + description: |- + ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -10484,6 +12778,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -10492,42 +12789,85 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array datasource: + description: Datasource Victoria Metrics or VMSelect url. Required + parameter. e.g. http://127.0.0.1:8428 properties: basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -10535,88 +12875,169 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: Path to bearer token file type: string bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version items: type: string type: array oauth2: + description: OAuth2 defines OAuth2 configuration required: - client_id - token_url type: object x-kubernetes-preserve-unknown-fields: true tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. type: object x-kubernetes-preserve-unknown-fields: true url: + description: Victoria Metrics or VMSelect url. Required parameter. + E.g. http://127.0.0.1:8428 type: string required: - url type: object disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. type: boolean disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable type: boolean dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. items: x-kubernetes-preserve-unknown-fields: true properties: nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array x-kubernetes-list-type: atomic options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: |- + Name is this DNS resolver option's name. + Required. type: string value: + description: Value is this DNS resolver option's value. type: string type: object type: array x-kubernetes-list-type: atomic searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. items: type: string type: array x-kubernetes-list-type: atomic type: object dnsPolicy: + description: DNSPolicy sets DNS policy for the pod type: string enforcedNamespaceLabel: + description: |- + EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert + and metric that is user created. The label value will always be the namespace of the object that is + being created. type: string evaluationInterval: + description: EvaluationInterval defines how often to evaluate rules + by default pattern: '[0-9]+(ms|s|m|h)' type: string externalLabels: additionalProperties: type: string + description: 'ExternalLabels in the form ''name: value'' to add to + all generated recording rules and alerts.' type: object extraArgs: additionalProperties: type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp type: object extraEnvs: + description: ExtraEnvs that will be passed to the application container items: + description: EnvVar represents an environment variable present in + a Container. properties: name: + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string required: - name @@ -10624,116 +13045,212 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap items: + description: EnvFromSource represents the source of a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap must be defined type: boolean type: object x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret must be defined type: boolean type: object x-kubernetes-map-type: atomic type: object type: array host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace type: boolean image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config properties: pullPolicy: + description: PullPolicy describes how to pull docker image type: string repository: + description: Repository contains name of docker image + it's repository + if needed type: string tag: + description: Tag contains desired docker image version type: string type: object imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic type: array initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) properties: forceOffline: + description: Enforce offline verification of the license key. type: boolean key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) type: string keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. type: string type: object livenessProbe: + description: LivenessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true logFormat: + description: |- + LogFormat for VMAlert to be configured with. + default or json enum: - default - json type: string logLevel: + description: LogLevel for VMAlert to be configured with. enum: - INFO - WARN @@ -10742,50 +13259,103 @@ spec: - PANIC type: string managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object type: object minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle format: int32 type: integer nodeSelector: additionalProperties: type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. type: object notifier: + description: |- + Notifier prometheus alertmanager endpoint spec. Required at least one of notifier or notifiers when there are alerting rules. e.g. http://127.0.0.1:9093 + If specified both notifier and notifiers, notifier will be added as last element to notifiers. + only one of notifier options could be chosen: notifierConfigRef or notifiers + notifier properties: basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -10793,42 +13363,84 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: Path to bearer token file type: string bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version items: type: string type: array oauth2: + description: OAuth2 defines OAuth2 configuration required: - client_id - token_url type: object x-kubernetes-preserve-unknown-fields: true selector: + description: |- + Selector allows service discovery for alertmanager + in this case all matched vmalertmanager replicas will be added into vmalert notifier.url + as statefulset pod.fqdn properties: labelSelector: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -10842,66 +13454,128 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaceSelector: + description: |- + NamespaceSelector is a selector for selecting either all namespaces or a + list of namespaces. properties: any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. type: boolean matchNames: + description: List of namespace names. items: type: string type: array type: object type: object tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. type: object x-kubernetes-preserve-unknown-fields: true url: + description: AlertManager url. E.g. http://127.0.0.1:9093 type: string type: object notifierConfigRef: + description: |- + NotifierConfigRef reference for secret with notifier configuration for vmalert + only one of notifier options could be chosen: notifierConfigRef or notifiers + notifier properties: key: + description: The key of the secret to select from. Must be a + valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic notifiers: + description: |- + Notifiers prometheus alertmanager endpoints. Required at least one of notifier or notifiers when there are alerting rules. e.g. http://127.0.0.1:9093 + If specified both notifier and notifiers, notifier will be added as last element to notifiers. + only one of notifier options could be chosen: notifierConfigRef or notifiers + notifier items: + description: VMAlertNotifierSpec defines the notifier url for sending + information about alerts properties: basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -10909,42 +13583,84 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: Path to bearer token file type: string bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version items: type: string type: array oauth2: + description: OAuth2 defines OAuth2 configuration required: - client_id - token_url type: object x-kubernetes-preserve-unknown-fields: true selector: + description: |- + Selector allows service discovery for alertmanager + in this case all matched vmalertmanager replicas will be added into vmalert notifier.url + as statefulset pod.fqdn properties: labelSelector: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -10958,106 +13674,194 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaceSelector: + description: |- + NamespaceSelector is a selector for selecting either all namespaces or a + list of namespaces. properties: any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. type: boolean matchNames: + description: List of namespace names. items: type: string type: array type: object type: object tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. type: object x-kubernetes-preserve-unknown-fields: true url: + description: AlertManager url. E.g. http://127.0.0.1:9093 type: string type: object type: array paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. type: boolean podDisruptionBudget: + description: PodDisruptionBudget created by operator properties: maxUnavailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". x-kubernetes-int-or-string: true minAvailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". x-kubernetes-int-or-string: true selectorLabels: additionalProperties: type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string type: object podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the VMAlert pods. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object port: + description: Port listen address type: string priorityClassName: + description: PriorityClassName class assigned to the Pods type: string readinessGates: + description: ReadinessGates defines pod readiness gates items: + description: PodReadinessGate contains the reference to a pod condition properties: conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. type: string required: - conditionType type: object type: array readinessProbe: + description: ReadinessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true remoteRead: + description: |- + RemoteRead Optional URL to read vmalert state (persisted via RemoteWrite) + This configuration only makes sense if alerts state has been successfully + persisted (via RemoteWrite) before. + see -remoteRead.url docs in vmalerts for details. + E.g. http://127.0.0.1:8428 properties: basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -11065,67 +13869,129 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: Path to bearer token file type: string bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version items: type: string type: array lookback: + description: |- + Lookback defines how far to look into past for alerts timeseries. For example, if lookback=1h then range from now() to now()-1h will be scanned. (default 1h0m0s) + Applied only to RemoteReadSpec type: string oauth2: + description: OAuth2 defines OAuth2 configuration required: - client_id - token_url type: object x-kubernetes-preserve-unknown-fields: true tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. type: object x-kubernetes-preserve-unknown-fields: true url: + description: URL of the endpoint to send samples to. type: string required: - url type: object remoteWrite: + description: |- + RemoteWrite Optional URL to remote-write compatible storage to persist + vmalert state and rule results to. + Rule results will be persisted according to each rule. + Alerts state will be persisted in the form of time series named ALERTS and ALERTS_FOR_STATE + see -remoteWrite.url docs in vmalerts for details. + E.g. http://127.0.0.1:8428 properties: basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -11133,61 +13999,111 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: Path to bearer token file type: string bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic concurrency: + description: Defines number of readers that concurrently write + into remote storage (default 1) format: int32 type: integer flushInterval: + description: Defines interval of flushes to remote write endpoint + (default 5s) pattern: '[0-9]+(ms|s|m|h)' type: string headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version items: type: string type: array maxBatchSize: + description: Defines defines max number of timeseries to be flushed + at once (default 1000) format: int32 type: integer maxQueueSize: + description: Defines the max number of pending datapoints to remote + write endpoint (default 100000) format: int32 type: integer oauth2: + description: OAuth2 defines OAuth2 configuration required: - client_id - token_url type: object x-kubernetes-preserve-unknown-fields: true tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. type: object x-kubernetes-preserve-unknown-fields: true url: + description: URL of the endpoint to send samples to. type: string required: - url type: object replicaCount: + description: ReplicaCount is the expected size of the Application. format: int32 type: integer resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -11203,6 +14119,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -11211,34 +14130,88 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. format: int32 type: integer rollingUpdate: + description: RollingUpdate - overrides deployment update params. properties: maxSurge: anyOf: - type: integer - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. x-kubernetes-int-or-string: true maxUnavailable: anyOf: - type: integer - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. x-kubernetes-int-or-string: true type: object ruleNamespaceSelector: + description: |- + RuleNamespaceSelector to be selected for VMRules discovery. + Works in combination with Selector. + If both nil - behaviour controlled by selectAllByDefault + NamespaceSelector nil - only objects at VMAlert namespace. properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -11252,23 +14225,56 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic rulePath: + description: |- + RulePath to the file with alert rules. + Supports patterns. Flag can be specified multiple times. + Examples: + -rule /path/to/file. Path to a single file with alerting rules + -rule dir/*.yaml -rule /*.yaml. Relative path to all .yaml files in folder, + absolute path to all .yaml files in root. + by default operator adds /etc/vmalert/configs/base/vmalert.yaml items: type: string type: array ruleSelector: + description: |- + RuleSelector selector to select which VMRules to mount for loading alerting + rules from. + Works in combination with NamespaceSelector. + If both nil - behaviour controlled by selectAllByDefault + NamespaceSelector nil - only objects at VMAlert namespace. properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -11282,76 +14288,159 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ type: string schedulerName: + description: SchedulerName - defines kubernetes scheduler name type: string secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder items: type: string type: array securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. type: object x-kubernetes-preserve-unknown-fields: true selectAllByDefault: + description: |- + SelectAllByDefault changes default behavior for empty CRD selectors, such RuleSelector. + with selectAllByDefault: true and empty serviceScrapeSelector and RuleNamespaceSelector + Operator selects all exist serviceScrapes + with selectAllByDefault: false - selects nothing type: boolean serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods type: string serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmalert VMServiceScrape + spec required: - endpoints type: object x-kubernetes-preserve-unknown-fields: true serviceSpec: + description: ServiceSpec that will be added to vmalert service spec properties: metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ type: object x-kubernetes-preserve-unknown-fields: true useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication type: boolean required: - spec type: object startupProbe: + description: StartupProbe that will be added to CRD pod type: object x-kubernetes-preserve-unknown-fields: true terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination format: int64 type: integer tolerations: + description: Tolerations If specified, the pod's tolerations. items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . properties: effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. required: - maxSkew - topologyKey @@ -11360,32 +14449,89 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array updateStrategy: + description: UpdateStrategy - overrides default update strategy. enum: - Recreate - RollingUpdate type: string useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements type: boolean useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions type: boolean useVMConfigReloader: + description: |- + UseVMConfigReloader replaces prometheus-like config-reloader + with vm one. It uses secrets watch instead of file watch + which greatly increases speed of config updates type: boolean volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container items: + description: VolumeMount describes a mounting of a Volume within + a container. properties: mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. type: string mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. type: boolean recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. type: string subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -11393,7 +14539,13 @@ spec: type: object type: array volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. required: - name type: object @@ -11403,34 +14555,58 @@ spec: - datasource type: object status: + description: VMAlertStatus defines the observed state of VMAlert properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -11445,11 +14621,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -11462,1366 +14643,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vmanomalies.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VMAnomaly - listKind: VMAnomalyList - plural: vmanomalies - singular: vmanomaly - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: current number of shards - jsonPath: .status.shards - name: Shards Count - type: integer - - description: Current status of update rollout - jsonPath: .status.updateStatus - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - claimTemplates: - items: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - x-kubernetes-preserve-unknown-fields: true - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - status: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - allocatedResourceStatuses: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: granular - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - conditions: - items: - properties: - lastProbeTime: - format: date-time - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentVolumeAttributesClassName: - type: string - modifyVolumeStatus: - properties: - status: - type: string - targetVolumeAttributesClassName: - type: string - required: - - status - type: object - phase: - type: string - type: object - type: object - type: array - configMaps: - items: - type: string - type: array - configRawYaml: - type: string - configSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - license: - properties: - forceOffline: - type: boolean - key: - type: string - keyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - reloadInterval: - type: string - type: object - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - managedMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - minReadySeconds: - format: int32 - type: integer - monitoring: - properties: - pull: - properties: - port: - type: string - required: - - port - type: object - push: - properties: - basicAuth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - password_file: - type: string - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - bearer: - properties: - bearerTokenFile: - type: string - bearerTokenSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - extraLabels: - additionalProperties: - type: string - type: object - healthPath: - type: string - pushFrequency: - type: string - tenantID: - type: string - timeout: - type: string - tlsConfig: - properties: - ca: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - caFile: - type: string - cert: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - certFile: - type: string - insecureSkipVerify: - type: boolean - keyFile: - type: string - keySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - serverName: - type: string - type: object - url: - type: string - required: - - url - type: object - type: object - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: - type: string - whenScaled: - type: string - type: object - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - reader: - properties: - basicAuth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - password_file: - type: string - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - bearer: - properties: - bearerTokenFile: - type: string - bearerTokenSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - dataRange: - items: - type: string - type: array - datasourceURL: - type: string - extraFilters: - items: - type: string - type: array - healthPath: - type: string - latencyOffset: - type: string - maxPointsPerQuery: - type: integer - queryFromLastSeenTimestamp: - type: boolean - queryRangePath: - type: string - samplingPeriod: - type: string - tenantID: - type: string - timeout: - type: string - tlsConfig: - properties: - ca: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - caFile: - type: string - cert: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - certFile: - type: string - insecureSkipVerify: - type: boolean - keyFile: - type: string - keySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - serverName: - type: string - type: object - tz: - type: string - required: - - datasourceURL - - samplingPeriod - type: object - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdateStrategy: - type: string - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - server: - properties: - addr: - type: string - maxConcurrentTasks: - maximum: 20 - minimum: 1 - type: integer - pathPrefix: - type: string - port: - type: string - uiDefaultState: - type: string - type: object - serviceAccountName: - type: string - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - shardCount: - format: int32 - type: integer - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - storage: - properties: - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - volumeClaimTemplate: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - status: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - allocatedResourceStatuses: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: granular - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - conditions: - items: - properties: - lastProbeTime: - format: date-time - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentVolumeAttributesClassName: - type: string - modifyVolumeStatus: - properties: - status: - type: string - targetVolumeAttributesClassName: - type: string - required: - - status - type: object - phase: - type: string - type: object - type: object - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - writer: - properties: - basicAuth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - password_file: - type: string - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - bearer: - properties: - bearerTokenFile: - type: string - bearerTokenSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - datasourceURL: - type: string - healthPath: - type: string - metricFormat: - properties: - __name__: - type: string - extraLabels: - additionalProperties: - type: string - type: object - for: - type: string - required: - - __name__ - - for - type: object - tenantID: - type: string - timeout: - type: string - tlsConfig: - properties: - ca: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - caFile: - type: string - cert: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - certFile: - type: string - insecureSkipVerify: - type: boolean - keyFile: - type: string - keySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - serverName: - type: string - type: object - required: - - datasourceURL - type: object - required: - - reader - - writer - type: object - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - shards: - format: int32 - type: integer - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - scale: - labelSelectorPath: .status.selector - specReplicasPath: .spec.shardCount - statusReplicasPath: .status.shards - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmauths.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -12840,58 +14662,86 @@ spec: - jsonPath: .metadata.creationTimestamp name: Age type: date - - description: The desired replicas number of VMAuth + - description: The desired replicas number of Alertmanagers jsonPath: .spec.replicaCount name: ReplicaCount type: integer name: v1beta1 schema: openAPIV3Schema: + description: VMAuth is the Schema for the vmauths API properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMAuthSpec defines the desired state of VMAuth properties: affinity: + description: Affinity If specified, the pod's scheduling constraints. type: object x-kubernetes-preserve-unknown-fields: true configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder items: type: string type: array - configReloadAuthKeySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic configReloaderExtraArgs: additionalProperties: type: string + description: |- + ConfigReloaderExtraArgs that will be passed to VMAuths config-reloader container + for example resyncInterval: "30s" type: object - configReloaderImage: - type: string configReloaderImageTag: + description: ConfigReloaderImageTag defines image:tag for config-reloader + container type: string configReloaderResources: + description: |- + ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -12907,6 +14757,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -12915,60 +14768,129 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object configSecret: + description: |- + ConfigSecret is the name of a Kubernetes Secret in the same namespace as the + VMAuth object, which contains auth configuration for vmauth, + configuration must be inside secret key: config.yaml. + It must be created and managed manually. + If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders + Deprecated, use externalConfig.secretRef instead type: string containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. type: boolean disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable type: boolean dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. items: x-kubernetes-preserve-unknown-fields: true properties: nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array x-kubernetes-list-type: atomic options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: |- + Name is this DNS resolver option's name. + Required. type: string value: + description: Value is this DNS resolver option's value. type: string type: object type: array x-kubernetes-list-type: atomic searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. items: type: string type: array x-kubernetes-list-type: atomic type: object dnsPolicy: + description: DNSPolicy sets DNS policy for the pod type: string externalConfig: + description: |- + ExternalConfig defines a source of external VMAuth configuration. + If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders properties: localPath: + description: |- + LocalPath contains static path to a config, which is managed externally for cases + when using secrets is not applicable, e.g.: Vault sidecar. type: string secretRef: + description: SecretRef defines selector for externally managed + secret which contains configuration properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key @@ -12978,13 +14900,30 @@ spec: extraArgs: additionalProperties: type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp type: object extraEnvs: + description: ExtraEnvs that will be passed to the application container items: + description: EnvVar represents an environment variable present in + a Container. properties: name: + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string required: - name @@ -12992,512 +14931,234 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap items: + description: EnvFromSource represents the source of a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap must be defined type: boolean type: object x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret must be defined type: boolean type: object x-kubernetes-map-type: atomic type: object type: array host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace type: boolean - hpa: - properties: - behaviour: - properties: - scaleDown: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - scaleUp: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - maxReplicas: - format: int32 - type: integer - metrics: - items: - properties: - containerResource: - properties: - container: - type: string - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - container - - name - - target - type: object - external: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - object: - properties: - describedObject: - properties: - apiVersion: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - describedObject - - metric - - target - type: object - pods: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - resource: - properties: - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - name - - target - type: object - type: - type: string - required: - - type - type: object - type: array - minReplicas: - format: int32 - type: integer - type: object - httpRoute: - properties: - annotations: - additionalProperties: - type: string - type: object - extraRules: - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - x-kubernetes-preserve-unknown-fields: true - hostnames: - items: - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - parentRefs: - items: - properties: - group: - default: gateway.networking.k8s.io - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - maxLength: 253 - minLength: 1 - type: string - namespace: - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - type: array - type: object image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config properties: pullPolicy: + description: PullPolicy describes how to pull docker image type: string repository: + description: Repository contains name of docker image + it's repository + if needed type: string tag: + description: Tag contains desired docker image version type: string type: object imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic type: array ingress: + description: Ingress enables ingress configuration for VMAuth. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object class_name: + description: ClassName defines ingress class name for VMAuth type: string extraRules: + description: |- + ExtraRules - additional rules for ingress, + must be checked for correctness by user. items: + description: |- + IngressRule represents the rules mapping the paths under a specified host to + the related backend services. Incoming requests are first evaluated for a host + match, then routed to the backend associated with the matching IngressRuleValue. properties: host: + description: "host is the fully qualified domain name of + a network host, as defined by RFC 3986.\nNote the following + deviations from the \"host\" part of the\nURI as defined + in RFC 3986:\n1. IPs are not allowed. Currently an IngressRuleValue + can only apply to\n the IP in the Spec of the parent + Ingress.\n2. The `:` delimiter is not respected because + ports are not allowed.\n\t Currently the port of an Ingress + is implicitly :80 for http and\n\t :443 for https.\nBoth + these may change in the future.\nIncoming requests are + matched against the host before the\nIngressRuleValue. + If the host is unspecified, the Ingress routes all\ntraffic + based on the specified IngressRuleValue.\n\nhost can be + \"precise\" which is a domain name without the terminating + dot of\na network host (e.g. \"foo.bar.com\") or \"wildcard\", + which is a domain name\nprefixed with a single wildcard + label (e.g. \"*.foo.com\").\nThe wildcard character '*' + must appear by itself as the first DNS label and\nmatches + only a single label. You cannot have a wildcard label + by itself (e.g. Host == \"*\").\nRequests will be matched + against the Host field in the following way:\n1. If host + is precise, the request matches this rule if the http + host header is equal to Host.\n2. If host is a wildcard, + then the request matches this rule if the http host header\nis + to equal to the suffix (removing the first label) of the + wildcard rule." type: string http: + description: |- + HTTPIngressRuleValue is a list of http selectors pointing to backends. + In the example: http:///? -> backend where + where parts of the url correspond to RFC 3986, this resource will be used + to match against everything after the last '/' and before the first '?' + or '#'. properties: paths: + description: paths is a collection of paths that map + requests to backends. items: + description: |- + HTTPIngressPath associates a path with a backend. Incoming urls matching the + path are forwarded to the backend. properties: backend: + description: |- + backend defines the referenced service endpoint to which the traffic + will be forwarded to. properties: resource: + description: |- + resource is an ObjectRef to another Kubernetes resource in the namespace + of the Ingress object. If resource is specified, a service.Name and + service.Port must not be specified. + This is a mutually exclusive setting with "Service". properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource + being referenced type: string name: + description: Name is the name of resource + being referenced type: string required: - kind @@ -13505,14 +15166,29 @@ spec: type: object x-kubernetes-map-type: atomic service: + description: |- + service references a service as a backend. + This is a mutually exclusive setting with "Resource". properties: name: + description: |- + name is the referenced service. The service must exist in + the same namespace as the Ingress object. type: string port: + description: |- + port of the referenced service. A port name or port number + is required for a IngressServiceBackend. properties: name: + description: |- + name is the name of the port on the Service. + This is a mutually exclusive setting with "Number". type: string number: + description: |- + number is the numerical port number (e.g. 80) on the Service. + This is a mutually exclusive setting with "Name". format: int32 type: integer type: object @@ -13522,8 +15198,28 @@ spec: type: object type: object path: + description: |- + path is matched against the path of an incoming request. Currently it can + contain characters disallowed from the conventional "path" part of a URL + as defined by RFC 3986. Paths must begin with a '/' and must be present + when using PathType with value "Exact" or "Prefix". type: string pathType: + description: |- + pathType determines the interpretation of the path matching. PathType can + be one of the following values: + * Exact: Matches the URL path exactly. + * Prefix: Matches based on a URL path prefix split by '/'. Matching is + done on a path element by element basis. A path element refers is the + list of labels in the path split by the '/' separator. A request is a + match for path p if every p is an element-wise prefix of p of the + request path. Note that if the last element of the path is a substring + of the last element in request path, it is not a match (e.g. /foo/bar + matches /foo/bar/baz, but does not match /foo/barbaz). + * ImplementationSpecific: Interpretation of the Path matching is up to + the IngressClass. Implementations can treat this as a separate PathType + or treat it identically to Prefix or Exact path types. + Implementations are required to support all path types. type: string required: - backend @@ -13537,76 +15233,138 @@ spec: type: object type: array extraTls: + description: |- + ExtraTLS - additional TLS configuration for ingress + must be checked for correctness by user. items: + description: IngressTLS describes the transport layer security + associated with an ingress. properties: hosts: + description: |- + hosts is a list of hosts included in the TLS certificate. The values in + this list must match the name/s used in the tlsSecret. Defaults to the + wildcard host setting for the loadbalancer controller fulfilling this + Ingress, if left unspecified. items: type: string type: array x-kubernetes-list-type: atomic secretName: + description: |- + secretName is the name of the secret used to terminate TLS traffic on + port 443. Field is left optional to allow TLS routing based on SNI + hostname alone. If the SNI host in a listener conflicts with the "Host" + header field used by an IngressRule, the SNI host is used for termination + and value of the "Host" header is used for routing. type: string type: object type: array host: + description: |- + Host defines ingress host parameter for default rule + It will be used, only if TlsHosts is empty type: string labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string - paths: - items: - type: string - type: array tlsHosts: + description: TlsHosts configures TLS access for ingress, tlsSecretName + must be defined for it. items: type: string type: array tlsSecretName: + description: |- + TlsSecretName defines secretname at the VMAuth namespace with cert and key + https://kubernetes.io/docs/concepts/services-networking/ingress/#tls type: string type: object initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array - internalListenPort: - type: string license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) properties: forceOffline: + description: Enforce offline verification of the license key. type: boolean key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) type: string keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. type: string type: object livenessProbe: + description: LivenessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true logFormat: + description: LogFormat for VMAuth to be configured with. enum: - default - json type: string logLevel: + description: LogLevel for victoria metrics single to be configured + with. enum: - INFO - WARN @@ -13615,87 +15373,164 @@ spec: - PANIC type: string managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object type: object minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle format: int32 type: integer nodeSelector: additionalProperties: type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. type: object paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. type: boolean podDisruptionBudget: + description: PodDisruptionBudget created by operator properties: maxUnavailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". x-kubernetes-int-or-string: true minAvailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". x-kubernetes-int-or-string: true selectorLabels: additionalProperties: type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string type: object podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the VMAuth pods. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object port: + description: Port listen address type: string priorityClassName: + description: PriorityClassName class assigned to the Pods type: string readinessGates: + description: ReadinessGates defines pod readiness gates items: + description: PodReadinessGate contains the reference to a pod condition properties: conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. type: string required: - conditionType type: object type: array readinessProbe: + description: ReadinessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true replicaCount: + description: ReplicaCount is the expected size of the Application. format: int32 type: integer resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -13711,6 +15546,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -13719,91 +15557,167 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. format: int32 type: integer - rollingUpdate: - properties: - maxSurge: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ type: string schedulerName: + description: SchedulerName - defines kubernetes scheduler name type: string secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder items: type: string type: array securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. type: object x-kubernetes-preserve-unknown-fields: true selectAllByDefault: + description: |- + SelectAllByDefault changes default behavior for empty CRD selectors, such userSelector. + with selectAllByDefault: true and empty userSelector and userNamespaceSelector + Operator selects all exist users + with selectAllByDefault: false - selects nothing type: boolean serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods type: string serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmauth VMServiceScrape + spec required: - endpoints type: object x-kubernetes-preserve-unknown-fields: true serviceSpec: + description: ServiceSpec that will be added to vmsingle service spec properties: metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ type: object x-kubernetes-preserve-unknown-fields: true useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication type: boolean required: - spec type: object startupProbe: + description: StartupProbe that will be added to CRD pod type: object x-kubernetes-preserve-unknown-fields: true terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination format: int64 type: integer tolerations: + description: Tolerations If specified, the pod's tolerations. items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . properties: effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. required: - maxSkew - topologyKey @@ -13812,24 +15726,54 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array unauthorizedAccessConfig: + description: |- + UnauthorizedAccessConfig configures access for un authorized users + + Deprecated, use unauthorizedUserAccessSpec instead + will be removed at v1.0 release x-kubernetes-preserve-unknown-fields: true unauthorizedUserAccessSpec: + description: UnauthorizedUserAccessSpec defines unauthorized_user + config section of vmauth config properties: default_url: + description: |- + DefaultURLs backend url for non-matching paths filter + usually used for default backend with error message items: type: string type: array discover_backend_ips: + description: DiscoverBackendIPs instructs discovering URLPrefix + backend IPs via DNS. type: boolean drop_src_path_prefix_parts: + description: |- + DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend. + See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details. type: integer dump_request_on_errors: + description: |- + DumpRequestOnErrors instructs vmauth to return detailed request params to the client + if routing rules don't allow to forward request to the backends. + Useful for debugging `src_hosts` and `src_headers` based routing rules + + available since v1.107.0 vmauth version type: boolean headers: + description: |- + Headers represent additional http headers, that vmauth uses + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.68.0 version of vmauth items: type: string type: array ip_filters: + description: |- + IPFilters defines per target src ip filters + supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/vmauth/#ip-filters) properties: allow_list: items: @@ -13841,180 +15785,93 @@ spec: type: array type: object load_balancing_policy: + description: |- + LoadBalancingPolicy defines load balancing policy to use for backend urls. + Supported policies: least_loaded, first_available. + See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded") enum: - least_loaded - first_available type: string max_concurrent_requests: + description: |- + MaxConcurrentRequests defines max concurrent requests per user + 300 is default value for vmauth type: integer metric_labels: additionalProperties: type: string + description: MetricLabels - additional labels for metrics exported + by vmauth for given user. type: object response_headers: + description: |- + ResponseHeaders represent additional http headers, that vmauth adds for request response + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.93.0 version of vmauth items: type: string type: array retry_status_codes: + description: |- + RetryStatusCodes defines http status codes in numeric format for request retries + e.g. [429,503] items: type: integer type: array - targetRefs: - items: - properties: - crd: - properties: - kind: - enum: - - VMAgent - - VMAlert - - VMSingle - - VLogs - - VMAlertManager - - VMAlertmanager - - VMCluster/vmselect - - VMCluster/vmstorage - - VMCluster/vminsert - - VLSingle - - VLCluster/vlinsert - - VLCluster/vlselect - - VLCluster/vlstorage - - VLAgent - - VTCluster/vtinsert - - VTCluster/vtselect - - VTCluster/vtstorage - - VTSingle - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - - namespace - type: object - discover_backend_ips: - type: boolean - drop_src_path_prefix_parts: - type: integer - headers: - items: - type: string - type: array - hosts: - items: - type: string - type: array - load_balancing_policy: - enum: - - least_loaded - - first_available - type: string - paths: - items: - type: string - type: array - query_args: - items: - properties: - name: - type: string - values: - items: - type: string - type: array - required: - - name - - values - type: object - type: array - response_headers: - items: - type: string - type: array - retry_status_codes: - items: - type: integer - type: array - src_headers: - items: - type: string - type: array - src_query_args: - items: - type: string - type: array - static: - properties: - url: - type: string - urls: - items: - type: string - type: array - type: object - target_path_suffix: - type: string - targetRefBasicAuth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - required: - - password - - username - type: object - type: object - type: array tlsConfig: + description: TLSConfig defines tls configuration for the backend + connection properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -14022,30 +15879,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use for + the targets. type: string cert: + description: Struct containing the client cert file for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -14053,97 +15936,181 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object url_map: items: + description: |- + UnauthorizedAccessConfigURLMap defines element of url_map routing configuration + For UnauthorizedAccessConfig and VMAuthUnauthorizedUserAccessSpec.URLMap properties: discover_backend_ips: + description: DiscoverBackendIPs instructs discovering URLPrefix + backend IPs via DNS. type: boolean drop_src_path_prefix_parts: + description: |- + DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend. + See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details. type: integer headers: + description: |- + RequestHeaders represent additional http headers, that vmauth uses + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.68.0 version of vmauth items: type: string type: array load_balancing_policy: + description: |- + LoadBalancingPolicy defines load balancing policy to use for backend urls. + Supported policies: least_loaded, first_available. + See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded") enum: - least_loaded - first_available type: string response_headers: + description: |- + ResponseHeaders represent additional http headers, that vmauth adds for request response + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.93.0 version of vmauth items: type: string type: array retry_status_codes: + description: |- + RetryStatusCodes defines http status codes in numeric format for request retries + Can be defined per target or at VMUser.spec level + e.g. [429,503] items: type: integer type: array src_headers: + description: SrcHeaders is an optional list of headers, + which must match request headers. items: type: string type: array src_hosts: + description: SrcHosts is an optional list of regular expressions, + which must match the request hostname. items: type: string type: array src_paths: + description: SrcPaths is an optional list of regular expressions, + which must match the request path. items: type: string type: array src_query_args: + description: SrcQueryArgs is an optional list of query args, + which must match request URL query args. items: type: string type: array url_prefix: + description: |- + UrlPrefix contains backend url prefixes for the proxied request url. + URLPrefix defines prefix prefix for destination x-kubernetes-preserve-unknown-fields: true type: object type: array url_prefix: + description: URLPrefix defines prefix prefix for destination x-kubernetes-preserve-unknown-fields: true type: object - updateStrategy: - enum: - - Recreate - - RollingUpdate - type: string useDefaultResources: - type: boolean - useProxyProtocol: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements type: boolean useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions type: boolean useVMConfigReloader: + description: |- + UseVMConfigReloader replaces prometheus-like config-reloader + with vm one. It uses secrets watch instead of file watch + which greatly increases speed of config updates type: boolean userNamespaceSelector: + description: |- + UserNamespaceSelector Namespaces to be selected for VMAuth discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAuth namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -14157,19 +16124,43 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic userSelector: + description: |- + UserSelector defines VMUser to be selected for config file generation. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAuth namespace. + If both nil - behaviour controlled by selectAllByDefault properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -14183,25 +16174,73 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container items: + description: VolumeMount describes a mounting of a Volume within + a container. properties: mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. type: string mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. type: boolean recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. type: string subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -14209,126 +16248,73 @@ spec: type: object type: array volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object type: object x-kubernetes-preserve-unknown-fields: true status: + description: VMAuthStatus defines the observed state of VMAuth properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -14343,11 +16329,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -14360,7 +16351,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmclusters.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -14394,67 +16385,146 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMCluster is fast, cost-effective and scalable time-series database. + Cluster version with properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMClusterSpec defines the desired state of VMCluster properties: clusterDomainName: + description: |- + ClusterDomainName defines domain name suffix for in-cluster dns addresses + aka .cluster.local + used by vminsert and vmselect to build vmstorage address type: string clusterVersion: + description: |- + ClusterVersion defines default images tag for all components. + it can be overwritten with component specific image.tag value. type: string imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic type: array license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) properties: forceOffline: + description: Enforce offline verification of the license key. type: boolean key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) type: string keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. type: string type: object managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object type: object paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. type: boolean replicationFactor: + description: |- + ReplicationFactor defines how many copies of data make among + distinct storage nodes format: int32 type: integer requestsLoadBalancer: + description: |- + RequestsLoadBalancer configures load-balancing for vminsert and vmselect requests + it helps to evenly spread load across pods + usually it's not possible with kubernetes TCP based service properties: disableInsertBalancing: type: boolean @@ -14463,75 +16533,157 @@ spec: enabled: type: boolean spec: + description: |- + VMAuthLoadBalancerSpec defines configuration spec for VMAuth used as load-balancer + for VMCluster component type: object x-kubernetes-preserve-unknown-fields: true type: object retentionPeriod: - pattern: ^[0-9]+(h|d|w|y)?$ + description: |- + RetentionPeriod for the stored metrics + Note VictoriaMetrics has data/ and indexdb/ folders + metrics from data/ removed eventually as soon as partition leaves retention period + reverse index data at indexdb rotates once at the half of configured + [retention period](https://docs.victoriametrics.com/Single-server-VictoriaMetrics/#retention) type: string serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run the + VMSelect, VMStorage and VMInsert Pods. type: string useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions type: boolean vminsert: properties: affinity: + description: Affinity If specified, the pod's scheduling constraints. type: object x-kubernetes-preserve-unknown-fields: true clusterNativeListenPort: + description: |- + ClusterNativePort for multi-level cluster setup. + More [details](https://docs.victoriametrics.com/Cluster-VictoriaMetrics#multi-level-cluster-setup) type: string configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder items: type: string type: array containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. items: + description: A single application container that you want to + run within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. type: boolean disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable type: boolean dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. items: x-kubernetes-preserve-unknown-fields: true properties: nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array x-kubernetes-list-type: atomic options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: |- + Name is this DNS resolver option's name. + Required. type: string value: + description: Value is this DNS resolver option's value. type: string type: object type: array x-kubernetes-list-type: atomic searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. items: type: string type: array x-kubernetes-list-type: atomic type: object dnsPolicy: + description: DNSPolicy sets DNS policy for the pod type: string extraArgs: additionalProperties: type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp type: object extraEnvs: + description: ExtraEnvs that will be passed to the application + container items: + description: EnvVar represents an environment variable present + in a Container. properties: name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. type: string value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string required: - name @@ -14539,108 +16691,190 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap items: + description: EnvFromSource represents the source of a set of + ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap must be defined type: boolean type: object x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each key + in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret must be defined type: boolean type: object x-kubernetes-map-type: atomic type: object type: array host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostNetwork: + description: HostNetwork controls whether the pod may use the + node network namespace type: boolean hpa: + description: HPA defines kubernetes PodAutoScaling configuration + version 2. type: object x-kubernetes-preserve-unknown-fields: true image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config properties: pullPolicy: + description: PullPolicy describes how to pull docker image type: string repository: + description: Repository contains name of docker image + it's + repository if needed type: string tag: + description: Tag contains desired docker image version type: string type: object imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic type: array initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ items: + description: A single application container that you want to + run within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array insertPorts: + description: InsertPorts - additional listen ports for data ingestion. properties: graphitePort: + description: GraphitePort listen port type: string influxPort: + description: InfluxPort listen port type: string openTSDBHTTPPort: + description: OpenTSDBHTTPPort for http connections. type: string openTSDBPort: + description: OpenTSDBPort for tcp and udp listen type: string type: object livenessProbe: + description: LivenessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true logFormat: + description: |- + LogFormat for VMInsert to be configured with. + default or json enum: - default - json type: string logLevel: + description: LogLevel for VMInsert to be configured with. enum: - INFO - WARN @@ -14649,76 +16883,142 @@ spec: - PANIC type: string minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle format: int32 type: integer nodeSelector: additionalProperties: type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. type: object paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. type: boolean podDisruptionBudget: + description: PodDisruptionBudget created by operator properties: maxUnavailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". x-kubernetes-int-or-string: true minAvailable: anyOf: - type: integer - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". x-kubernetes-int-or-string: true selectorLabels: additionalProperties: type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string type: object podMetadata: + description: PodMetadata configures Labels and Annotations which + are propagated to the VMInsert pods. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object port: + description: Port listen address type: string priorityClassName: + description: PriorityClassName class assigned to the Pods type: string readinessGates: + description: ReadinessGates defines pod readiness gates items: + description: PodReadinessGate contains the reference to a pod + condition properties: conditionType: + description: ConditionType refers to a condition in the + pod's condition list with matching type. type: string required: - conditionType type: object type: array readinessProbe: + description: ReadinessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true replicaCount: + description: ReplicaCount is the expected size of the Application. format: int32 type: integer resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -14734,6 +17034,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -14742,87 +17045,194 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. format: int32 type: integer rollingUpdate: + description: RollingUpdate - overrides deployment update params. properties: maxSurge: anyOf: - type: integer - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. x-kubernetes-int-or-string: true maxUnavailable: anyOf: - type: integer - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. x-kubernetes-int-or-string: true type: object runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ type: string schedulerName: + description: SchedulerName - defines kubernetes scheduler name type: string secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder items: type: string type: array securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. type: object x-kubernetes-preserve-unknown-fields: true serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vminsert + VMServiceScrape spec required: - endpoints type: object x-kubernetes-preserve-unknown-fields: true serviceSpec: + description: ServiceSpec that will be added to vminsert service + spec properties: metadata: + description: EmbeddedObjectMetadata defines objectMeta for + additional service. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ type: object x-kubernetes-preserve-unknown-fields: true useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication type: boolean required: - spec type: object startupProbe: + description: StartupProbe that will be added to CRD pod type: object x-kubernetes-preserve-unknown-fields: true terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container + graceful termination format: int64 type: integer tolerations: + description: Tolerations If specified, the pod's tolerations. items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . properties: effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. required: - maxSkew - topologyKey @@ -14831,30 +17241,83 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array updateStrategy: + description: UpdateStrategy - overrides default update strategy. enum: - Recreate - RollingUpdate type: string useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements type: boolean useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions type: boolean volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container items: + description: VolumeMount describes a mounting of a Volume within + a container. properties: mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. type: string mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. type: boolean recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. type: string subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -14862,4371 +17325,161 @@ spec: type: object type: array volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object type: object vmselect: + description: VMSelect defines configuration section for vmselect components + of the victoria-metrics cluster properties: affinity: + description: Affinity If specified, the pod's scheduling constraints. type: object x-kubernetes-preserve-unknown-fields: true cacheMountPath: + description: |- + CacheMountPath allows to add cache persistent for VMSelect, + will use "/cache" as default if not specified. type: string claimTemplates: + description: ClaimTemplates allows adding additional VolumeClaimTemplates + for StatefulSet items: - type: object - type: array - clusterNativeListenPort: - type: string - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: + description: PersistentVolumeClaim is a user's request for and + claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: + x-kubernetes-preserve-unknown-fields: true + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - hpa: - type: object - x-kubernetes-preserve-unknown-fields: true - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: - type: string - whenScaled: - type: string - type: object - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdateStrategy: - type: string - rollingUpdateStrategyBehavior: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - storage: - properties: - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - volumeClaimTemplate: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - status: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - allocatedResourceStatuses: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: granular - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - conditions: - items: - properties: - lastProbeTime: - format: date-time - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentVolumeAttributesClassName: - type: string - modifyVolumeStatus: - properties: - status: - type: string - targetVolumeAttributesClassName: - type: string - required: - - status - type: object - phase: - type: string - type: object - type: object - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object - type: object - vmstorage: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - claimTemplates: - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - hpa: - properties: - behaviour: - properties: - scaleDown: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - scaleUp: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - maxReplicas: - format: int32 - type: integer - metrics: - items: - properties: - containerResource: - properties: - container: - type: string - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - container - - name - - target - type: object - external: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - object: - properties: - describedObject: - properties: - apiVersion: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - describedObject - - metric - - target - type: object - pods: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - resource: - properties: - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - name - - target - type: object - type: - type: string - required: - - type - type: object - type: array - minReplicas: - format: int32 - type: integer - type: object - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - maintenanceInsertNodeIDs: - items: - format: int32 - type: integer - type: array - maintenanceSelectNodeIDs: - items: - format: int32 - type: integer - type: array - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: - type: string - whenScaled: - type: string - type: object - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdateStrategy: - type: string - rollingUpdateStrategyBehavior: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - storage: - properties: - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - volumeClaimTemplate: - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - storageDataPath: - type: string - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - vmBackup: - properties: - acceptEULA: - type: boolean - concurrency: - format: int32 - type: integer - credentialsSecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - customS3Endpoint: - type: string - destination: - type: string - destinationDisableSuffixAdd: - type: boolean - disableDaily: - type: boolean - disableHourly: - type: boolean - disableMonthly: - type: boolean - disableWeekly: - type: boolean - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - port: - type: string - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - restore: - properties: - onStart: - properties: - enabled: - type: boolean - type: object - type: object - snapshotCreateURL: - type: string - snapshotDeleteURL: - type: string - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - type: object - vmInsertPort: - type: string - vmSelectPort: - type: string - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object - type: object - type: object - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: - type: string - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vmdistributed.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VMDistributed - listKind: VMDistributedList - plural: vmdistributed - singular: vmdistributed - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: current status of update rollout - jsonPath: .status.updateStatus - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - license: - properties: - forceOffline: - type: boolean - key: - type: string - keyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - reloadInterval: - type: string - type: object - paused: - type: boolean - retain: - type: boolean - vmauth: - properties: - enabled: - default: true - type: boolean - name: - type: string - spec: - properties: - affinity: - properties: - nodeAffinity: - properties: - preferredDuringSchedulingIgnoredDuringExecution: - items: - properties: - preference: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - properties: - nodeSelectorTerms: - items: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - properties: - preferredDuringSchedulingIgnoredDuringExecution: - items: - properties: - podAffinityTerm: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - weight: - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - items: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - properties: - preferredDuringSchedulingIgnoredDuringExecution: - items: - properties: - podAffinityTerm: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - weight: - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - items: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - configMaps: - items: - type: string - type: array - configReloadAuthKeySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - configReloaderExtraArgs: - additionalProperties: - type: string - type: object - configReloaderImage: - type: string - configReloaderImageTag: - type: string - configReloaderResources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - configSecret: - type: string - containers: - items: - properties: - args: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - envFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - image: - type: string - imagePullPolicy: - type: string - lifecycle: + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: - postStart: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - stopSignal: - type: string - type: object - livenessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - name: - type: string - ports: - items: - properties: - containerPort: - format: int32 - type: integer - hostIP: - type: string - hostPort: - format: int32 - type: integer - name: - type: string - protocol: - default: TCP - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - resizePolicy: - items: - properties: - resourceName: - type: string - restartPolicy: - type: string - required: - - resourceName - - restartPolicy - type: object - type: array - x-kubernetes-list-type: atomic - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - restartPolicy: - type: string - restartPolicyRules: - items: - properties: - action: - type: string - exitCodes: - properties: - operator: - type: string - values: - items: - format: int32 - type: integer - type: array - x-kubernetes-list-type: set - required: - - operator - type: object - required: - - action - type: object - type: array - x-kubernetes-list-type: atomic - securityContext: - properties: - allowPrivilegeEscalation: - type: boolean - appArmorProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - capabilities: - properties: - add: - items: - type: string - type: array - x-kubernetes-list-type: atomic - drop: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - privileged: - type: boolean - procMount: - type: string - readOnlyRootFilesystem: - type: boolean - runAsGroup: - format: int64 - type: integer - runAsNonRoot: - type: boolean - runAsUser: - format: int64 - type: integer - seLinuxOptions: - properties: - level: - type: string - role: - type: string - type: - type: string - user: - type: string - type: object - seccompProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - windowsOptions: - properties: - gmsaCredentialSpec: - type: string - gmsaCredentialSpecName: - type: string - hostProcess: - type: boolean - runAsUserName: - type: string - type: object - type: object - startupProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - stdin: - type: boolean - stdinOnce: - type: boolean - terminationMessagePath: - type: string - terminationMessagePolicy: - type: string - tty: - type: boolean - volumeDevices: - items: - properties: - devicePath: - type: string - name: - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - devicePath - x-kubernetes-list-type: map - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map - workingDir: - type: string - required: - - name - type: object - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - externalConfig: - properties: - localPath: - type: string - secretRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - hpa: - properties: - behaviour: - properties: - scaleDown: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - scaleUp: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - maxReplicas: - format: int32 - type: integer - metrics: - items: - properties: - containerResource: - properties: - container: - type: string - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - container - - name - - target - type: object - external: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - object: - properties: - describedObject: - properties: - apiVersion: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - describedObject - - metric - - target - type: object - pods: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - resource: - properties: - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - name - - target - type: object - type: - type: string - required: - - type - type: object - type: array - minReplicas: - format: int32 - type: integer - type: object - httpRoute: - properties: - annotations: - additionalProperties: - type: string - type: object - extraRules: - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - x-kubernetes-preserve-unknown-fields: true - hostnames: - items: - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - parentRefs: - items: - properties: - group: - default: gateway.networking.k8s.io - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: - default: Gateway - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + description: Kind is the type of resource being + referenced type: string name: - maxLength: 253 - minLength: 1 - type: string - namespace: - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + description: Name is the name of resource being + referenced type: string required: + - kind - name type: object - type: array - type: object - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - ingress: - properties: - annotations: - additionalProperties: - type: string - type: object - class_name: - type: string - extraRules: - items: + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: - host: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string - http: - properties: - paths: - items: - properties: - backend: - properties: - resource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - service: - properties: - name: - type: string - port: - properties: - name: - type: string - number: - format: int32 - type: integer - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - type: object - path: - type: string - pathType: - type: string - required: - - backend - - pathType - type: object - type: array - x-kubernetes-list-type: atomic - required: - - paths - type: object - type: object - type: array - extraTls: - items: - properties: - hosts: - items: - type: string - type: array - x-kubernetes-list-type: atomic - secretName: + kind: + description: Kind is the type of resource being + referenced type: string - type: object - type: array - host: - type: string - labels: - additionalProperties: - type: string - type: object - name: - type: string - paths: - items: - type: string - type: array - tlsHosts: - items: - type: string - type: array - tlsSecretName: - type: string - type: object - initContainers: - items: - properties: - args: - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind - name - x-kubernetes-list-type: map - envFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - image: - type: string - imagePullPolicy: - type: string - lifecycle: - properties: - postStart: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - stopSignal: - type: string type: object - livenessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - name: - type: string - ports: - items: - properties: - containerPort: - format: int32 - type: integer - hostIP: - type: string - hostPort: - format: int32 - type: integer - name: - type: string - protocol: - default: TCP - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - resizePolicy: - items: - properties: - resourceName: - type: string - restartPolicy: - type: string - required: - - resourceName - - restartPolicy - type: object - type: array - x-kubernetes-list-type: atomic resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -19234,6 +17487,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -19242,1381 +17498,40 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object - restartPolicy: - type: string - restartPolicyRules: - items: - properties: - action: - type: string - exitCodes: - properties: - operator: - type: string - values: - items: - format: int32 - type: integer - type: array - x-kubernetes-list-type: set - required: - - operator - type: object - required: - - action - type: object - type: array - x-kubernetes-list-type: atomic - securityContext: - properties: - allowPrivilegeEscalation: - type: boolean - appArmorProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - capabilities: - properties: - add: - items: - type: string - type: array - x-kubernetes-list-type: atomic - drop: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - privileged: - type: boolean - procMount: - type: string - readOnlyRootFilesystem: - type: boolean - runAsGroup: - format: int64 - type: integer - runAsNonRoot: - type: boolean - runAsUser: - format: int64 - type: integer - seLinuxOptions: - properties: - level: - type: string - role: - type: string - type: - type: string - user: - type: string - type: object - seccompProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - windowsOptions: - properties: - gmsaCredentialSpec: - type: string - gmsaCredentialSpecName: - type: string - hostProcess: - type: boolean - runAsUserName: - type: string - type: object - type: object - startupProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - stdin: - type: boolean - stdinOnce: - type: boolean - terminationMessagePath: - type: string - terminationMessagePolicy: - type: string - tty: - type: boolean - volumeDevices: - items: - properties: - devicePath: - type: string - name: - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - devicePath - x-kubernetes-list-type: map - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map - workingDir: - type: string - required: - - name - type: object - type: array - internalListenPort: - type: string - license: - properties: - forceOffline: - type: boolean - key: - type: string - keyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - reloadInterval: - type: string - type: object - livenessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - managedMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdate: - properties: - maxSurge: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - properties: - allowPrivilegeEscalation: - type: boolean - appArmorProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - capabilities: - properties: - add: - items: - type: string - type: array - x-kubernetes-list-type: atomic - drop: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - fsGroup: - format: int64 - type: integer - fsGroupChangePolicy: - type: string - privileged: - type: boolean - procMount: - type: string - readOnlyRootFilesystem: - type: boolean - runAsGroup: - format: int64 - type: integer - runAsNonRoot: - type: boolean - runAsUser: - format: int64 - type: integer - seLinuxChangePolicy: - type: string - seLinuxOptions: - properties: - level: - type: string - role: - type: string - type: - type: string - user: - type: string - type: object - seccompProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - supplementalGroups: - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - supplementalGroupsPolicy: - type: string - sysctls: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - windowsOptions: - properties: - gmsaCredentialSpec: - type: string - gmsaCredentialSpecName: - type: string - hostProcess: - type: boolean - runAsUserName: - type: string - type: object - type: object - selectAllByDefault: - type: boolean - serviceAccountName: - type: string - serviceScrapeSpec: - properties: - attach_metadata: - properties: - namespace: - type: boolean - node: - type: boolean - type: object - discoveryRole: - enum: - - endpoints - - service - - endpointslices - - endpointslice - type: string - endpoints: - items: - properties: - attach_metadata: - properties: - namespace: - type: boolean - node: - type: boolean - type: object - authorization: - properties: - credentials: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - credentialsFile: - type: string - type: - type: string - type: object - basicAuth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - password_file: - type: string - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - bearerTokenFile: - type: string - bearerTokenSecret: - nullable: true - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - follow_redirects: - type: boolean - honorLabels: - type: boolean - honorTimestamps: - type: boolean - interval: - type: string - max_scrape_size: - type: string - metricRelabelConfigs: - items: - properties: - action: - type: string - if: - x-kubernetes-preserve-unknown-fields: true - labels: - additionalProperties: - type: string - type: object - match: - type: string - modulus: - format: int64 - type: integer - regex: - x-kubernetes-preserve-unknown-fields: true - replacement: - type: string - separator: - type: string - source_labels: - items: - type: string - type: array - sourceLabels: - items: - type: string - type: array - target_label: - type: string - targetLabel: - type: string - type: object - type: array - oauth2: - properties: - client_id: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - client_secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - client_secret_file: - type: string - endpoint_params: - additionalProperties: - type: string - type: object - proxy_url: - type: string - scopes: - items: - type: string - type: array - tls_config: - x-kubernetes-preserve-unknown-fields: true - token_url: - minLength: 1 - type: string - required: - - client_id - - token_url - type: object - params: - additionalProperties: - items: - type: string - type: array - type: object - path: - type: string - port: - type: string - proxyURL: - type: string - relabelConfigs: - items: - properties: - action: - type: string - if: - x-kubernetes-preserve-unknown-fields: true - labels: - additionalProperties: - type: string - type: object - match: - type: string - modulus: - format: int64 - type: integer - regex: - x-kubernetes-preserve-unknown-fields: true - replacement: - type: string - separator: - type: string - source_labels: - items: - type: string - type: array - sourceLabels: - items: - type: string - type: array - target_label: - type: string - targetLabel: - type: string - type: object - type: array - sampleLimit: - type: integer - scheme: - enum: - - http - - https - - HTTPS - - HTTP - type: string - scrape_interval: - type: string - scrapeTimeout: - type: string - seriesLimit: - type: integer - targetPort: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - tlsConfig: - properties: - ca: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - caFile: - type: string - cert: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - certFile: - type: string - insecureSkipVerify: - type: boolean - keyFile: - type: string - keySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - serverName: - type: string - type: object - vm_scrape_params: - properties: - disable_compression: - type: boolean - disable_keep_alive: - type: boolean - headers: - items: - type: string - type: array - no_stale_markers: - type: boolean - proxy_client_config: - properties: - basic_auth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - password_file: - type: string - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - bearer_token: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - bearer_token_file: - type: string - tls_config: - x-kubernetes-preserve-unknown-fields: true - type: object - scrape_align_interval: - type: string - scrape_offset: - type: string - stream_parse: - type: boolean - type: object - type: object - type: array - jobLabel: - type: string - namespaceSelector: - properties: - any: - type: boolean - matchNames: - items: - type: string - type: array - type: object - podTargetLabels: - items: - type: string - type: array - sampleLimit: - type: integer - scrapeClass: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - seriesLimit: - type: integer - targetLabels: - items: - type: string - type: array - required: - - endpoints - type: object - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - properties: - allocateLoadBalancerNodePorts: - type: boolean - clusterIP: - type: string - clusterIPs: - items: - type: string - type: array - x-kubernetes-list-type: atomic - externalIPs: - items: - type: string - type: array - x-kubernetes-list-type: atomic - externalName: - type: string - externalTrafficPolicy: - type: string - healthCheckNodePort: - format: int32 - type: integer - internalTrafficPolicy: - type: string - ipFamilies: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ipFamilyPolicy: - type: string - loadBalancerClass: - type: string - loadBalancerIP: - type: string - loadBalancerSourceRanges: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ports: - items: - properties: - appProtocol: - type: string - name: - type: string - nodePort: - format: int32 - type: integer - port: - format: int32 - type: integer - protocol: - default: TCP - type: string - targetPort: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: array - x-kubernetes-list-map-keys: - - port - - protocol - x-kubernetes-list-type: map - publishNotReadyAddresses: - type: boolean - selector: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: atomic - sessionAffinity: - type: string - sessionAffinityConfig: - properties: - clientIP: - properties: - timeoutSeconds: - format: int32 - type: integer - type: object - type: object - trafficDistribution: - type: string - type: - type: string - type: object - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - properties: - labelSelector: + selector: + description: selector is a label query over volumes + to consider for binding. properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -20630,7797 +17545,1621 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic - matchLabelKeys: + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic - maxSkew: - format: int32 - type: integer - minDomains: - format: int32 - type: integer - nodeAffinityPolicy: - type: string - nodeTaintsPolicy: - type: string - topologyKey: - type: string - whenUnsatisfiable: - type: string - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - type: array - unauthorizedAccessConfig: - x-kubernetes-preserve-unknown-fields: true - unauthorizedUserAccessSpec: - properties: - default_url: - items: - type: string - type: array - discover_backend_ips: - type: boolean - drop_src_path_prefix_parts: - type: integer - dump_request_on_errors: - type: boolean - headers: - items: - type: string - type: array - ip_filters: - properties: - allow_list: - items: - type: string - type: array - deny_list: - items: - type: string - type: array - type: object - load_balancing_policy: - enum: - - least_loaded - - first_available - type: string - max_concurrent_requests: - type: integer - metric_labels: - additionalProperties: - type: string - type: object - response_headers: - items: - type: string - type: array - retry_status_codes: - items: - type: integer - type: array - targetRefs: - items: - properties: - crd: - properties: - kind: - enum: - - VMAgent - - VMAlert - - VMSingle - - VLogs - - VMAlertManager - - VMAlertmanager - - VMCluster/vmselect - - VMCluster/vmstorage - - VMCluster/vminsert - - VLSingle - - VLCluster/vlinsert - - VLCluster/vlselect - - VLCluster/vlstorage - - VLAgent - - VTCluster/vtinsert - - VTCluster/vtselect - - VTCluster/vtstorage - - VTSingle - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - - namespace - type: object - discover_backend_ips: - type: boolean - drop_src_path_prefix_parts: - type: integer - headers: - items: - type: string - type: array - hosts: - items: - type: string - type: array - load_balancing_policy: - enum: - - least_loaded - - first_available - type: string - paths: - items: - type: string - type: array - query_args: - items: - properties: - name: - type: string - values: - items: - type: string - type: array - required: - - name - - values - type: object - type: array - response_headers: - items: - type: string - type: array - retry_status_codes: - items: - type: integer - type: array - src_headers: - items: - type: string - type: array - src_query_args: - items: - type: string - type: array - static: - properties: - url: - type: string - urls: - items: - type: string - type: array - type: object - target_path_suffix: - type: string - targetRefBasicAuth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - required: - - password - - username - type: object + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey + names follow standard Kubernetes label syntax. Valid + values are either:\n\t* Un-prefixed keys:\n\t\t- storage + - the capacity of the volume.\n\t* Custom resources + must use implementation-defined prefixed names such + as \"example.com/my-custom-resource\"\nApart from + above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not + be used.\n\nClaimResourceStatus can be in any of following + states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with + a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing the + volume but further resizing of\n\t\tvolume is needed + on the node.\n\t- NodeResizeInProgress:\n\t\tState + set when kubelet starts resizing the volume.\n\t- + NodeResizeFailed:\n\t\tState set when resizing has + failed in kubelet with a terminal error. Transient + errors don't set\n\t\tNodeResizeFailed.\nFor example: + if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress for + the given PVC.\n\nA controller that receives PVC update + with previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." type: object - type: array - tlsConfig: - properties: - ca: + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage + - the capacity of the volume.\n\t* Custom resources + must use implementation-defined prefixed names such + as \"example.com/my-custom-resource\"\nApart from + above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not + be used.\n\nCapacity reported here may be larger than + the actual capacity when a volume expansion operation\nis + requested.\nFor storage quota, the larger value from + allocatedResources and PVC.spec.resources is used.\nIf + allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume + expansion capacity request is lowered, allocatedResources + is only\nlowered if there are no expansion operations + in progress and if the actual volume capacity\nis + equal or lower than the requested capacity.\n\nA controller + that receives PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains + details about state of pvc properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - caFile: - type: string - cert: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - certFile: - type: string - insecureSkipVerify: - type: boolean - keyFile: - type: string - keySecret: - properties: - key: + lastProbeTime: + description: lastProbeTime is the time we probed + the condition. + format: date-time type: string - name: - default: "" + lastTransitionTime: + description: lastTransitionTime is the time the + condition transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about type: string - optional: - type: boolean required: - - key + - status + - type type: object - x-kubernetes-map-type: atomic - serverName: - type: string - type: object - url_map: - items: - properties: - discover_backend_ips: - type: boolean - drop_src_path_prefix_parts: - type: integer - headers: - items: - type: string - type: array - load_balancing_policy: - enum: - - least_loaded - - first_available - type: string - response_headers: - items: - type: string - type: array - retry_status_codes: - items: - type: integer - type: array - src_headers: - items: - type: string - type: array - src_hosts: - items: - type: string - type: array - src_paths: - items: - type: string - type: array - src_query_args: - items: - type: string - type: array - url_prefix: - x-kubernetes-preserve-unknown-fields: true - type: object - type: array - url_prefix: - x-kubernetes-preserve-unknown-fields: true - type: object - updateStrategy: - enum: - - Recreate - - RollingUpdate - type: string - useDefaultResources: - type: boolean - useProxyProtocol: - type: boolean - useStrictSecurity: - type: boolean - useVMConfigReloader: - type: boolean - userNamespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). type: string - type: object - type: object - x-kubernetes-map-type: atomic - userSelector: - properties: - matchExpressions: - items: + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). properties: - key: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, + such as\n the specified VolumeAttributesClass + not existing.\n - InProgress\n InProgress indicates + that the volume is being modified.\n - Infeasible\n + \ Infeasible indicates that the request has been + rejected as invalid by the CSI driver. To\n\t + \ resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can + be added in the future. Consumers should check + for unknown statuses and fail appropriately." type: string - operator: + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is + the name of the VolumeAttributesClass the PVC + currently being reconciled type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic required: - - key - - operator + - status type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: + phase: + description: phase represents the current phase of PersistentVolumeClaim. type: string - type: object - type: object - x-kubernetes-map-type: atomic - volumeMounts: + type: object + type: object + type: array + clusterNativeListenPort: + description: |- + ClusterNativePort for multi-level cluster setup. + More [details](https://docs.victoriametrics.com/Cluster-VictoriaMetrics#multi-level-cluster-setup) + type: string + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: - mountPath: - type: string - mountPropagation: - type: string name: + description: |- + Name is this DNS resolver option's name. + Required. type: string - readOnly: + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application + container + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of + ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name type: object - type: array - volumes: - items: + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key + in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from properties: - awsElasticBlockStore: - properties: - fsType: - type: string - partition: - format: int32 - type: integer - readOnly: - type: boolean - volumeID: - type: string - required: - - volumeID - type: object - azureDisk: - properties: - cachingMode: - type: string - diskName: - type: string - diskURI: - type: string - fsType: - default: ext4 - type: string - kind: - type: string - readOnly: - default: false - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - properties: - readOnly: - type: boolean - secretName: - type: string - shareName: - type: string - required: - - secretName - - shareName - type: object - cephfs: - properties: - monitors: - items: - type: string - type: array - x-kubernetes-list-type: atomic - path: - type: string - readOnly: - type: boolean - secretFile: - type: string - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - user: - type: string - required: - - monitors - type: object - cinder: - properties: - fsType: - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - volumeID: - type: string - required: - - volumeID - type: object - configMap: - properties: - defaultMode: - format: int32 - type: integer - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - csi: - properties: - driver: - type: string - fsType: - type: string - nodePublishSecretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - readOnly: - type: boolean - volumeAttributes: - additionalProperties: - type: string - type: object - required: - - driver - type: object - downwardAPI: - properties: - defaultMode: - format: int32 - type: integer - items: - items: - properties: - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - format: int32 - type: integer - path: - type: string - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - x-kubernetes-list-type: atomic - type: object - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - properties: - volumeClaimTemplate: - properties: - metadata: - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - required: - - spec - type: object - type: object - fc: - properties: - fsType: - type: string - lun: - format: int32 - type: integer - readOnly: - type: boolean - targetWWNs: - items: - type: string - type: array - x-kubernetes-list-type: atomic - wwids: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - flexVolume: - properties: - driver: - type: string - fsType: - type: string - options: - additionalProperties: - type: string - type: object - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - required: - - driver - type: object - flocker: - properties: - datasetName: - type: string - datasetUUID: - type: string - type: object - gcePersistentDisk: - properties: - fsType: - type: string - partition: - format: int32 - type: integer - pdName: - type: string - readOnly: - type: boolean - required: - - pdName - type: object - gitRepo: - properties: - directory: - type: string - repository: - type: string - revision: - type: string - required: - - repository - type: object - glusterfs: - properties: - endpoints: - type: string - path: - type: string - readOnly: - type: boolean - required: - - endpoints - - path - type: object - hostPath: - properties: - path: - type: string - type: - type: string - required: - - path - type: object - image: - properties: - pullPolicy: - type: string - reference: - type: string - type: object - iscsi: - properties: - chapAuthDiscovery: - type: boolean - chapAuthSession: - type: boolean - fsType: - type: string - initiatorName: - type: string - iqn: - type: string - iscsiInterface: - default: default - type: string - lun: - format: int32 - type: integer - portals: - items: - type: string - type: array - x-kubernetes-list-type: atomic - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - targetPortal: - type: string - required: - - iqn - - lun - - targetPortal - type: object name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - nfs: - properties: - path: - type: string - readOnly: - type: boolean - server: - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - properties: - claimName: - type: string - readOnly: - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - properties: - fsType: - type: string - pdID: - type: string - required: - - pdID - type: object - portworxVolume: - properties: - fsType: - type: string - readOnly: - type: boolean - volumeID: - type: string - required: - - volumeID - type: object - projected: - properties: - defaultMode: - format: int32 - type: integer - sources: - items: - properties: - clusterTrustBundle: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - name: - type: string - optional: - type: boolean - path: - type: string - signerName: - type: string - required: - - path - type: object - configMap: - properties: - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - downwardAPI: - properties: - items: - items: - properties: - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - format: int32 - type: integer - path: - type: string - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podCertificate: - properties: - certificateChainPath: - type: string - credentialBundlePath: - type: string - keyPath: - type: string - keyType: - type: string - maxExpirationSeconds: - format: int32 - type: integer - signerName: - type: string - required: - - keyType - - signerName - type: object - secret: - properties: - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - serviceAccountToken: - properties: - audience: - type: string - expirationSeconds: - format: int64 - type: integer - path: - type: string - required: - - path - type: object - type: object - type: array - x-kubernetes-list-type: atomic - type: object - quobyte: - properties: - group: - type: string - readOnly: - type: boolean - registry: - type: string - tenant: - type: string - user: - type: string - volume: - type: string - required: - - registry - - volume - type: object - rbd: - properties: - fsType: - type: string - image: - type: string - keyring: - default: /etc/ceph/keyring - type: string - monitors: - items: - type: string - type: array - x-kubernetes-list-type: atomic - pool: - default: rbd - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - user: - default: admin - type: string - required: - - image - - monitors - type: object - scaleIO: - properties: - fsType: - default: xfs - type: string - gateway: - type: string - protectionDomain: - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - sslEnabled: - type: boolean - storageMode: - default: ThinProvisioned - type: string - storagePool: - type: string - system: - type: string - volumeName: - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - properties: - defaultMode: - format: int32 - type: integer - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - optional: - type: boolean - secretName: - type: string - type: object - storageos: - properties: - fsType: - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - volumeName: - type: string - volumeNamespace: - type: string - type: object - vsphereVolume: - properties: - fsType: - type: string - storagePolicyID: - type: string - storagePolicyName: - type: string - volumePath: - type: string - required: - - volumePath - type: object - required: - - name + optional: + description: Specify whether the Secret must be defined + type: boolean type: object - type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object + x-kubernetes-map-type: atomic + type: object + type: array + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the + node network namespace + type: boolean + hpa: + description: |- + Configures horizontal pod autoscaling. + Note, enabling this option disables vmselect to vmselect communication. In most cases it's not an issue. type: object x-kubernetes-preserve-unknown-fields: true - type: object - zoneCommon: - properties: - readyTimeout: - type: string - remoteWrite: - x-kubernetes-preserve-unknown-fields: true - updatePause: - type: string - vmagent: + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config properties: - name: + pullPolicy: + description: PullPolicy describes how to pull docker image type: string - spec: + repository: + description: Repository contains name of docker image + it's + repository if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: |- + LogFormat for VMSelect to be configured with. + default or json + enum: + - default + - json + type: string + logLevel: + description: LogLevel for VMSelect to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + persistentVolume: + description: |- + Storage - add persistent volume for cacheMountPath + its useful for persistent cache + use storage instead of persistentVolume. + properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean + emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir properties: - affinity: - properties: - nodeAffinity: - properties: - preferredDuringSchedulingIgnoredDuringExecution: - items: - properties: - preference: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - properties: - nodeSelectorTerms: - items: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - properties: - preferredDuringSchedulingIgnoredDuringExecution: - items: - properties: - podAffinityTerm: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - weight: - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - items: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - properties: - preferredDuringSchedulingIgnoredDuringExecution: - items: - properties: - podAffinityTerm: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - weight: - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - items: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - claimTemplates: - items: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - status: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - allocatedResourceStatuses: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: granular - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - conditions: - items: - properties: - lastProbeTime: - format: date-time - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentVolumeAttributesClassName: - type: string - modifyVolumeStatus: - properties: - status: - type: string - targetVolumeAttributesClassName: - type: string - required: - - status - type: object - phase: - type: string - type: object - type: object - type: array - configMaps: - items: - type: string - type: array - containers: - items: - properties: - args: - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - envFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - image: - type: string - imagePullPolicy: - type: string - lifecycle: - properties: - postStart: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - stopSignal: - type: string - type: object - livenessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - name: - type: string - ports: - items: - properties: - containerPort: - format: int32 - type: integer - hostIP: - type: string - hostPort: - format: int32 - type: integer - name: - type: string - protocol: - default: TCP - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - resizePolicy: - items: - properties: - resourceName: - type: string - restartPolicy: - type: string - required: - - resourceName - - restartPolicy - type: object - type: array - x-kubernetes-list-type: atomic - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - restartPolicy: - type: string - restartPolicyRules: - items: - properties: - action: - type: string - exitCodes: - properties: - operator: - type: string - values: - items: - format: int32 - type: integer - type: array - x-kubernetes-list-type: set - required: - - operator - type: object - required: - - action - type: object - type: array - x-kubernetes-list-type: atomic - securityContext: - properties: - allowPrivilegeEscalation: - type: boolean - appArmorProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - capabilities: - properties: - add: - items: - type: string - type: array - x-kubernetes-list-type: atomic - drop: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - privileged: - type: boolean - procMount: - type: string - readOnlyRootFilesystem: - type: boolean - runAsGroup: - format: int64 - type: integer - runAsNonRoot: - type: boolean - runAsUser: - format: int64 - type: integer - seLinuxOptions: - properties: - level: - type: string - role: - type: string - type: - type: string - user: - type: string - type: object - seccompProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - windowsOptions: - properties: - gmsaCredentialSpec: - type: string - gmsaCredentialSpecName: - type: string - hostProcess: - type: boolean - runAsUserName: - type: string - type: object - type: object - startupProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - stdin: - type: boolean - stdinOnce: - type: boolean - terminationMessagePath: - type: string - terminationMessagePolicy: - type: string - tty: - type: boolean - volumeDevices: - items: - properties: - devicePath: - type: string - name: - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - devicePath - x-kubernetes-list-type: map - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map - workingDir: - type: string - required: - - name - type: object - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string - extraArgs: + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + podDisruptionBudget: + description: PodDisruptionBudget created by operator + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selectorLabels: + additionalProperties: + type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget + type: object + type: object + podMetadata: + description: PodMetadata configures Labels and Annotations which + are propagated to the VMSelect pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod + condition + properties: + conditionType: + description: ConditionType refers to a condition in the + pod's condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + rollingUpdateStrategy: + description: |- + RollingUpdateStrategy defines strategy for application updates + Default is OnDelete, in this case operator handles update process + Can be changed for RollingUpdate + type: string + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmselect + VMServiceScrape spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be added to vmselect service + spec + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for + additional service. + properties: + annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - properties: - args: - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - envFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - image: - type: string - imagePullPolicy: - type: string - lifecycle: - properties: - postStart: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - stopSignal: - type: string - type: object - livenessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - name: - type: string - ports: - items: - properties: - containerPort: - format: int32 - type: integer - hostIP: - type: string - hostPort: - format: int32 - type: integer - name: - type: string - protocol: - default: TCP - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - resizePolicy: - items: - properties: - resourceName: - type: string - restartPolicy: - type: string - required: - - resourceName - - restartPolicy - type: object - type: array - x-kubernetes-list-type: atomic - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - restartPolicy: - type: string - restartPolicyRules: - items: - properties: - action: - type: string - exitCodes: - properties: - operator: - type: string - values: - items: - format: int32 - type: integer - type: array - x-kubernetes-list-type: set - required: - - operator - type: object - required: - - action - type: object - type: array - x-kubernetes-list-type: atomic - securityContext: - properties: - allowPrivilegeEscalation: - type: boolean - appArmorProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - capabilities: - properties: - add: - items: - type: string - type: array - x-kubernetes-list-type: atomic - drop: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - privileged: - type: boolean - procMount: - type: string - readOnlyRootFilesystem: - type: boolean - runAsGroup: - format: int64 - type: integer - runAsNonRoot: - type: boolean - runAsUser: - format: int64 - type: integer - seLinuxOptions: - properties: - level: - type: string - role: - type: string - type: - type: string - user: - type: string - type: object - seccompProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - windowsOptions: - properties: - gmsaCredentialSpec: - type: string - gmsaCredentialSpecName: - type: string - hostProcess: - type: boolean - runAsUserName: - type: string - type: object - type: object - startupProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - stdin: - type: boolean - stdinOnce: - type: boolean - terminationMessagePath: - type: string - terminationMessagePolicy: - type: string - tty: - type: boolean - volumeDevices: - items: - properties: - devicePath: - type: string - name: - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - devicePath - x-kubernetes-list-type: map - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map - workingDir: - type: string - required: - - name - type: object - type: array - license: - properties: - forceOffline: - type: boolean - key: - type: string - keyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - reloadInterval: - type: string - type: object - livenessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - logFormat: - enum: - - default - - json + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + storage: + description: |- + StorageSpec - add persistent volume claim for cacheMountPath + its needed for persistent cache + properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean + emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string - managedMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: - type: string - whenScaled: - type: string - type: object - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: EmbeddedMetadata contains metadata relevant + to an EmbeddedResource. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: + spec: + description: |- + Spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - remoteWriteSettings: - properties: - flushInterval: - pattern: '[0-9]+(ms|s|m|h)' - type: string - label: - additionalProperties: - type: string - type: object - maxBlockSize: - format: int32 - type: integer - maxDiskUsagePerURL: - x-kubernetes-preserve-unknown-fields: true - queues: - format: int32 - type: integer - showURL: - type: boolean - tmpDataPath: - type: string - useMultiTenantMode: - type: boolean - type: object - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdate: - properties: - maxSurge: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - properties: - allowPrivilegeEscalation: - type: boolean - appArmorProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - capabilities: - properties: - add: - items: - type: string - type: array - x-kubernetes-list-type: atomic - drop: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - fsGroup: - format: int64 - type: integer - fsGroupChangePolicy: - type: string - privileged: - type: boolean - procMount: - type: string - readOnlyRootFilesystem: - type: boolean - runAsGroup: - format: int64 - type: integer - runAsNonRoot: - type: boolean - runAsUser: - format: int64 - type: integer - seLinuxChangePolicy: - type: string - seLinuxOptions: - properties: - level: - type: string - role: - type: string - type: - type: string - user: - type: string - type: object - seccompProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - supplementalGroups: - items: - format: int64 - type: integer + type: string type: array x-kubernetes-list-type: atomic - supplementalGroupsPolicy: - type: string - sysctls: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - windowsOptions: + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: - gmsaCredentialSpec: - type: string - gmsaCredentialSpecName: - type: string - hostProcess: - type: boolean - runAsUserName: - type: string - type: object - type: object - serviceAccountName: - type: string - startupProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - statefulMode: - type: boolean - statefulRollingUpdateStrategy: - type: string - statefulRollingUpdateStrategyBehavior: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - statefulStorage: - properties: - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - volumeClaimTemplate: - properties: - apiVersion: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being + referenced type: string - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - status: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - allocatedResourceStatuses: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: granular - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - conditions: - items: - properties: - lastProbeTime: - format: date-time - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentVolumeAttributesClassName: - type: string - modifyVolumeStatus: - properties: - status: - type: string - targetVolumeAttributesClassName: - type: string - required: - - status - type: object - phase: - type: string - type: object + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name type: object - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string - type: array - x-kubernetes-list-type: atomic - maxSkew: - format: int32 - type: integer - minDomains: - format: int32 - type: integer - nodeAffinityPolicy: - type: string - nodeTaintsPolicy: - type: string - topologyKey: - type: string - whenUnsatisfiable: - type: string - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - type: array - updateStrategy: - enum: - - Recreate - - RollingUpdate - type: string - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - properties: - awsElasticBlockStore: - properties: - fsType: - type: string - partition: - format: int32 - type: integer - readOnly: - type: boolean - volumeID: - type: string - required: - - volumeID - type: object - azureDisk: - properties: - cachingMode: - type: string - diskName: - type: string - diskURI: - type: string - fsType: - default: ext4 - type: string - kind: - type: string - readOnly: - default: false - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - properties: - readOnly: - type: boolean - secretName: - type: string - shareName: - type: string - required: - - secretName - - shareName - type: object - cephfs: - properties: - monitors: - items: - type: string - type: array - x-kubernetes-list-type: atomic - path: - type: string - readOnly: - type: boolean - secretFile: - type: string - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - user: - type: string - required: - - monitors - type: object - cinder: - properties: - fsType: - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - volumeID: - type: string - required: - - volumeID - type: object - configMap: - properties: - defaultMode: - format: int32 - type: integer - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - csi: - properties: - driver: - type: string - fsType: - type: string - nodePublishSecretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - readOnly: - type: boolean - volumeAttributes: - additionalProperties: - type: string - type: object - required: - - driver - type: object - downwardAPI: - properties: - defaultMode: - format: int32 - type: integer - items: - items: - properties: - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - format: int32 - type: integer - path: - type: string - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - x-kubernetes-list-type: atomic - type: object - emptyDir: - properties: - medium: - type: string - sizeLimit: + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - type: object - ephemeral: - properties: - volumeClaimTemplate: - properties: - metadata: - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - required: - - spec - type: object - type: object - fc: - properties: - fsType: - type: string - lun: - format: int32 - type: integer - readOnly: - type: boolean - targetWWNs: - items: - type: string - type: array - x-kubernetes-list-type: atomic - wwids: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - flexVolume: - properties: - driver: - type: string - fsType: - type: string - options: - additionalProperties: - type: string - type: object - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - required: - - driver - type: object - flocker: - properties: - datasetName: - type: string - datasetUUID: - type: string - type: object - gcePersistentDisk: - properties: - fsType: - type: string - partition: - format: int32 - type: integer - pdName: - type: string - readOnly: - type: boolean - required: - - pdName - type: object - gitRepo: - properties: - directory: - type: string - repository: - type: string - revision: - type: string - required: - - repository - type: object - glusterfs: - properties: - endpoints: - type: string - path: - type: string - readOnly: - type: boolean - required: - - endpoints - - path - type: object - hostPath: - properties: - path: - type: string - type: - type: string - required: - - path - type: object - image: - properties: - pullPolicy: - type: string - reference: - type: string - type: object - iscsi: - properties: - chapAuthDiscovery: - type: boolean - chapAuthSession: - type: boolean - fsType: - type: string - initiatorName: - type: string - iqn: - type: string - iscsiInterface: - default: default - type: string - lun: - format: int32 - type: integer - portals: - items: - type: string - type: array - x-kubernetes-list-type: atomic - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - targetPortal: - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - type: string - nfs: - properties: - path: - type: string - readOnly: - type: boolean - server: - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - properties: - claimName: - type: string - readOnly: - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - properties: - fsType: - type: string - pdID: - type: string - required: - - pdID - type: object - portworxVolume: - properties: - fsType: - type: string - readOnly: - type: boolean - volumeID: - type: string - required: - - volumeID - type: object - projected: - properties: - defaultMode: - format: int32 - type: integer - sources: - items: - properties: - clusterTrustBundle: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - name: - type: string - optional: - type: boolean - path: - type: string - signerName: - type: string - required: - - path - type: object - configMap: - properties: - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - downwardAPI: - properties: - items: - items: - properties: - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - format: int32 - type: integer - path: - type: string - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podCertificate: - properties: - certificateChainPath: - type: string - credentialBundlePath: - type: string - keyPath: - type: string - keyType: - type: string - maxExpirationSeconds: - format: int32 - type: integer - signerName: - type: string - required: - - keyType - - signerName - type: object - secret: - properties: - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - serviceAccountToken: - properties: - audience: - type: string - expirationSeconds: - format: int64 - type: integer - path: - type: string - required: - - path - type: object - type: object - type: array - x-kubernetes-list-type: atomic - type: object - quobyte: - properties: - group: - type: string - readOnly: - type: boolean - registry: - type: string - tenant: - type: string - user: - type: string - volume: - type: string - required: - - registry - - volume - type: object - rbd: - properties: - fsType: - type: string - image: - type: string - keyring: - default: /etc/ceph/keyring - type: string - monitors: - items: - type: string - type: array - x-kubernetes-list-type: atomic - pool: - default: rbd - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - user: - default: admin - type: string - required: - - image - - monitors - type: object - scaleIO: - properties: - fsType: - default: xfs - type: string - gateway: - type: string - protectionDomain: - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - sslEnabled: - type: boolean - storageMode: - default: ThinProvisioned - type: string - storagePool: - type: string - system: - type: string - volumeName: - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - properties: - defaultMode: - format: int32 - type: integer + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - optional: - type: boolean - secretName: - type: string - type: object - storageos: - properties: - fsType: - type: string - readOnly: - type: boolean - secretRef: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: - name: - default: "" + key: + description: key is the label key that the + selector applies to. type: string - type: object - x-kubernetes-map-type: atomic - volumeName: - type: string - volumeNamespace: - type: string - type: object - vsphereVolume: - properties: - fsType: - type: string - storagePolicyID: - type: string - storagePolicyName: - type: string - volumePath: - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - type: object - type: object - vmcluster: - properties: - name: - type: string - spec: - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - zones: - items: - properties: - name: - type: string - remoteWrite: - x-kubernetes-preserve-unknown-fields: true - vmagent: - properties: - name: - type: string - spec: - properties: - affinity: - properties: - nodeAffinity: - properties: - preferredDuringSchedulingIgnoredDuringExecution: - items: - properties: - preference: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - properties: - nodeSelectorTerms: + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic + type: string type: array x-kubernetes-list-type: atomic required: - - nodeSelectorTerms + - key + - operator type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - properties: - preferredDuringSchedulingIgnoredDuringExecution: - items: - properties: - podAffinityTerm: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - weight: - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - items: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - properties: - preferredDuringSchedulingIgnoredDuringExecution: - items: - properties: - podAffinityTerm: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - weight: - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - items: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - claimTemplates: - items: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - status: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - allocatedResourceStatuses: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: granular - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - conditions: - items: - properties: - lastProbeTime: - format: date-time - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentVolumeAttributesClassName: - type: string - modifyVolumeStatus: - properties: - status: - type: string - targetVolumeAttributesClassName: - type: string - required: - - status - type: object - phase: - type: string - type: object - type: object - type: array - configMaps: - items: - type: string - type: array - containers: - items: - properties: - args: - items: + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: type: string - type: array - x-kubernetes-list-type: atomic - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - envFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - image: - type: string - imagePullPolicy: - type: string - lifecycle: - properties: - postStart: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - stopSignal: - type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - livenessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - name: - type: string - ports: - items: - properties: - containerPort: - format: int32 - type: integer - hostIP: - type: string - hostPort: - format: int32 - type: integer - name: - type: string - protocol: - default: TCP - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - resizePolicy: - items: - properties: - resourceName: - type: string - restartPolicy: - type: string - required: - - resourceName - - restartPolicy - type: object - type: array - x-kubernetes-list-type: atomic - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - restartPolicy: - type: string - restartPolicyRules: - items: - properties: - action: - type: string - exitCodes: - properties: - operator: - type: string - values: - items: - format: int32 - type: integer - type: array - x-kubernetes-list-type: set - required: - - operator - type: object - required: - - action - type: object - type: array - x-kubernetes-list-type: atomic - securityContext: - properties: - allowPrivilegeEscalation: - type: boolean - appArmorProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - capabilities: - properties: - add: - items: - type: string - type: array - x-kubernetes-list-type: atomic - drop: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - privileged: - type: boolean - procMount: - type: string - readOnlyRootFilesystem: - type: boolean - runAsGroup: - format: int64 - type: integer - runAsNonRoot: - type: boolean - runAsUser: - format: int64 - type: integer - seLinuxOptions: - properties: - level: - type: string - role: - type: string - type: - type: string - user: - type: string - type: object - seccompProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - windowsOptions: - properties: - gmsaCredentialSpec: - type: string - gmsaCredentialSpecName: - type: string - hostProcess: - type: boolean - runAsUserName: - type: string - type: object - type: object - startupProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - stdin: - type: boolean - stdinOnce: - type: boolean - terminationMessagePath: - type: string - terminationMessagePolicy: - type: string - tty: - type: boolean - volumeDevices: - items: - properties: - devicePath: - type: string - name: - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - devicePath - x-kubernetes-list-type: map - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map - workingDir: - type: string - required: - - name - type: object - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string type: object x-kubernetes-map-type: atomic - type: array - initContainers: - items: - properties: - args: - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - items: - properties: - name: - type: string - value: - type: string - valueFrom: - properties: - configMapKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - envFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - image: - type: string - imagePullPolicy: - type: string - lifecycle: - properties: - postStart: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - sleep: - properties: - seconds: - format: int64 - type: integer - required: - - seconds - type: object - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - stopSignal: - type: string - type: object - livenessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - name: - type: string - ports: - items: - properties: - containerPort: - format: int32 - type: integer - hostIP: - type: string - hostPort: - format: int32 - type: integer - name: - type: string - protocol: - default: TCP - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - resizePolicy: - items: - properties: - resourceName: - type: string - restartPolicy: - type: string - required: - - resourceName - - restartPolicy - type: object - type: array - x-kubernetes-list-type: atomic - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - restartPolicy: - type: string - restartPolicyRules: - items: - properties: - action: - type: string - exitCodes: - properties: - operator: - type: string - values: - items: - format: int32 - type: integer - type: array - x-kubernetes-list-type: set - required: - - operator - type: object - required: - - action - type: object - type: array - x-kubernetes-list-type: atomic - securityContext: - properties: - allowPrivilegeEscalation: - type: boolean - appArmorProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - capabilities: - properties: - add: - items: - type: string - type: array - x-kubernetes-list-type: atomic - drop: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - privileged: - type: boolean - procMount: - type: string - readOnlyRootFilesystem: - type: boolean - runAsGroup: - format: int64 - type: integer - runAsNonRoot: - type: boolean - runAsUser: - format: int64 - type: integer - seLinuxOptions: - properties: - level: - type: string - role: - type: string - type: - type: string - user: - type: string - type: object - seccompProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - windowsOptions: - properties: - gmsaCredentialSpec: - type: string - gmsaCredentialSpecName: - type: string - hostProcess: - type: boolean - runAsUserName: - type: string - type: object - type: object - startupProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - stdin: - type: boolean - stdinOnce: - type: boolean - terminationMessagePath: - type: string - terminationMessagePolicy: - type: string - tty: - type: boolean - volumeDevices: - items: - properties: - devicePath: - type: string - name: - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - devicePath - x-kubernetes-list-type: map - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map - workingDir: - type: string - required: - - name - type: object - type: array - license: - properties: - forceOffline: - type: boolean - key: - type: string - keyRef: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - reloadInterval: - type: string - type: object - livenessProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer - type: object - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - managedMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string - type: object - paused: - type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + Status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: type: string - whenScaled: + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. type: string - type: object - podDisruptionBudget: - properties: - maxUnavailable: + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey + names follow standard Kubernetes label syntax. Valid + values are either:\n\t* Un-prefixed keys:\n\t\t- + storage - the capacity of the volume.\n\t* Custom + resources must use implementation-defined prefixed + names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or + have kubernetes.io prefix are considered\nreserved + and hence may not be used.\n\nClaimResourceStatus + can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller + with a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing + the volume but further resizing of\n\t\tvolume is + needed on the node.\n\t- NodeResizeInProgress:\n\t\tState + set when kubelet starts resizing the volume.\n\t- + NodeResizeFailed:\n\t\tState set when resizing has + failed in kubelet with a terminal error. Transient + errors don't set\n\t\tNodeResizeFailed.\nFor example: + if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress + for the given PVC.\n\nA controller that receives + PVC update with previously unknown resourceName + or ClaimResourceStatus\nshould ignore the update + for the purpose it was designed. For example - a + controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with + PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: anyOf: - type: integer - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - minAvailable: + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey + names follow standard Kubernetes label syntax. Valid + values are either:\n\t* Un-prefixed keys:\n\t\t- + storage - the capacity of the volume.\n\t* Custom + resources must use implementation-defined prefixed + names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or + have kubernetes.io prefix are considered\nreserved + and hence may not be used.\n\nCapacity reported + here may be larger than the actual capacity when + a volume expansion operation\nis requested.\nFor + storage quota, the larger value from allocatedResources + and PVC.spec.resources is used.\nIf allocatedResources + is not set, PVC.spec.resources alone is used for + quota calculation.\nIf a volume expansion capacity + request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress + and if the actual volume capacity\nis equal or lower + than the requested capacity.\n\nA controller that + receives PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires + enabling RecoverVolumeExpansionFailure feature." + type: object + capacity: + additionalProperties: anyOf: - type: integer - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string + description: capacity represents the actual resources + of the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains + details about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed + the condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time + the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). properties: - conditionType: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, + such as\n the specified VolumeAttributesClass + not existing.\n - InProgress\n InProgress + indicates that the volume is being modified.\n + - Infeasible\n Infeasible indicates that the + request has been rejected as invalid by the + CSI driver. To\n\t resolve the error, a valid + VolumeAttributesClass needs to be specified.\nNote: + New statuses can be added in the future. Consumers + should check for unknown statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is + the name of the VolumeAttributesClass the PVC + currently being reconciled type: string required: - - conditionType + - status type: object + phase: + description: phase represents the current phase of + PersistentVolumeClaim. + type: string + type: object + type: object + type: object + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container + graceful termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + vmstorage: + properties: + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + claimTemplates: + description: ClaimTemplates allows adding additional VolumeClaimTemplates + for StatefulSet + items: + description: PersistentVolumeClaim is a user's request for and + claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + type: object + x-kubernetes-preserve-unknown-fields: true + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string type: array - readinessProbe: + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name type: object - remoteWriteSettings: + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: - flushInterval: - pattern: '[0-9]+(ms|s|m|h)' + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string - label: - additionalProperties: - type: string - type: object - maxBlockSize: - format: int32 - type: integer - maxDiskUsagePerURL: - x-kubernetes-preserve-unknown-fields: true - queues: - format: int32 - type: integer - showURL: - type: boolean - tmpDataPath: + kind: + description: Kind is the type of resource being + referenced type: string - useMultiTenantMode: - type: boolean + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name type: object - replicaCount: - format: int32 - type: integer resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -28428,6 +19167,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -28436,1363 +19178,1545 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdate: + selector: + description: selector is a label query over volumes + to consider for binding. properties: - maxSurge: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object type: object - runtimeClassName: + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string - schedulerName: + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string - secrets: + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array - securityContext: - properties: - allowPrivilegeEscalation: - type: boolean - appArmorProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - capabilities: - properties: - add: - items: - type: string - type: array - x-kubernetes-list-type: atomic - drop: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - fsGroup: - format: int64 - type: integer - fsGroupChangePolicy: - type: string - privileged: - type: boolean - procMount: - type: string - readOnlyRootFilesystem: - type: boolean - runAsGroup: - format: int64 - type: integer - runAsNonRoot: - type: boolean - runAsUser: - format: int64 - type: integer - seLinuxChangePolicy: - type: string - seLinuxOptions: - properties: - level: - type: string - role: - type: string - type: - type: string - user: - type: string - type: object - seccompProfile: - properties: - localhostProfile: - type: string - type: - type: string - required: - - type - type: object - supplementalGroups: - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - supplementalGroupsPolicy: - type: string - sysctls: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - windowsOptions: - properties: - gmsaCredentialSpec: - type: string - gmsaCredentialSpecName: - type: string - hostProcess: - type: boolean - runAsUserName: - type: string - type: object + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey + names follow standard Kubernetes label syntax. Valid + values are either:\n\t* Un-prefixed keys:\n\t\t- storage + - the capacity of the volume.\n\t* Custom resources + must use implementation-defined prefixed names such + as \"example.com/my-custom-resource\"\nApart from + above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not + be used.\n\nClaimResourceStatus can be in any of following + states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with + a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing the + volume but further resizing of\n\t\tvolume is needed + on the node.\n\t- NodeResizeInProgress:\n\t\tState + set when kubelet starts resizing the volume.\n\t- + NodeResizeFailed:\n\t\tState set when resizing has + failed in kubelet with a terminal error. Transient + errors don't set\n\t\tNodeResizeFailed.\nFor example: + if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress for + the given PVC.\n\nA controller that receives PVC update + with previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." type: object - serviceAccountName: - type: string - startupProbe: - properties: - exec: - properties: - command: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - failureThreshold: - format: int32 - type: integer - grpc: - properties: - port: - format: int32 - type: integer - service: - default: "" - type: string - required: - - port - type: object - httpGet: - properties: - host: - type: string - httpHeaders: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - path: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - type: string - required: - - port - type: object - initialDelaySeconds: - format: int32 - type: integer - periodSeconds: - format: int32 - type: integer - successThreshold: - format: int32 - type: integer - tcpSocket: - properties: - host: - type: string - port: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - timeoutSeconds: - format: int32 - type: integer + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage + - the capacity of the volume.\n\t* Custom resources + must use implementation-defined prefixed names such + as \"example.com/my-custom-resource\"\nApart from + above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not + be used.\n\nCapacity reported here may be larger than + the actual capacity when a volume expansion operation\nis + requested.\nFor storage quota, the larger value from + allocatedResources and PVC.spec.resources is used.\nIf + allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume + expansion capacity request is lowered, allocatedResources + is only\nlowered if there are no expansion operations + in progress and if the actual volume capacity\nis + equal or lower than the requested capacity.\n\nA controller + that receives PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." type: object - statefulMode: - type: boolean - statefulRollingUpdateStrategy: - type: string - statefulRollingUpdateStrategyBehavior: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. type: object - statefulStorage: - properties: - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - volumeClaimTemplate: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - status: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - allocatedResourceStatuses: - additionalProperties: - type: string - type: object - x-kubernetes-map-type: granular - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - conditions: - items: - properties: - lastProbeTime: - format: date-time - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - currentVolumeAttributesClassName: - type: string - modifyVolumeStatus: - properties: - status: - type: string - targetVolumeAttributesClassName: - type: string - required: - - status - type: object - phase: - type: string - type: object - type: object - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. items: + description: PersistentVolumeClaimCondition contains + details about state of pvc properties: - effect: + lastProbeTime: + description: lastProbeTime is the time we probed + the condition. + format: date-time type: string - key: + lastTransitionTime: + description: lastTransitionTime is the time the + condition transitioned from one status to another. + format: date-time type: string - operator: + message: + description: message is the human-readable message + indicating details about last transition. type: string - tolerationSeconds: - format: int64 - type: integer - value: + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. type: string - type: object - type: array - topologySpreadConstraints: - items: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxSkew: - format: int32 - type: integer - minDomains: - format: int32 - type: integer - nodeAffinityPolicy: + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required type: string - nodeTaintsPolicy: - type: string - topologyKey: - type: string - whenUnsatisfiable: + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about type: string required: - - maxSkew - - topologyKey - - whenUnsatisfiable + - status + - type type: object type: array - updateStrategy: - enum: - - Recreate - - RollingUpdate + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, + such as\n the specified VolumeAttributesClass + not existing.\n - InProgress\n InProgress indicates + that the volume is being modified.\n - Infeasible\n + \ Infeasible indicates that the request has been + rejected as invalid by the CSI driver. To\n\t + \ resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can + be added in the future. Consumers should check + for unknown statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is + the name of the VolumeAttributesClass the PVC + currently being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. type: string - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - properties: - awsElasticBlockStore: - properties: - fsType: - type: string - partition: - format: int32 - type: integer - readOnly: - type: boolean - volumeID: - type: string - required: - - volumeID - type: object - azureDisk: - properties: - cachingMode: - type: string - diskName: - type: string - diskURI: - type: string - fsType: - default: ext4 - type: string - kind: - type: string - readOnly: - default: false - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - properties: - readOnly: - type: boolean - secretName: - type: string - shareName: - type: string - required: - - secretName - - shareName - type: object - cephfs: - properties: - monitors: - items: - type: string - type: array - x-kubernetes-list-type: atomic - path: - type: string - readOnly: - type: boolean - secretFile: - type: string - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - user: - type: string - required: - - monitors - type: object - cinder: - properties: - fsType: - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - volumeID: - type: string - required: - - volumeID - type: object - configMap: - properties: - defaultMode: - format: int32 - type: integer - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - csi: - properties: - driver: - type: string - fsType: - type: string - nodePublishSecretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - readOnly: - type: boolean - volumeAttributes: - additionalProperties: - type: string - type: object - required: - - driver - type: object - downwardAPI: - properties: - defaultMode: - format: int32 - type: integer - items: - items: - properties: - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - format: int32 - type: integer - path: - type: string - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - x-kubernetes-list-type: atomic - type: object - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - properties: - volumeClaimTemplate: - properties: - metadata: - type: object - spec: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - required: - - spec - type: object - type: object - fc: - properties: - fsType: - type: string - lun: - format: int32 - type: integer - readOnly: - type: boolean - targetWWNs: - items: - type: string - type: array - x-kubernetes-list-type: atomic - wwids: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - flexVolume: - properties: - driver: - type: string - fsType: - type: string - options: - additionalProperties: - type: string - type: object - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - required: - - driver - type: object - flocker: - properties: - datasetName: - type: string - datasetUUID: - type: string - type: object - gcePersistentDisk: - properties: - fsType: - type: string - partition: - format: int32 - type: integer - pdName: - type: string - readOnly: - type: boolean - required: - - pdName - type: object - gitRepo: - properties: - directory: - type: string - repository: - type: string - revision: - type: string - required: - - repository - type: object - glusterfs: - properties: - endpoints: - type: string - path: - type: string - readOnly: - type: boolean - required: - - endpoints - - path - type: object - hostPath: - properties: - path: - type: string - type: - type: string - required: - - path - type: object - image: - properties: - pullPolicy: - type: string - reference: - type: string - type: object - iscsi: - properties: - chapAuthDiscovery: - type: boolean - chapAuthSession: - type: boolean - fsType: - type: string - initiatorName: - type: string - iqn: - type: string - iscsiInterface: - default: default - type: string - lun: - format: int32 - type: integer - portals: - items: - type: string - type: array - x-kubernetes-list-type: atomic - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - targetPortal: - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - type: string - nfs: - properties: - path: - type: string - readOnly: - type: boolean - server: - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - properties: - claimName: - type: string - readOnly: - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - properties: - fsType: - type: string - pdID: - type: string - required: - - pdID - type: object - portworxVolume: - properties: - fsType: - type: string - readOnly: - type: boolean - volumeID: - type: string - required: - - volumeID - type: object - projected: - properties: - defaultMode: - format: int32 - type: integer - sources: - items: - properties: - clusterTrustBundle: - properties: - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - name: - type: string - optional: - type: boolean - path: - type: string - signerName: - type: string - required: - - path - type: object - configMap: - properties: - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - downwardAPI: - properties: - items: - items: - properties: - fieldRef: - properties: - apiVersion: - type: string - fieldPath: - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - format: int32 - type: integer - path: - type: string - resourceFieldRef: - properties: - containerName: - type: string - divisor: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podCertificate: - properties: - certificateChainPath: - type: string - credentialBundlePath: - type: string - keyPath: - type: string - keyType: - type: string - maxExpirationSeconds: - format: int32 - type: integer - signerName: - type: string - required: - - keyType - - signerName - type: object - secret: - properties: - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - serviceAccountToken: - properties: - audience: - type: string - expirationSeconds: - format: int64 - type: integer - path: - type: string - required: - - path - type: object - type: object - type: array - x-kubernetes-list-type: atomic - type: object - quobyte: - properties: - group: - type: string - readOnly: - type: boolean - registry: - type: string - tenant: - type: string - user: - type: string - volume: - type: string - required: - - registry - - volume - type: object - rbd: - properties: - fsType: - type: string - image: - type: string - keyring: - default: /etc/ceph/keyring - type: string - monitors: - items: - type: string - type: array - x-kubernetes-list-type: atomic - pool: - default: rbd - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - user: - default: admin - type: string - required: - - image - - monitors - type: object - scaleIO: - properties: - fsType: - default: xfs - type: string - gateway: - type: string - protectionDomain: - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - sslEnabled: - type: boolean - storageMode: - default: ThinProvisioned - type: string - storagePool: - type: string - system: - type: string - volumeName: - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - properties: - defaultMode: - format: int32 - type: integer - items: - items: - properties: - key: - type: string - mode: - format: int32 - type: integer - path: - type: string - required: - - key - - path - type: object - type: array - x-kubernetes-list-type: atomic - optional: - type: boolean - secretName: - type: string - type: object - storageos: - properties: - fsType: - type: string - readOnly: - type: boolean - secretRef: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - volumeName: - type: string - volumeNamespace: - type: string - type: object - vsphereVolume: - properties: - fsType: - type: string - storagePolicyID: - type: string - storagePolicyName: - type: string - volumePath: - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array type: object type: object - vmcluster: + type: array + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application + container + items: + description: EnvVar represents an environment variable present + in a Container. properties: name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. type: string - spec: - x-kubernetes-preserve-unknown-fields: true + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name type: object - required: - - name - type: object - type: array + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of + ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key + in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the + node network namespace + type: boolean + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's + repository if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: |- + LogFormat for VMStorage to be configured with. + default or json + enum: + - default + - json + type: string + logLevel: + description: LogLevel for VMStorage to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + maintenanceInsertNodeIDs: + description: |- + MaintenanceInsertNodeIDs - excludes given node ids from insert requests routing, must contain pod suffixes - for pod-0, id will be 0 and etc. + lets say, you have pod-0, pod-1, pod-2, pod-3. to exclude pod-0 and pod-3 from insert routing, define nodeIDs: [0,3]. + Useful at storage expanding, when you want to rebalance some data at cluster. + items: + format: int32 + type: integer + type: array + maintenanceSelectNodeIDs: + description: MaintenanceInsertNodeIDs - excludes given node ids + from select requests routing, must contain pod suffixes - for + pod-0, id will be 0 and etc. + items: + format: int32 + type: integer + type: array + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + podDisruptionBudget: + description: PodDisruptionBudget created by operator + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selectorLabels: + additionalProperties: + type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget + type: object + type: object + podMetadata: + description: PodMetadata configures Labels and Annotations which + are propagated to the VMStorage pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod + condition + properties: + conditionType: + description: ConditionType refers to a condition in the + pod's condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + rollingUpdateStrategy: + description: |- + RollingUpdateStrategy defines strategy for application updates + Default is OnDelete, in this case operator handles update process + Can be changed for RollingUpdate + type: string + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmstorage + VMServiceScrape spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be create additional service + for vmstorage + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for + additional service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + storage: + description: |- + Storage - add persistent volume for StorageDataPath + its useful for persistent cache + properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean + emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + storageDataPath: + description: StorageDataPath - path to storage data + type: string + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container + graceful termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + vmBackup: + description: VMBackup configuration for backup + properties: + acceptEULA: + description: |- + AcceptEULA accepts enterprise feature usage, must be set to true. + otherwise backupmanager cannot be added to single/cluster version. + https://victoriametrics.com/legal/esa/ + type: boolean + concurrency: + description: Defines number of concurrent workers. Higher + concurrency may reduce backup duration (default 10) + format: int32 + type: integer + credentialsSecret: + description: |- + CredentialsSecret is secret in the same namespace for access to remote storage + The secret is mounted into /etc/vm/creds. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + customS3Endpoint: + description: Custom S3 endpoint for use with S3-compatible + storages (e.g. MinIO). S3 is used if not set + type: string + destination: + description: Defines destination for backup + type: string + destinationDisableSuffixAdd: + description: |- + DestinationDisableSuffixAdd - disables suffix adding for cluster version backups + each vmstorage backup must have unique backup folder + so operator adds POD_NAME as suffix for backup destination folder. + type: boolean + disableDaily: + description: Defines if daily backups disabled (default false) + type: boolean + disableHourly: + description: Defines if hourly backups disabled (default false) + type: boolean + disableMonthly: + description: Defines if monthly backups disabled (default + false) + type: boolean + disableWeekly: + description: Defines if weekly backups disabled (default false) + type: boolean + extraArgs: + additionalProperties: + type: string + description: extra args like maxBytesPerSecond default 0 + type: object + extraEnvs: + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set + of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be + defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + description: Image - docker image settings for VMBackuper + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + + it's repository if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + logFormat: + description: |- + LogFormat for VMBackup to be configured with. + default or json + enum: + - default + - json + type: string + logLevel: + description: LogLevel for VMBackup to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + port: + description: Port for health check connections + type: string + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + restore: + description: |- + Restore Allows to enable restore options for pod + Read [more](https://docs.victoriametrics.com/vmbackupmanager#restore-commands) + properties: + onStart: + description: OnStart defines configuration for restore + on pod start + properties: + enabled: + description: Enabled defines if restore on start enabled + type: boolean + type: object + type: object + snapshotCreateURL: + description: SnapshotCreateURL overwrites url for snapshot + create + type: string + snapshotDeleteURL: + description: SnapShotDeleteURL overwrites url for snapshot + delete + type: string + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment definition. + VolumeMounts specified will be appended to other VolumeMounts in the vmbackupmanager container, + that are generated as a result of StorageSpec objects. + items: + description: VolumeMount describes a mounting of a Volume + within a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + type: object + vmInsertPort: + description: VMInsertPort for VMInsert connections + type: string + vmSelectPort: + description: VMSelectPort for VMSelect connections + type: string + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + required: + - retentionPeriod type: object status: + description: VMClusterStatus defines the observed state of VMCluster properties: + clusterStatus: + description: LegacyStatus is deprecated and will be removed at v0.52.0 + version + type: string conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -29807,11 +20731,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -29826,7 +20755,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmnodescrapes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -29850,60 +20779,121 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMNodeScrape defines discovery for targets placed on kubernetes nodes, + usually its node-exporters and other host services. + InternalIP is used as __address__ for scraping. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMNodeScrapeSpec defines specification for VMNodeScrape. properties: authorization: + description: Authorization with http header Authorization properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object basicAuth: + description: BasicAuth allow an endpoint to authenticate over basic + authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key @@ -29911,94 +20901,181 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: File to read bearer token for scraping targets. type: string bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. nullable: true properties: key: + description: The key of the secret to select from. Must be a + valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic follow_redirects: + description: FollowRedirects controls redirects for scraping. type: boolean honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. type: boolean honorTimestamps: + description: HonorTimestamps controls whether vmagent respects the + timestamps present in scraped data. type: boolean interval: + description: Interval at which metrics should be scraped type: string jobLabel: + description: The label to use to retrieve the job name from. type: string max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped data + for a job type: string metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after scrapping. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 client + id properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -30006,33 +21083,56 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -30044,52 +21144,101 @@ spec: items: type: string type: array + description: Optional HTTP URL parameters type: object path: + description: HTTP path to scrape for metrics. type: string port: + description: Name of the port exposed at Node. type: string proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes to + proxy through this endpoint. type: string relabelConfigs: + description: RelabelConfigs to apply to samples during service discovery. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 type: integer scheme: + description: HTTP scheme to use for scraping. enum: - http - https @@ -30097,21 +21246,39 @@ spec: - HTTP type: string scrape_interval: - type: string - scrapeClass: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used type: string scrapeTimeout: + description: Timeout after which the scrape is ended type: string selector: + description: Selector to select kubernetes Nodes. properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -30125,40 +21292,73 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 type: integer targetLabels: + description: TargetLabels transfers labels on the Kubernetes Node + onto the target. items: type: string type: array tlsConfig: + description: TLSConfig configuration to use when scraping the endpoint properties: ca: + description: Struct containing the CA cert to use for the targets. properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -30166,30 +21366,54 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use for the + targets. type: string cert: + description: Struct containing the client cert file for the targets. properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -30197,66 +21421,131 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container for + the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container for + the targets. type: string keySecret: + description: Secret containing the client key file for the targets. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific scrape + parameters properties: disable_compression: + description: DisableCompression type: boolean disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements type: boolean headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version items: type: string type: array no_stale_markers: type: boolean proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -30264,13 +21553,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -30290,34 +21590,58 @@ spec: type: object type: object status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -30332,11 +21656,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -30349,7 +21678,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmpodscrapes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -30373,88 +21702,165 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMPodScrape is scrape configuration for pods, + it generates vmagent's config for scraping pod targets + based on selectors. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMPodScrapeSpec defines the desired state of VMPodScrape properties: attach_metadata: + description: AttachMetadata configures metadata attaching from service + discovery properties: - namespace: - type: boolean node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. type: boolean type: object jobLabel: + description: The label to use to retrieve the job name from. type: string namespaceSelector: + description: Selector to select which namespaces the Endpoints objects + are discovered from. properties: any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. type: boolean matchNames: + description: List of namespace names. items: type: string type: array type: object podMetricsEndpoints: + description: A list of endpoints allowed as part of this PodMonitor. items: + description: PodMetricsEndpoint defines a scrapeable endpoint of + a Kubernetes Pod serving metrics. properties: attach_metadata: + description: AttachMetadata configures metadata attaching from + service discovery properties: - namespace: - type: boolean node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. type: boolean type: object authorization: + description: Authorization with http header Authorization properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -30462,94 +21868,187 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: File to read bearer token for scraping targets. type: string bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. nullable: true properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic filterRunning: + description: |- + FilterRunning applies filter with pod status == running + it prevents from scrapping metrics at failed or succeed state pods. + enabled by default type: boolean follow_redirects: + description: FollowRedirects controls redirects for scraping. type: boolean honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. type: boolean honorTimestamps: + description: HonorTimestamps controls whether vmagent respects + the timestamps present in scraped data. type: boolean interval: + description: Interval at which metrics should be scraped type: string max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped + data for a job type: string metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after + scrapping. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source + label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 + client id properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -30557,33 +22056,57 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret + file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -30595,57 +22118,109 @@ spec: items: type: string type: array + description: Optional HTTP URL parameters type: object path: + description: HTTP path to scrape for metrics. type: string port: + description: Name of the port exposed at Pod. type: string portNumber: + description: PortNumber defines the `Pod` port number which + exposes the endpoint. format: int32 maximum: 65535 minimum: 1 type: integer proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. type: string relabelConfigs: + description: RelabelConfigs to apply to samples during service + discovery. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source + label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array sampleLimit: + description: SampleLimit defines per-scrape limit on number + of scraped samples that will be accepted. + format: int64 type: integer scheme: + description: HTTP scheme to use for scraping. enum: - http - https @@ -30653,41 +22228,78 @@ spec: - HTTP type: string scrape_interval: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used type: string scrapeTimeout: + description: Timeout after which the scrape is ended type: string seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 type: integer targetPort: anyOf: - type: integer - type: string + description: |- + TargetPort defines name or number of the pod port this endpoint refers to. + Mutually exclusive with Port and PortNumber. x-kubernetes-int-or-string: true tlsConfig: + description: TLSConfig configuration to use when scraping the + endpoint properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -30695,30 +22307,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use + for the targets. type: string cert: + description: Struct containing the client cert file for + the targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -30726,66 +22364,132 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific + scrape parameters properties: disable_compression: + description: DisableCompression type: boolean disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements type: boolean headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version items: type: string type: array no_stale_markers: type: boolean proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key @@ -30793,13 +22497,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -30820,23 +22535,42 @@ spec: type: object type: array podTargetLabels: + description: PodTargetLabels transfers labels on the Kubernetes Pod + onto the target. items: type: string type: array sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 type: integer - scrapeClass: - type: string selector: + description: Selector to select Pod objects. properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -30850,43 +22584,75 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 type: integer required: - podMetricsEndpoints type: object status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -30901,11 +22667,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -30918,7 +22689,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmprobes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -30942,60 +22713,121 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMProbe defines a probe for targets, that will be executed with prober, + like blackbox exporter. + It helps to monitor reachability of target with various checks. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMProbeSpec contains specification parameters for a Probe. properties: authorization: + description: Authorization with http header Authorization properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object basicAuth: + description: BasicAuth allow an endpoint to authenticate over basic + authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key @@ -31003,96 +22835,187 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: File to read bearer token for scraping targets. type: string bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. nullable: true properties: key: + description: The key of the secret to select from. Must be a + valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic follow_redirects: + description: FollowRedirects controls redirects for scraping. type: boolean honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. type: boolean honorTimestamps: + description: HonorTimestamps controls whether vmagent respects the + timestamps present in scraped data. type: boolean interval: + description: Interval at which metrics should be scraped type: string jobName: + description: The job name assigned to scraped metrics by default. type: string max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped data + for a job type: string metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after scrapping. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array module: + description: |- + The module to use for probing specifying how to probe the target. + Example module configuring in the blackbox exporter: + https://github.com/prometheus/blackbox_exporter/blob/master/example.yml type: string oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 client + id properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -31100,33 +23023,56 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -31138,14 +23084,22 @@ spec: items: type: string type: array + description: Optional HTTP URL parameters type: object path: + description: HTTP path to scrape for metrics. type: string proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes to + proxy through this endpoint. type: string sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 type: integer scheme: + description: HTTP scheme to use for scraping. enum: - http - https @@ -31153,79 +23107,144 @@ spec: - HTTP type: string scrape_interval: - type: string - scrapeClass: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used type: string scrapeTimeout: + description: Timeout after which the scrape is ended type: string seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 type: integer targets: + description: Targets defines a set of static and/or dynamically discovered + targets to be probed using the prober. properties: ingress: + description: Ingress defines the set of dynamically discovered + ingress objects which hosts are considered for probing. properties: namespaceSelector: + description: Select Ingress objects by namespace. properties: any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. type: boolean matchNames: + description: List of namespace names. items: type: string type: array type: object relabelingConfigs: + description: RelabelConfigs to apply to samples during service + discovery. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for + `action: graphite`' type: object match: + description: 'Match is used together with Labels for + `action: graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source + label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array - role: - enum: - - service - - ingress - - pod - - node - type: string selector: + description: Select Ingress objects by labels. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -31239,185 +23258,104 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object - kubernetes: - items: - properties: - namespaceSelector: - properties: - any: - type: boolean - matchNames: - items: - type: string - type: array - type: object - relabelingConfigs: - items: - properties: - action: - type: string - if: - x-kubernetes-preserve-unknown-fields: true - labels: - additionalProperties: - type: string - type: object - match: - type: string - modulus: - format: int64 - type: integer - regex: - x-kubernetes-preserve-unknown-fields: true - replacement: - type: string - separator: - type: string - source_labels: - items: - type: string - type: array - sourceLabels: - items: - type: string - type: array - target_label: - type: string - targetLabel: - type: string - type: object - type: array - role: - enum: - - service - - ingress - - pod - - node - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - type: object - type: array - static: - properties: - labels: - additionalProperties: - type: string - type: object - relabelingConfigs: - items: - properties: - action: - type: string - if: - x-kubernetes-preserve-unknown-fields: true - labels: - additionalProperties: - type: string - type: object - match: - type: string - modulus: - format: int64 - type: integer - regex: - x-kubernetes-preserve-unknown-fields: true - replacement: - type: string - separator: - type: string - source_labels: - items: - type: string - type: array - sourceLabels: - items: - type: string - type: array - target_label: - type: string - targetLabel: - type: string - type: object - type: array - targets: - items: - type: string - type: array - required: - - targets - type: object staticConfig: + description: StaticConfig defines static targets which are considers + for probing. properties: labels: additionalProperties: type: string + description: Labels assigned to all metrics scraped from the + targets. type: object relabelingConfigs: + description: RelabelConfigs to apply to samples during service + discovery. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for + `action: graphite`' type: object match: + description: 'Match is used together with Labels for + `action: graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source + label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array targets: + description: Targets is a list of URLs to probe using the + configured prober. items: type: string type: array @@ -31426,30 +23364,53 @@ spec: type: object type: object tlsConfig: + description: TLSConfig configuration to use when scraping the endpoint properties: ca: + description: Struct containing the CA cert to use for the targets. properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -31457,30 +23418,54 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use for the + targets. type: string cert: + description: Struct containing the client cert file for the targets. properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -31488,66 +23473,131 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container for + the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container for + the targets. type: string keySecret: + description: Secret containing the client key file for the targets. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific scrape + parameters properties: disable_compression: + description: DisableCompression type: boolean disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements type: boolean headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version items: type: string type: array no_stale_markers: type: boolean proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -31555,13 +23605,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -31580,15 +23641,25 @@ spec: type: boolean type: object vmProberSpec: + description: |- + Specification for the prober to use for probing targets. + The prober.URL parameter is required. Targets cannot be probed if left empty. properties: path: + description: |- + Path to collect metrics from. + Defaults to `/probe`. type: string scheme: + description: |- + HTTP scheme to use for scraping. + Defaults to `http`. enum: - http - https type: string url: + description: Mandatory URL of the prober. type: string required: - url @@ -31597,34 +23668,58 @@ spec: - vmProberSpec type: object status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -31639,11 +23734,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -31658,7 +23758,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmrules.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -31682,41 +23782,103 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMRule defines rule records for vmalert application properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMRuleSpec defines the desired state of VMRule properties: groups: + description: Groups list of group rules items: + description: RuleGroup is a list of sequentially evaluated recording + and alerting rules. properties: concurrency: + description: Concurrency defines how many rules execute at once. type: integer eval_alignment: + description: |- + Optional + The evaluation timestamp will be aligned with group's interval, + instead of using the actual timestamp that evaluation happens at. + It is enabled by default to get more predictable results + and to visually align with graphs plotted via Grafana or vmui. type: boolean eval_delay: + description: |- + Optional + Adjust the `time` parameter of group evaluation requests to compensate intentional query delay from the datasource. type: string eval_offset: + description: |- + Optional + Group will be evaluated at the exact offset in the range of [0...interval]. type: string + extra_filter_labels: + additionalProperties: + type: string + description: |- + ExtraFilterLabels optional list of label filters applied to every rule's + request within a group. Is compatible only with VM datasource. + See more details [here](https://docs.victoriametrics.com/#prometheus-querying-api-enhancements) + Deprecated, use params instead + type: object headers: + description: |- + Headers contains optional HTTP headers added to each rule request + Must be in form `header-name: value` + For example: + headers: + - "CustomHeader: foo" + - "CustomHeader2: bar" items: type: string type: array interval: + description: evaluation interval for group type: string labels: additionalProperties: type: string + description: |- + Labels optional list of labels added to every rule within a group. + It has priority over the external labels. + Labels are commonly used for adding environment + or tenant-specific tag. type: object limit: + description: |- + Limit the number of alerts an alerting rule and series a recording + rule can produce type: integer name: + description: Name of group type: string notifier_headers: + description: |- + NotifierHeaders contains optional HTTP headers added to each alert request which will send to notifier + Must be in form `header-name: value` + For example: + headers: + - "CustomHeader: foo" + - "CustomHeader2: bar" items: type: string type: array @@ -31725,37 +23887,67 @@ spec: items: type: string type: array + description: Params optional HTTP URL parameters added to each + rule request type: object rules: + description: Rules list of alert rules items: + description: Rule describes an alerting or recording rule. properties: alert: + description: Alert is a name for alert type: string annotations: additionalProperties: type: string + description: Annotations will be added to rule configuration type: object debug: + description: |- + Debug enables logging for rule + it useful for tracking type: boolean expr: + description: Expr is query, that will be evaluated at + dataSource type: string for: + description: |- + For evaluation interval in time.Duration format + 30s, 1m, 1h or nanoseconds type: string keep_firing_for: + description: |- + KeepFiringFor will make alert continue firing for this long + even when the alerting expression no longer has results. + Use time.Duration format, 30s, 1m, 1h or nanoseconds type: string labels: additionalProperties: type: string + description: Labels will be added to rule configuration type: object record: + description: Record represents a query, that will be recorded + to dataSource type: string update_entries_limit: + description: |- + UpdateEntriesLimit defines max number of rule's state updates stored in memory. + Overrides `-rule.updateEntriesLimit` in vmalert. type: integer type: object type: array tenant: + description: |- + Tenant id for group, can be used only with enterprise version of vmalert. + See more details [here](https://docs.victoriametrics.com/vmalert#multitenancy). type: string type: + description: |- + Type defines datasource type for enterprise version of vmalert + possible values - prometheus,graphite,vlogs type: string required: - name @@ -31766,34 +23958,58 @@ spec: - groups type: object status: + description: VMRuleStatus defines the observed state of VMRule properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -31808,11 +24024,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -31827,7 +24048,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmscrapeconfigs.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -31851,98 +24072,188 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMScrapeConfig specifies a set of targets and parameters describing + how to scrape them. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMScrapeConfigSpec defines the desired state of VMScrapeConfig properties: authorization: + description: Authorization with http header Authorization properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object azureSDConfigs: + description: AzureSDConfigs defines a list of Azure service discovery + configurations. items: + description: |- + AzureSDConfig allow retrieving scrape targets from Azure VMs. + See [here](https://docs.victoriametrics.com/sd_configs#azure_sd_configs) properties: authenticationMethod: + description: |- + # The authentication method, either OAuth or ManagedIdentity. + See https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview enum: - OAuth - ManagedIdentity type: string clientID: + description: Optional client ID. Only required with the OAuth + authentication method. type: string clientSecret: + description: Optional client secret. Only required with the + OAuth authentication method. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic environment: + description: The Azure environment. type: string port: + description: |- + The port to scrape metrics from. If using the public IP address, this must + instead be specified in the relabeling rule. type: integer resourceGroup: + description: Optional resource group name. Limits discovery + to this resource group. type: string subscriptionID: + description: The subscription ID. Always required. minLength: 1 type: string tenantID: + description: Optional tenant ID. Only required with the OAuth + authentication method. type: string required: - subscriptionID type: object type: array basicAuth: + description: BasicAuth allow an endpoint to authenticate over basic + authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key @@ -31950,71 +24261,137 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: File to read bearer token for scraping targets. type: string bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. nullable: true properties: key: + description: The key of the secret to select from. Must be a + valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic consulSDConfigs: + description: ConsulSDConfigs defines a list of Consul service discovery + configurations. items: + description: |- + ConsulSDConfig defines a Consul service discovery configuration. + See [here](https://docs.victoriametrics.com/sd_configs/#consul_sd_configs) properties: allowStale: + description: |- + Allow stale Consul results (see https://developer.hashicorp.com/consul/api-docs/features/consistency). Will reduce load on Consul. + If unset, use its default value. type: boolean authorization: + description: Authorization header to use on every scrape request. properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object basicAuth: + description: BasicAuth information to use on every scrape request. properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -32022,43 +24399,79 @@ spec: x-kubernetes-map-type: atomic type: object datacenter: + description: Consul Datacenter name, if not provided it will + use the local Consul Agent Datacenter. type: string filter: + description: |- + Filter defines filter for /v1/catalog/services requests + See https://developer.hashicorp.com/consul/api-docs/features/filtering type: string followRedirects: + description: |- + Configure whether HTTP requests follow HTTP 3xx redirects. + If unset, use its default value. type: boolean namespace: + description: Namespaces are only supported in Consul Enterprise. type: string nodeMeta: additionalProperties: type: string + description: Node metadata key/value pairs to filter nodes for + a given service. type: object x-kubernetes-map-type: atomic oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 + client id properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32066,33 +24479,57 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret + file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -32100,34 +24537,69 @@ spec: - token_url type: object partition: + description: Admin Partitions are only supported in Consul Enterprise. type: string proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy) properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32135,13 +24607,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -32153,52 +24636,89 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. type: string scheme: + description: HTTP Scheme default "http" enum: - HTTP - HTTPS type: string server: + description: A valid string consisting of a hostname or IP followed + by an optional port number. minLength: 1 type: string services: + description: A list of services for which targets are retrieved. + If omitted, all services are scraped. items: type: string type: array x-kubernetes-list-type: atomic tagSeparator: + description: |- + The string by which Consul tags are joined into the tag label. + If unset, use its default value. type: string tags: + description: An optional list of tags used to filter nodes for + a given service. Services must contain all tags in the list. items: type: string type: array x-kubernetes-list-type: atomic tlsConfig: + description: TLS configuration to use on every scrape request properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32206,30 +24726,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use + for the targets. type: string cert: + description: Struct containing the client cert file for + the targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32237,35 +24783,65 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object tokenRef: + description: Consul ACL TokenRef, if not provided it will use + the ACL from the local Consul Agent. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -32276,55 +24852,102 @@ spec: type: object type: array digitalOceanSDConfigs: + description: DigitalOceanSDConfigs defines a list of DigitalOcean + service discovery configurations. items: + description: |- + DigitalOceanSDConfig allow retrieving scrape targets from DigitalOcean's Droplets API. + This service discovery uses the public IPv4 address by default, by that can be changed with relabeling. + See [here](https://docs.victoriametrics.com/sd_configs#digitalocean_sd_configs) properties: authorization: + description: Authorization header to use on every scrape request. properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object followRedirects: + description: Configure whether HTTP requests follow HTTP 3xx + redirects. type: boolean oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 + client id properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32332,33 +24955,57 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret + file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -32366,34 +25013,69 @@ spec: - token_url type: object port: + description: The port to scrape metrics from. type: integer proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy) properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32401,13 +25083,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -32419,32 +25112,59 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. type: string tlsConfig: + description: TLS configuration to use on every scrape request properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32452,30 +25172,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use + for the targets. type: string cert: + description: Struct containing the client cert file for + the targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32483,38 +25229,66 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object type: object type: array dnsSDConfigs: + description: DNSSDConfigs defines a list of DNS service discovery + configurations. items: + description: |- + DNSSDConfig allows specifying a set of DNS domain names which are periodically queried to discover a list of targets. + The DNS servers to be contacted are read from /etc/resolv.conf. + See [here](https://docs.victoriametrics.com/sd_configs#dns_sd_configs) properties: names: + description: A list of DNS domain names to be queried. items: type: string minItems: 1 type: array port: + description: |- + The port number used if the query type is not SRV + Ignored for SRV records type: integer type: enum: @@ -32528,23 +25302,48 @@ spec: type: object type: array ec2SDConfigs: + description: EC2SDConfigs defines a list of EC2 service discovery + configurations. items: + description: |- + EC2SDConfig allow retrieving scrape targets from AWS EC2 instances. + The private IP address is used by default, but may be changed to the public IP address with relabeling. + The IAM credentials used must have the ec2:DescribeInstances permission to discover scrape targets. + See [here](https://docs.victoriametrics.com/sd_configs#ec2_sd_configs) properties: accessKey: + description: AccessKey is the AWS API key. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic filters: + description: |- + Filters can be used optionally to filter the instance list by other criteria. + Available filter criteria can be found here: + https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html + Filter API documentation: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Filter.html items: + description: EC2Filter is the configuration for filtering + EC2 instances. properties: name: type: string @@ -32558,19 +25357,35 @@ spec: type: object type: array port: + description: |- + The port to scrape metrics from. If using the public IP address, this must + instead be specified in the relabeling rule. type: integer region: + description: The AWS region type: string roleARN: + description: AWS Role ARN, an alternative to using AWS API keys. type: string secretKey: + description: SecretKey is the AWS API secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -32579,9 +25394,15 @@ spec: type: object type: array fileSDConfigs: + description: FileSDConfigs defines a list of file service discovery + configurations. items: + description: |- + FileSDConfig defines a file service discovery configuration. + See [here](https://docs.victoriametrics.com/sd_configs#file_sd_configs) properties: files: + description: List of files to be used for file discovery. items: type: string minItems: 1 @@ -32591,20 +25412,44 @@ spec: type: object type: array follow_redirects: + description: FollowRedirects controls redirects for scraping. type: boolean gceSDConfigs: + description: GCESDConfigs defines a list of GCE service discovery + configurations. items: + description: |- + GCESDConfig configures scrape targets from GCP GCE instances. + The private IP address is used by default, but may be changed to + the public IP address with relabeling. + See [here](https://docs.victoriametrics.com/sd_configs#gce_sd_configs) + + The GCE service discovery will load the Google Cloud credentials + from the file specified by the GOOGLE_APPLICATION_CREDENTIALS environment variable. + See https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform properties: filter: + description: |- + Filter can be used optionally to filter the instance list by other criteria + Syntax of this filter is described in the filter query parameter section: + https://cloud.google.com/compute/docs/reference/latest/instances/list type: string port: + description: |- + The port to scrape metrics from. If using the public IP address, this must + instead be specified in the relabeling rule. type: integer project: + description: The Google Cloud Project ID minLength: 1 type: string tagSeparator: + description: The tag separator is used to separate the tags + on concatenation type: string zone: + description: The zone of the scrape targets. If you need multiple + zones use multiple GCESDConfigs. x-kubernetes-preserve-unknown-fields: true required: - project @@ -32612,57 +25457,110 @@ spec: type: object type: array honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. type: boolean honorTimestamps: + description: HonorTimestamps controls whether vmagent respects the + timestamps present in scraped data. type: boolean httpSDConfigs: + description: HTTPSDConfigs defines a list of HTTP service discovery + configurations. items: + description: |- + HTTPSDConfig defines a HTTP service discovery configuration. + See [here](https://docs.victoriametrics.com/sd_configs#http_sd_configs) properties: authorization: + description: Authorization header to use on every scrape request. properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object basicAuth: + description: BasicAuth information to use on every scrape request. properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -32670,32 +25568,66 @@ spec: x-kubernetes-map-type: atomic type: object proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy) properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32703,13 +25635,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -32721,32 +25664,59 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. type: string tlsConfig: + description: TLS configuration to use on every scrape request properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32754,30 +25724,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use + for the targets. type: string cert: + description: Struct containing the client cert file for + the targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32785,28 +25781,47 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object url: + description: URL from which the targets are fetched. minLength: 1 pattern: ^http(s)?://.+$ type: string @@ -32815,64 +25830,123 @@ spec: type: object type: array interval: + description: Interval at which metrics should be scraped type: string kubernetesSDConfigs: + description: KubernetesSDConfigs defines a list of Kubernetes service + discovery configurations. items: + description: |- + KubernetesSDConfig allows retrieving scrape targets from Kubernetes' REST API. + See [here](https://docs.victoriametrics.com/sd_configs#kubernetes_sd_configs) properties: apiServer: + description: |- + The API server address consisting of a hostname or IP address followed + by an optional port number. + If left empty, assuming process is running inside + of the cluster. It will discover API servers automatically and use the pod's + CA certificate and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/. type: string attach_metadata: + description: AttachMetadata configures metadata attaching from + service discovery properties: - namespace: - type: boolean node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. type: boolean type: object authorization: + description: Authorization header to use on every scrape request. properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object basicAuth: + description: BasicAuth information to use on every scrape request. properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -32880,41 +25954,75 @@ spec: x-kubernetes-map-type: atomic type: object followRedirects: + description: Configure whether HTTP requests follow HTTP 3xx + redirects. type: boolean namespaces: + description: Optional namespace discovery. If omitted, discover + targets across all namespaces. properties: names: + description: |- + List of namespaces where to watch for resources. + If empty and `ownNamespace` isn't true, watch for resources in all namespaces. items: type: string type: array ownNamespace: + description: Includes the namespace in which the pod exists + to the list of watched namespaces. type: boolean type: object oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 + client id properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32922,33 +26030,57 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret + file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -32956,32 +26088,66 @@ spec: - token_url type: object proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy) properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -32989,13 +26155,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -33007,31 +26184,23 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. type: string role: - enum: - - node - - pod - - service - - endpoints - - endpointslice - - ingress + description: Role of the Kubernetes entities that should be + discovered. type: string selectors: + description: Selector to select objects. items: + description: K8SSelectorConfig is Kubernetes Selector Config properties: field: type: string label: type: string role: - enum: - - node - - pod - - service - - endpoints - - endpointslice - - ingress type: string required: - role @@ -33041,30 +26210,55 @@ spec: - role x-kubernetes-list-type: map tlsConfig: + description: TLS configuration to use on every scrape request properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -33072,30 +26266,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use + for the targets. type: string cert: + description: Struct containing the client cert file for + the targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -33103,25 +26323,43 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object required: @@ -33129,341 +26367,134 @@ spec: type: object type: array max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped data + for a job type: string metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after scrapping. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array - nomadSDConfigs: - items: - properties: - allowStale: - type: boolean - authorization: - properties: - credentials: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - credentialsFile: - type: string - type: - type: string - type: object - basicAuth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - password_file: - type: string - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - followRedirects: - type: boolean - namespace: - type: string - oauth2: - properties: - client_id: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - client_secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - client_secret_file: - type: string - endpoint_params: - additionalProperties: - type: string - type: object - proxy_url: - type: string - scopes: - items: - type: string - type: array - tls_config: - x-kubernetes-preserve-unknown-fields: true - token_url: - minLength: 1 - type: string - required: - - client_id - - token_url - type: object - proxy_client_config: - properties: - basic_auth: - properties: - password: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - password_file: - type: string - username: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - bearer_token: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - bearer_token_file: - type: string - tls_config: - x-kubernetes-preserve-unknown-fields: true - type: object - proxyURL: - type: string - region: - type: string - server: - minLength: 1 - type: string - tagSeparator: - type: string - tlsConfig: - properties: - ca: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - caFile: - type: string - cert: - properties: - configMap: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - secret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - certFile: - type: string - insecureSkipVerify: - type: boolean - keyFile: - type: string - keySecret: - properties: - key: - type: string - name: - default: "" - type: string - optional: - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - serverName: - type: string - type: object - required: - - server - type: object - type: array oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 client + id properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -33471,33 +26502,56 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -33505,28 +26559,56 @@ spec: - token_url type: object openstackSDConfigs: + description: OpenStackSDConfigs defines a list of OpenStack service + discovery configurations. items: + description: |- + OpenStackSDConfig allow retrieving scrape targets from OpenStack Nova instances. + See [here](https://docs.victoriametrics.com/sd_configs#openstack_sd_configs) properties: allTenants: + description: |- + Whether the service discovery should list all instances for all projects. + It is only relevant for the 'instance' role and usually requires admin permissions. type: boolean applicationCredentialId: + description: ApplicationCredentialID type: string applicationCredentialName: + description: |- + The ApplicationCredentialID or ApplicationCredentialName fields are + required if using an application credential to authenticate. Some providers + allow you to create an application credential to authenticate rather than a + password. type: string applicationCredentialSecret: + description: |- + The applicationCredentialSecret field is required if using an application + credential to authenticate. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic availability: + description: Availability of the endpoint to connect to. enum: - Public - public @@ -33536,34 +26618,65 @@ spec: - internal type: string domainID: + description: DomainID type: string domainName: + description: |- + At most one of domainId and domainName must be provided if using username + with Identity V3. Otherwise, either are optional. type: string identityEndpoint: + description: |- + IdentityEndpoint specifies the HTTP endpoint that is required to work with + the Identity API of the appropriate version. type: string password: + description: |- + Password for the Identity V2 and V3 APIs. Consult with your provider's + control panel to discover your account's preferred method of authentication. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic port: + description: |- + The port to scrape metrics from. If using the public IP address, this must + instead be specified in the relabeling rule. type: integer projectID: + description: ' ProjectID' type: string projectName: + description: |- + The ProjectId and ProjectName fields are optional for the Identity V2 API. + Some providers allow you to specify a ProjectName instead of the ProjectId. + Some require both. Your provider's authentication policies will determine + how these fields influence authentication. type: string region: + description: The OpenStack Region. minLength: 1 type: string role: + description: The OpenStack role of entities that should be discovered. enum: - Instance - instance @@ -33571,30 +26684,55 @@ spec: - hypervisor type: string tlsConfig: + description: TLS configuration to use on every scrape request properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -33602,30 +26740,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use + for the targets. type: string cert: + description: Struct containing the client cert file for + the targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -33633,30 +26797,54 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object userid: + description: UserID type: string username: + description: |- + Username is required if using Identity V2 API. Consult with your provider's + control panel to discover your account's username. + In Identity V3, either userid or a combination of username + and domainId or domainName are needed type: string required: - region @@ -33668,50 +26856,98 @@ spec: items: type: string type: array + description: Optional HTTP URL parameters type: object path: + description: HTTP path to scrape for metrics. type: string proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes to + proxy through this endpoint. type: string relabelConfigs: + description: RelabelConfigs to apply to samples during service discovery. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. Default + is 'replace' type: string if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source label + values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source label + values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 type: integer scheme: + description: HTTP scheme to use for scraping. enum: - http - https @@ -33719,52 +26955,89 @@ spec: - HTTP type: string scrape_interval: - type: string - scrapeClass: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used type: string scrapeTimeout: + description: Timeout after which the scrape is ended type: string seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 type: integer staticConfigs: + description: StaticConfigs defines a list of static targets with a + common label set. items: + description: |- + StaticConfig defines a static configuration. + See [here](https://docs.victoriametrics.com/sd_configs#static_configs) properties: labels: additionalProperties: type: string + description: Labels assigned to all metrics scraped from the + targets. type: object x-kubernetes-map-type: atomic targets: + description: List of targets for this static configuration. items: type: string type: array type: object type: array tlsConfig: + description: TLSConfig configuration to use when scraping the endpoint properties: ca: + description: Struct containing the CA cert to use for the targets. properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -33772,30 +27045,54 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use for the + targets. type: string cert: + description: Struct containing the client cert file for the targets. properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -33803,66 +27100,131 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container for + the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container for + the targets. type: string keySecret: + description: Secret containing the client key file for the targets. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific scrape + parameters properties: disable_compression: + description: DisableCompression type: boolean disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements type: boolean headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version items: type: string type: array no_stale_markers: type: boolean proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -33870,13 +27232,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -33896,34 +27269,58 @@ spec: type: object type: object status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -33938,11 +27335,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -33955,7 +27357,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmservicescrapes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -33979,84 +27381,159 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMServiceScrape is scrape configuration for endpoints associated with + kubernetes service, + it generates scrape configuration for vmagent based on selectors. + result config will scrape service endpoints properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMServiceScrapeSpec defines the desired state of VMServiceScrape properties: attach_metadata: + description: AttachMetadata configures metadata attaching from service + discovery properties: - namespace: - type: boolean node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. type: boolean type: object discoveryRole: + description: |- + DiscoveryRole - defines kubernetes_sd role for objects discovery. + by default, its endpoints. + can be changed to service or endpointslices. + note, that with service setting, you have to use port: "name" + and cannot use targetPort for endpoints. enum: - endpoints - service - endpointslices - - endpointslice type: string endpoints: + description: A list of endpoints allowed as part of this ServiceScrape. items: + description: Endpoint defines a scrapeable endpoint serving metrics. properties: attach_metadata: + description: AttachMetadata configures metadata attaching from + service discovery properties: - namespace: - type: boolean node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. type: boolean type: object authorization: + description: Authorization with http header Authorization properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -34064,92 +27541,181 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: File to read bearer token for scraping targets. type: string bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. nullable: true properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic follow_redirects: + description: FollowRedirects controls redirects for scraping. type: boolean honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. type: boolean honorTimestamps: + description: HonorTimestamps controls whether vmagent respects + the timestamps present in scraped data. type: boolean interval: + description: Interval at which metrics should be scraped type: string max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped + data for a job type: string metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after + scrapping. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source + label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 + client id properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -34157,33 +27723,57 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret + file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -34195,52 +27785,102 @@ spec: items: type: string type: array + description: Optional HTTP URL parameters type: object path: + description: HTTP path to scrape for metrics. type: string port: + description: Name of the port exposed at Service. type: string proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. type: string relabelConfigs: + description: RelabelConfigs to apply to samples during service + discovery. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source + label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array sampleLimit: + description: SampleLimit defines per-scrape limit on number + of scraped samples that will be accepted. + format: int64 type: integer scheme: + description: HTTP scheme to use for scraping. enum: - http - https @@ -34248,41 +27888,78 @@ spec: - HTTP type: string scrape_interval: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used type: string scrapeTimeout: + description: Timeout after which the scrape is ended type: string seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 type: integer targetPort: anyOf: - type: integer - type: string + description: |- + TargetPort + Name or number of the pod port this endpoint refers to. Mutually exclusive with port. x-kubernetes-int-or-string: true tlsConfig: + description: TLSConfig configuration to use when scraping the + endpoint properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -34290,30 +27967,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use + for the targets. type: string cert: + description: Struct containing the client cert file for + the targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -34321,66 +28024,132 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific + scrape parameters properties: disable_compression: + description: DisableCompression type: boolean disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements type: boolean headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version items: type: string type: array no_stale_markers: type: boolean proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key @@ -34388,13 +28157,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -34415,34 +28195,61 @@ spec: type: object type: array jobLabel: + description: The label to use to retrieve the job name from. type: string namespaceSelector: + description: Selector to select which namespaces the Endpoints objects + are discovered from. properties: any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. type: boolean matchNames: + description: List of namespace names. items: type: string type: array type: object podTargetLabels: + description: PodTargetLabels transfers labels on the Kubernetes Pod + onto the target. items: type: string type: array sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 type: integer - scrapeClass: - type: string selector: + description: Selector to select Endpoints objects by corresponding + Service labels. properties: matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector applies + to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -34456,12 +28263,22 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 type: integer targetLabels: + description: TargetLabels transfers labels on the Kubernetes Service + onto the target. items: type: string type: array @@ -34469,34 +28286,58 @@ spec: - endpoints type: object status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -34511,11 +28352,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -34530,7 +28376,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmsingles.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -34552,70 +28398,144 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMSingle is fast, cost-effective and scalable time-series database. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMSingleSpec defines the desired state of VMSingle properties: affinity: + description: Affinity If specified, the pod's scheduling constraints. type: object x-kubernetes-preserve-unknown-fields: true configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder items: type: string type: array containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. type: boolean disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable type: boolean dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. items: x-kubernetes-preserve-unknown-fields: true properties: nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array x-kubernetes-list-type: atomic options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: |- + Name is this DNS resolver option's name. + Required. type: string value: + description: Value is this DNS resolver option's value. type: string type: object type: array x-kubernetes-list-type: atomic searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. items: type: string type: array x-kubernetes-list-type: atomic type: object dnsPolicy: + description: DNSPolicy sets DNS policy for the pod type: string extraArgs: additionalProperties: type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp type: object extraEnvs: + description: ExtraEnvs that will be passed to the application container items: + description: EnvVar represents an environment variable present in + a Container. properties: name: + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string required: - name @@ -34623,127 +28543,227 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap items: + description: EnvFromSource represents the source of a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap must be defined type: boolean type: object x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret must be defined type: boolean type: object x-kubernetes-map-type: atomic type: object type: array host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array x-kubernetes-list-type: atomic ip: + description: IP address of the host file entry. type: string required: - ip type: object type: array hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace type: boolean image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config properties: pullPolicy: + description: PullPolicy describes how to pull docker image type: string repository: + description: Repository contains name of docker image + it's repository + if needed type: string tag: + description: Tag contains desired docker image version type: string type: object imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic type: array initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ items: + description: A single application container that you want to run + within a pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array insertPorts: + description: InsertPorts - additional listen ports for data ingestion. properties: graphitePort: + description: GraphitePort listen port type: string influxPort: + description: InfluxPort listen port type: string openTSDBHTTPPort: + description: OpenTSDBHTTPPort for http connections. type: string openTSDBPort: + description: OpenTSDBPort for tcp and udp listen type: string type: object license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) properties: forceOffline: + description: Enforce offline verification of the license key. type: boolean key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) type: string keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. type: string type: object livenessProbe: + description: LivenessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true logFormat: + description: LogFormat for VMSingle to be configured with. enum: - default - json type: string logLevel: + description: LogLevel for victoria metrics single to be configured + with. enum: - INFO - WARN @@ -34752,67 +28772,139 @@ spec: - PANIC type: string managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object type: object minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle format: int32 type: integer nodeSelector: additionalProperties: type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. type: object paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. type: boolean podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the VMSingle pods. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object port: + description: Port listen address type: string priorityClassName: + description: PriorityClassName class assigned to the Pods type: string readinessGates: + description: ReadinessGates defines pod readiness gates items: + description: PodReadinessGate contains the reference to a pod condition properties: conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. type: string required: - conditionType type: object type: array readinessProbe: + description: ReadinessProbe that will be added CRD pod type: object x-kubernetes-preserve-unknown-fields: true removePvcAfterDelete: + description: |- + RemovePvcAfterDelete - if true, controller adds ownership to pvc + and after VMSingle object deletion - pvc will be garbage collected + by controller manager type: boolean replicaCount: + description: ReplicaCount is the expected size of the Application. format: int32 type: integer resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -34828,6 +28920,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -34836,72 +28931,150 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object retentionPeriod: - pattern: ^[0-9]+(h|d|w|y)?$ + description: |- + RetentionPeriod for the stored metrics + Note VictoriaMetrics has data/ and indexdb/ folders + metrics from data/ removed eventually as soon as partition leaves retention period + reverse index data at indexdb rotates once at the half of configured [retention period](https://docs.victoriametrics.com/Single-server-VictoriaMetrics/#retention) type: string revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. format: int32 type: integer runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ type: string schedulerName: + description: SchedulerName - defines kubernetes scheduler name type: string secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder items: type: string type: array securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods type: string serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmsingle VMServiceScrape + spec required: - endpoints type: object x-kubernetes-preserve-unknown-fields: true serviceSpec: + description: ServiceSpec that will be added to vmsingle service spec properties: metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ type: object x-kubernetes-preserve-unknown-fields: true useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication type: boolean required: - spec type: object startupProbe: + description: StartupProbe that will be added to CRD pod type: object x-kubernetes-preserve-unknown-fields: true storage: + description: |- + Storage is the definition of how storage will be used by the VMSingle + by default it`s empty dir + this option is ignored if storageDataPath is set properties: accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string required: - kind @@ -34909,20 +29082,60 @@ spec: type: object x-kubernetes-map-type: atomic dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: + description: Kind is the type of resource being referenced type: string name: + description: Name is the name of resource being referenced type: string namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. type: string required: - kind - name type: object resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: limits: additionalProperties: @@ -34931,6 +29144,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -34939,18 +29155,40 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object selector: + description: selector is a label query over volumes to consider + for binding. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -34964,176 +29202,393 @@ spec: matchLabels: additionalProperties: type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). type: string volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. type: string volumeName: + description: volumeName is the binding reference to the PersistentVolume + backing this claim. type: string type: object storageDataPath: + description: |- + StorageDataPath disables spec.storage option and overrides arg for victoria-metrics binary --storageDataPath, + its users responsibility to mount proper device into given path. + It requires to provide spec.volumes and spec.volumeMounts with at least 1 value type: string storageMetadata: + description: StorageMeta defines annotations and labels attached to + PVC for given vmsingle CR properties: annotations: additionalProperties: type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations type: object labels: additionalProperties: type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels type: object name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names type: string type: object streamAggrConfig: + description: StreamAggrConfig defines stream aggregation configuration + for VMSingle properties: configmap: + description: ConfigMap with stream aggregation rules properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic dedupInterval: + description: Allows setting different de-duplication intervals + per each configured remote storage type: string dropInput: + description: Allow drop all the input samples after the aggregation type: boolean dropInputLabels: + description: labels to drop from samples for aggregator before + stream de-duplication and aggregation items: type: string type: array enableWindows: + description: EnableWindows enables aggregating data in separate + windows ( available from v0.54.0). type: boolean ignoreFirstIntervals: + description: IgnoreFirstIntervals instructs to ignore first interval type: integer - ignoreFirstSampleInterval: - type: string ignoreOldSamples: + description: IgnoreOldSamples instructs to ignore samples with + old timestamps outside the current aggregation interval. type: boolean keepInput: + description: Allows writing both raw and aggregate data type: boolean rules: + description: Stream aggregation rules items: + description: StreamAggrRule defines the rule in stream aggregation + config properties: by: + description: |- + By is an optional list of labels for grouping input series. + + See also Without. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. items: type: string type: array dedup_interval: + description: DedupInterval is an optional interval for deduplication. type: string drop_input_labels: + description: |- + DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples. + + Labels are dropped before de-duplication and aggregation. items: type: string type: array enable_windows: + description: EnableWindows enables aggregating data in separate + windows type: boolean flush_on_shutdown: + description: |- + FlushOnShutdown defines whether to flush the aggregation state on process termination + or config reload. Is `false` by default. + It is not recommended changing this setting, unless unfinished aggregations states + are preferred to missing data points. type: boolean ignore_first_intervals: type: integer ignore_old_samples: + description: IgnoreOldSamples instructs to ignore samples + with old timestamps outside the current aggregation interval. type: boolean - ignoreFirstSampleInterval: - type: string input_relabel_configs: + description: |- + InputRelabelConfigs is an optional relabeling rules, which are applied on the input + before aggregation. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for + `action: graphite`' type: object match: + description: 'Match is used together with Labels for + `action: graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated + source label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array interval: + description: Interval is the interval between aggregations. type: string keep_metric_names: + description: KeepMetricNames instructs to leave metric names + as is for the output time series without adding any suffix. type: boolean match: + description: |- + Match is a label selector (or list of label selectors) for filtering time series for the given selector. + + If the match isn't set, then all the input time series are processed. x-kubernetes-preserve-unknown-fields: true no_align_flush_to_interval: + description: |- + NoAlignFlushToInterval disables aligning of flushes to multiples of Interval. + By default flushes are aligned to Interval. type: boolean output_relabel_configs: + description: |- + OutputRelabelConfigs is an optional relabeling rules, which are applied + on the aggregated output before being sent to remote storage. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for + `action: graphite`' type: object match: + description: 'Match is used together with Labels for + `action: graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated + source label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array outputs: + description: |- + Outputs is a list of output aggregate functions to produce. + + The following names are allowed: + + - total - aggregates input counters + - increase - counts the increase over input counters + - count_series - counts the input series + - count_samples - counts the input samples + - sum_samples - sums the input samples + - last - the last biggest sample value + - min - the minimum sample value + - max - the maximum sample value + - avg - the average value across all the samples + - stddev - standard deviation across all the samples + - stdvar - standard variance across all the samples + - histogram_bucket - creates VictoriaMetrics histogram for input samples + - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1] + + The output time series will have the following names: + + input_name:aggr__ items: type: string type: array staleness_interval: + description: |- + Staleness interval is interval after which the series state will be reset if no samples have been sent during it. + The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket. type: string without: + description: |- + Without is an optional list of labels, which must be excluded when grouping input series. + + See also By. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. items: type: string type: array @@ -35144,26 +29599,58 @@ spec: type: array type: object terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination format: int64 type: integer tolerations: + description: Tolerations If specified, the pod's tolerations. items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . properties: effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. required: - maxSkew - topologyKey @@ -35172,120 +29659,196 @@ spec: x-kubernetes-preserve-unknown-fields: true type: array useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements type: boolean useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions type: boolean vmBackup: + description: VMBackup configuration for backup properties: acceptEULA: + description: |- + AcceptEULA accepts enterprise feature usage, must be set to true. + otherwise backupmanager cannot be added to single/cluster version. + https://victoriametrics.com/legal/esa/ type: boolean concurrency: + description: Defines number of concurrent workers. Higher concurrency + may reduce backup duration (default 10) format: int32 type: integer credentialsSecret: + description: |- + CredentialsSecret is secret in the same namespace for access to remote storage + The secret is mounted into /etc/vm/creds. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic customS3Endpoint: + description: Custom S3 endpoint for use with S3-compatible storages + (e.g. MinIO). S3 is used if not set type: string destination: + description: Defines destination for backup type: string destinationDisableSuffixAdd: + description: |- + DestinationDisableSuffixAdd - disables suffix adding for cluster version backups + each vmstorage backup must have unique backup folder + so operator adds POD_NAME as suffix for backup destination folder. type: boolean disableDaily: + description: Defines if daily backups disabled (default false) type: boolean disableHourly: + description: Defines if hourly backups disabled (default false) type: boolean disableMonthly: + description: Defines if monthly backups disabled (default false) type: boolean disableWeekly: + description: Defines if weekly backups disabled (default false) type: boolean extraArgs: additionalProperties: type: string + description: extra args like maxBytesPerSecond default 0 type: object extraEnvs: items: + description: EnvVar represents an environment variable present + in a Container. properties: name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. type: string value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select in the + specified API version. type: string required: - fieldPath type: object x-kubernetes-map-type: atomic - fileKeyRef: - properties: - key: - type: string - optional: - default: false - type: boolean - path: - type: string - volumeName: - type: string - required: - - key - - path - - volumeName - type: object - x-kubernetes-map-type: atomic resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. properties: containerName: + description: 'Container name: required for volumes, + optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the pod's + namespace properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -35297,45 +29860,77 @@ spec: type: object type: array extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap items: + description: EnvFromSource represents the source of a set of + ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap must be defined type: boolean type: object x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each key + in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret must be defined type: boolean type: object x-kubernetes-map-type: atomic type: object type: array image: + description: Image - docker image settings for VMBackuper properties: pullPolicy: + description: PullPolicy describes how to pull docker image type: string repository: + description: Repository contains name of docker image + it's + repository if needed type: string tag: + description: Tag contains desired docker image version type: string type: object logFormat: + description: |- + LogFormat for VMBackup to be configured with. + default or json enum: - default - json type: string logLevel: + description: LogLevel for VMBackup to be configured with. enum: - INFO - WARN @@ -35344,15 +29939,36 @@ spec: - PANIC type: string port: + description: Port for health check connections type: string resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used properties: claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. type: string required: - name @@ -35368,6 +29984,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -35376,36 +29995,94 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object restore: + description: |- + Restore Allows to enable restore options for pod + Read [more](https://docs.victoriametrics.com/vmbackupmanager#restore-commands) properties: onStart: + description: OnStart defines configuration for restore on + pod start properties: enabled: + description: Enabled defines if restore on start enabled type: boolean type: object type: object snapshotCreateURL: + description: SnapshotCreateURL overwrites url for snapshot create type: string snapshotDeleteURL: + description: SnapShotDeleteURL overwrites url for snapshot delete type: string volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment definition. + VolumeMounts specified will be appended to other VolumeMounts in the vmbackupmanager container, + that are generated as a result of StorageSpec objects. items: + description: VolumeMount describes a mounting of a Volume within + a container. properties: mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. type: string mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. type: boolean recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. type: string subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -35414,21 +30091,65 @@ spec: type: array type: object volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container items: + description: VolumeMount describes a mounting of a Volume within + a container. properties: mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. type: string mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. type: boolean recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. type: string subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -35436,42 +30157,74 @@ spec: type: object type: array volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. required: - name type: object x-kubernetes-preserve-unknown-fields: true type: array + required: + - retentionPeriod type: object status: + description: VMSingleStatus defines the observed state of VMSingle properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -35486,11 +30239,20 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason + type: string + singleStatus: + description: LegacyStatus is deprecated and will be removed at v0.52.0 + version type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -35503,7 +30265,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmstaticscrapes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -35527,71 +30289,137 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMStaticScrape defines static targets configuration for scraping. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMStaticScrapeSpec defines the desired state of VMStaticScrape. properties: jobName: + description: JobName name of job. type: string sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 type: integer - scrapeClass: - type: string seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 type: integer targetEndpoints: + description: A list of target endpoints to scrape metrics from. items: + description: TargetEndpoint defines single static target endpoint. properties: authorization: + description: Authorization with http header Authorization properties: credentials: + description: Reference to the secret with value for authorization properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic credentialsFile: + description: File with value for authorization type: string type: + description: Type of authorization, default to bearer type: string type: object basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -35599,96 +30427,186 @@ spec: x-kubernetes-map-type: atomic type: object bearerTokenFile: + description: File to read bearer token for scraping targets. type: string bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. nullable: true properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic follow_redirects: + description: FollowRedirects controls redirects for scraping. type: boolean honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. type: boolean honorTimestamps: + description: HonorTimestamps controls whether vmagent respects + the timestamps present in scraped data. type: boolean interval: + description: Interval at which metrics should be scraped type: string labels: additionalProperties: type: string + description: Labels static labels for targets. type: object max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped + data for a job type: string metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after + scrapping. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source + label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array oauth2: + description: OAuth2 defines auth configuration properties: client_id: + description: The secret or configmap containing the OAuth2 + client id properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -35696,33 +30614,57 @@ spec: x-kubernetes-map-type: atomic type: object client_secret: + description: The secret containing the OAuth2 client secret properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic client_secret_file: + description: ClientSecretFile defines path for client secret + file. type: string endpoint_params: additionalProperties: type: string + description: Parameters to append to the token URL type: object proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family type: string scopes: + description: OAuth2 scopes used for the token request items: type: string type: array tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: + description: The URL to fetch the token from minLength: 1 type: string required: @@ -35734,50 +30676,99 @@ spec: items: type: string type: array + description: Optional HTTP URL parameters type: object path: + description: HTTP path to scrape for metrics. type: string proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. type: string relabelConfigs: + description: RelabelConfigs to apply to samples during service + discovery. items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling properties: action: + description: Action to perform based on regex matching. + Default is 'replace' type: string if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' x-kubernetes-preserve-unknown-fields: true labels: additionalProperties: type: string + description: 'Labels is used together with Match for `action: + graphite`' type: object match: + description: 'Match is used together with Labels for `action: + graphite`' type: string modulus: + description: Modulus to take of the hash of the source + label values. format: int64 type: integer regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements x-kubernetes-preserve-unknown-fields: true replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' type: string separator: + description: Separator placed between concatenated source + label values. default is ';'. type: string source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 items: type: string type: array sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. items: type: string type: array target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 type: string targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. type: string type: object type: array sampleLimit: + description: SampleLimit defines per-scrape limit on number + of scraped samples that will be accepted. + format: int64 type: integer scheme: + description: HTTP scheme to use for scraping. enum: - http - https @@ -35785,41 +30776,76 @@ spec: - HTTP type: string scrape_interval: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used type: string scrapeTimeout: + description: Timeout after which the scrape is ended type: string seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 type: integer targets: + description: Targets static targets addresses in form of ["192.122.55.55:9100","some-name:9100"]. items: type: string minItems: 1 type: array tlsConfig: + description: TLSConfig configuration to use when scraping the + endpoint properties: ca: + description: Struct containing the CA cert to use for the + targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -35827,30 +30853,56 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use + for the targets. type: string cert: + description: Struct containing the client cert file for + the targets. properties: configMap: + description: ConfigMap containing data to use for the + targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -35858,66 +30910,132 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container + for the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container + for the targets. type: string keySecret: + description: Secret containing the client key file for the + targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific + scrape parameters properties: disable_compression: + description: DisableCompression type: boolean disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements type: boolean headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version items: type: string type: array no_stale_markers: type: boolean proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy properties: basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication properties: password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted type: string username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key @@ -35925,13 +31043,24 @@ spec: x-kubernetes-map-type: atomic type: object bearer_token: + description: SecretKeySelector selects a key of a Secret. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key + must be defined type: boolean required: - key @@ -35957,34 +31086,58 @@ spec: - targetEndpoints type: object status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -35999,11 +31152,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -36016,7 +31174,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmusers.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -36040,36 +31198,79 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMUser is the Schema for the vmusers API properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMUserSpec defines the desired state of VMUser properties: bearerToken: + description: BearerToken Authorization header value for accessing + protected endpoint. type: string default_url: + description: |- + DefaultURLs backend url for non-matching paths filter + usually used for default backend with error message items: type: string type: array disable_secret_creation: + description: DisableSecretCreation skips related secret creation for + vmuser type: boolean discover_backend_ips: + description: DiscoverBackendIPs instructs discovering URLPrefix backend + IPs via DNS. type: boolean drop_src_path_prefix_parts: + description: |- + DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend. + See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details. type: integer dump_request_on_errors: + description: |- + DumpRequestOnErrors instructs vmauth to return detailed request params to the client + if routing rules don't allow to forward request to the backends. + Useful for debugging `src_hosts` and `src_headers` based routing rules + + available since v1.107.0 vmauth version type: boolean generatePassword: + description: |- + GeneratePassword instructs operator to generate password for user + if spec.password if empty. type: boolean headers: + description: |- + Headers represent additional http headers, that vmauth uses + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.68.0 version of vmauth items: type: string type: array ip_filters: + description: |- + IPFilters defines per target src ip filters + supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/vmauth/#ip-filters) properties: allow_list: items: @@ -36081,58 +31282,91 @@ spec: type: array type: object load_balancing_policy: + description: |- + LoadBalancingPolicy defines load balancing policy to use for backend urls. + Supported policies: least_loaded, first_available. + See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded") enum: - least_loaded - first_available type: string - managedMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object max_concurrent_requests: + description: |- + MaxConcurrentRequests defines max concurrent requests per user + 300 is default value for vmauth type: integer metric_labels: additionalProperties: type: string + description: MetricLabels - additional labels for metrics exported + by vmauth for given user. type: object name: + description: Name of the VMUser object. type: string password: + description: Password basic auth password for accessing protected + endpoint. type: string passwordRef: + description: PasswordRef allows fetching password from user-create + secret by its name and key. properties: key: + description: The key of the secret to select from. Must be a + valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic response_headers: + description: |- + ResponseHeaders represent additional http headers, that vmauth adds for request response + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.93.0 version of vmauth items: type: string type: array retry_status_codes: + description: |- + RetryStatusCodes defines http status codes in numeric format for request retries + e.g. [429,503] items: type: integer type: array targetRefs: + description: TargetRefs - reference to endpoints, which user may access. items: + description: |- + TargetRef describes target for user traffic forwarding. + one of target types can be chosen: + crd or static per targetRef. + user can define multiple targetRefs with different ref Types. properties: crd: + description: |- + CRD describes exist operator's CRD object, + operator generates access url based on CRD params. properties: kind: + description: |- + Kind one of: + VMAgent,VMAlert, VMSingle, VMCluster/vmselect, VMCluster/vmstorage,VMCluster/vminsert or VMAlertManager enum: - VMAgent - VMAlert @@ -36143,19 +31377,12 @@ spec: - VMCluster/vmselect - VMCluster/vmstorage - VMCluster/vminsert - - VLSingle - - VLCluster/vlinsert - - VLCluster/vlselect - - VLCluster/vlstorage - - VLAgent - - VTCluster/vtinsert - - VTCluster/vtselect - - VTCluster/vtstorage - - VTSingle type: string name: + description: Name target CRD object name type: string namespace: + description: Namespace target CRD object namespace. type: string required: - kind @@ -36163,10 +31390,21 @@ spec: - namespace type: object discover_backend_ips: + description: DiscoverBackendIPs instructs discovering URLPrefix + backend IPs via DNS. type: boolean drop_src_path_prefix_parts: + description: |- + DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend. + See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details. type: integer headers: + description: |- + RequestHeaders represent additional http headers, that vmauth uses + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.68.0 version of vmauth items: type: string type: array @@ -36175,78 +31413,123 @@ spec: type: string type: array load_balancing_policy: + description: |- + LoadBalancingPolicy defines load balancing policy to use for backend urls. + Supported policies: least_loaded, first_available. + See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded") enum: - least_loaded - first_available type: string paths: + description: Paths - matched path to route. items: type: string type: array - query_args: - items: - properties: - name: - type: string - values: - items: - type: string - type: array - required: - - name - - values - type: object - type: array response_headers: + description: |- + ResponseHeaders represent additional http headers, that vmauth adds for request response + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.93.0 version of vmauth items: type: string type: array retry_status_codes: + description: |- + RetryStatusCodes defines http status codes in numeric format for request retries + Can be defined per target or at VMUser.spec level + e.g. [429,503] items: type: integer type: array src_headers: + description: SrcHeaders is an optional list of headers, which + must match request headers. items: type: string type: array src_query_args: + description: SrcQueryArgs is an optional list of query args, + which must match request URL query args. items: type: string type: array static: + description: |- + Static - user defined url for traffic forward, + for instance http://vmsingle:8429 properties: url: + description: URL http url for given staticRef. type: string urls: + description: URLs allows setting multiple urls for load-balancing + at vmauth-side. items: type: string type: array type: object target_path_suffix: + description: |- + TargetPathSuffix allows to add some suffix to the target path + It allows to hide tenant configuration from user with crd as ref. + it also may contain any url encoded params. type: string targetRefBasicAuth: + description: TargetRefBasicAuth allow an target endpoint to + authenticate over basic authentication properties: password: + description: |- + The secret in the service scrape namespace that contains the password + for authentication. + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic username: + description: |- + The secret in the service scrape namespace that contains the username + for authentication. + It must be at them same namespace as CRD properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -36259,30 +31542,53 @@ spec: type: object type: array tlsConfig: + description: TLSConfig defines tls configuration for the backend connection properties: ca: + description: Struct containing the CA cert to use for the targets. properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -36290,30 +31596,54 @@ spec: x-kubernetes-map-type: atomic type: object caFile: + description: Path to the CA cert in the container to use for the + targets. type: string cert: + description: Struct containing the client cert file for the targets. properties: configMap: + description: ConfigMap containing data to use for the targets. properties: key: + description: The key to select. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the ConfigMap or its key + must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic secret: + description: Secret containing data to use for the targets. properties: key: + description: The key of the secret to select from. Must + be a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must + be defined type: boolean required: - key @@ -36321,74 +31651,129 @@ spec: x-kubernetes-map-type: atomic type: object certFile: + description: Path to the client cert file in the container for + the targets. type: string insecureSkipVerify: + description: Disable target certificate validation. type: boolean keyFile: + description: Path to the client key file in the container for + the targets. type: string keySecret: + description: Secret containing the client key file for the targets. properties: key: + description: The key of the secret to select from. Must be + a valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be + defined type: boolean required: - key type: object x-kubernetes-map-type: atomic serverName: + description: Used to verify the hostname for the targets. type: string type: object tokenRef: + description: TokenRef allows fetching token from user-created secrets + by its name and key. properties: key: + description: The key of the secret to select from. Must be a + valid secret key. type: string name: default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: + description: Specify whether the Secret or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic username: + description: |- + UserName basic auth user name for accessing protected endpoint, + will be replaced with metadata.name of VMUser if omitted. type: string required: - targetRefs type: object status: + description: VMUserStatus defines the observed state of VMUser properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -36403,2507 +31788,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vtclusters.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VTCluster - listKind: VTClusterList - plural: vtclusters - singular: vtcluster - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: replicas of VTInsert - jsonPath: .spec.insert.replicaCount - name: Insert Count - type: string - - description: replicas of VTStorage - jsonPath: .spec.storage.replicaCount - name: Storage Count - type: string - - description: replicas of VTSelect - jsonPath: .spec.select.replicaCount - name: Select Count - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Current status of cluster - jsonPath: .status.updateStatus - name: Status - type: string - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - clusterDomainName: - type: string - clusterVersion: - type: string - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - insert: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - hpa: - type: object - x-kubernetes-preserve-unknown-fields: true - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdate: - properties: - maxSurge: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - updateStrategy: - enum: - - Recreate - - RollingUpdate - type: string - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object - type: object - managedMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - paused: - type: boolean - requestsLoadBalancer: - properties: - disableInsertBalancing: - type: boolean - disableSelectBalancing: - type: boolean - enabled: - type: boolean - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - select: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - extraStorageNodes: - items: - properties: - addr: - type: string - required: - - addr - type: object - type: array - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - hpa: - type: object - x-kubernetes-preserve-unknown-fields: true - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdate: - properties: - maxSurge: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - updateStrategy: - enum: - - Recreate - - RollingUpdate - type: string - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object - type: object - serviceAccountName: - type: string - storage: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - claimTemplates: - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - futureRetention: - pattern: ^[0-9]+(h|d|w|y)?$ - type: string - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - hpa: - properties: - behaviour: - properties: - scaleDown: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - scaleUp: - properties: - policies: - items: - properties: - periodSeconds: - format: int32 - type: integer - type: - type: string - value: - format: int32 - type: integer - required: - - periodSeconds - - type - - value - type: object - type: array - x-kubernetes-list-type: atomic - selectPolicy: - type: string - stabilizationWindowSeconds: - format: int32 - type: integer - tolerance: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - maxReplicas: - format: int32 - type: integer - metrics: - items: - properties: - containerResource: - properties: - container: - type: string - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - container - - name - - target - type: object - external: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - object: - properties: - describedObject: - properties: - apiVersion: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - describedObject - - metric - - target - type: object - pods: - properties: - metric: - properties: - name: - type: string - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - required: - - name - type: object - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - metric - - target - type: object - resource: - properties: - name: - type: string - target: - properties: - averageUtilization: - format: int32 - type: integer - averageValue: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - type: string - value: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - required: - - type - type: object - required: - - name - - target - type: object - type: - type: string - required: - - type - type: object - type: array - minReplicas: - format: int32 - type: integer - type: object - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logIngestedRows: - type: boolean - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - logNewStreams: - type: boolean - maintenanceInsertNodeIDs: - items: - format: int32 - type: integer - type: array - maintenanceSelectNodeIDs: - items: - format: int32 - type: integer - type: array - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - persistentVolumeClaimRetentionPolicy: - properties: - whenDeleted: - type: string - whenScaled: - type: string - type: object - podDisruptionBudget: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - minAvailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - selectorLabels: - additionalProperties: - type: string - type: object - unhealthyPodEvictionPolicy: - enum: - - IfHealthyBudget - - AlwaysAllow - type: string - type: object - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - retentionMaxDiskSpaceUsageBytes: - type: string - retentionPeriod: - pattern: ^[0-9]+(h|d|w|y)?$ - type: string - revisionHistoryLimitCount: - format: int32 - type: integer - rollingUpdateStrategy: - type: string - rollingUpdateStrategyBehavior: - properties: - maxUnavailable: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - storage: - properties: - emptyDir: - properties: - medium: - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - volumeClaimTemplate: - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - storageDataPath: - type: string - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - vpa: - properties: - recommenders: - items: - properties: - name: - type: string - required: - - name - type: object - type: array - resourcePolicy: - properties: - containerPolicies: - items: - properties: - containerName: - type: string - controlledResources: - items: - type: string - type: array - controlledValues: - enum: - - RequestsAndLimits - - RequestsOnly - type: string - maxAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - minAllowed: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - mode: - enum: - - Auto - - "Off" - type: string - type: object - type: array - type: object - updatePolicy: - properties: - evictionRequirements: - items: - properties: - changeRequirement: - enum: - - TargetHigherThanRequests - - TargetLowerThanRequests - type: string - resources: - items: - type: string - type: array - required: - - changeRequirement - - resources - type: object - type: array - minReplicas: - format: int32 - type: integer - updateMode: - enum: - - "Off" - - Initial - - Recreate - - InPlaceOrRecreate - - Auto - type: string - type: object - type: object - type: object - useStrictSecurity: - type: boolean - type: object - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vtsingles.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VTSingle - listKind: VTSingleList - plural: vtsingles - singular: vtsingle - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: Current status of traces instance update process - jsonPath: .status.status - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - affinity: - type: object - x-kubernetes-preserve-unknown-fields: true - configMaps: - items: - type: string - type: array - containers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - disableAutomountServiceAccountToken: - type: boolean - disableSelfServiceScrape: - type: boolean - dnsConfig: - items: - x-kubernetes-preserve-unknown-fields: true - properties: - nameservers: - items: - type: string - type: array - x-kubernetes-list-type: atomic - options: - items: - properties: - name: - type: string - value: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - searches: - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - dnsPolicy: - type: string - extraArgs: - additionalProperties: - type: string - type: object - extraEnvs: - items: - properties: - name: - type: string - value: - type: string - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - extraEnvsFrom: - items: - properties: - configMapRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - prefix: - type: string - secretRef: - properties: - name: - default: "" - type: string - optional: - type: boolean - type: object - x-kubernetes-map-type: atomic - type: object - type: array - futureRetention: - pattern: ^[0-9]+(h|d|y)?$ - type: string - host_aliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostAliases: - items: - properties: - hostnames: - items: - type: string - type: array - x-kubernetes-list-type: atomic - ip: - type: string - required: - - ip - type: object - type: array - hostNetwork: - type: boolean - image: - properties: - pullPolicy: - type: string - repository: - type: string - tag: - type: string - type: object - imagePullSecrets: - items: - properties: - name: - default: "" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - initContainers: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - livenessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - logFormat: - enum: - - default - - json - type: string - logIngestedRows: - type: boolean - logLevel: - enum: - - INFO - - WARN - - ERROR - - FATAL - - PANIC - type: string - logNewStreams: - type: boolean - managedMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - minReadySeconds: - format: int32 - type: integer - nodeSelector: - additionalProperties: - type: string - type: object - paused: - type: boolean - podMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - port: - type: string - priorityClassName: - type: string - readinessGates: - items: - properties: - conditionType: - type: string - required: - - conditionType - type: object - type: array - readinessProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - replicaCount: - format: int32 - type: integer - resources: - properties: - claims: - items: - properties: - name: - type: string - request: - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - retentionMaxDiskSpaceUsageBytes: - type: string - retentionPeriod: - pattern: ^[0-9]+(h|d|w|y)?$ - type: string - revisionHistoryLimitCount: - format: int32 - type: integer - runtimeClassName: - type: string - schedulerName: - type: string - secrets: - items: - type: string - type: array - securityContext: - type: object - x-kubernetes-preserve-unknown-fields: true - serviceAccountName: - type: string - serviceScrapeSpec: - required: - - endpoints - type: object - x-kubernetes-preserve-unknown-fields: true - serviceSpec: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - useAsDefault: - type: boolean - required: - - spec - type: object - startupProbe: - type: object - x-kubernetes-preserve-unknown-fields: true - storage: - properties: - accessModes: - items: - type: string - type: array - x-kubernetes-list-type: atomic - dataSource: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - properties: - apiGroup: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - resources: - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - type: string - volumeAttributesClassName: - type: string - volumeMode: - type: string - volumeName: - type: string - type: object - storageDataPath: - type: string - storageMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - name: - type: string - type: object - terminationGracePeriodSeconds: - format: int64 - type: integer - tolerations: - items: - properties: - effect: - type: string - key: - type: string - operator: - type: string - tolerationSeconds: - format: int64 - type: integer - value: - type: string - type: object - type: array - topologySpreadConstraints: - items: - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - useDefaultResources: - type: boolean - useStrictSecurity: - type: boolean - volumeMounts: - items: - properties: - mountPath: - type: string - mountPropagation: - type: string - name: - type: string - readOnly: - type: boolean - recursiveReadOnly: - type: string - subPath: - type: string - subPathExpr: - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - items: - required: - - name - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - type: object - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/files/crd.yaml.bz2 b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/files/crd.yaml.bz2 deleted file mode 100644 index ab7c4d95..00000000 Binary files a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/files/crd.yaml.bz2 and /dev/null differ diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/_helpers.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/_helpers.yaml deleted file mode 100644 index 65e96fc6..00000000 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/_helpers.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- define "crds.upgrade.name" -}} -{{- print (include "vm.plain.fullname" .) "-upgrade-crds" }} -{{- end -}} - -{{- define "crds.upgrade.serviceAccountName" -}} -{{- $Values := (.helm).Values | default .Values }} -{{- $upgrade := $Values.upgrade }} -{{- if $upgrade.serviceAccount.create -}} - {{ default (include "crds.upgrade.name" .) $upgrade.serviceAccount.name }} -{{- else -}} - {{ default "default" $upgrade.serviceAccount.name }} -{{- end -}} -{{- end -}} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/cm.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/cm.yaml deleted file mode 100644 index 40cd8ed5..00000000 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/cm.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.upgrade.enabled }} -{{- $ctx := dict "helm" . }} -{{- $upgrade := .Values.upgrade }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "crds.upgrade.serviceAccountName" $ctx }} - namespace: {{ template "vm.namespace" $ctx }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,pre-rollback - "helm.sh/hook-weight": "-2" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - {{- $_ := set $ctx "extraLabels" (dict "app.kubernetes.io/component" "upgrade-crds") }} - labels: {{ include "vm.labels" $ctx | nindent 4 }} - {{- $_ := unset $ctx "extraLabels" }} -binaryData: - crd.yaml.bz2: {{ .Files.Get "files/crd.yaml.bz2" | b64enc }} -{{- end }} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/job.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/job.yaml deleted file mode 100644 index 2884157f..00000000 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/job.yaml +++ /dev/null @@ -1,126 +0,0 @@ -{{- if .Values.upgrade.enabled }} -{{- $app := .Values.upgrade }} -{{- if empty (($app.kubectl).image).tag }} - {{- $tag := regexSplit "[+-]" .Capabilities.KubeVersion.Version -1 | first -}} - {{- $_ := set $app.kubectl.image "tag" $tag }} -{{- else if not (kindIs "string" (($app.kubectl).image).tag) }} - {{- fail "`crd.upgrade.kubectl.image.tag` is not string, most probably you need to enquote provided value" -}} -{{- end }} -{{- $ctx := dict "helm" . "noEnterprise" true }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "crds.upgrade.name" $ctx }} - namespace: {{ template "vm.namespace" $ctx }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,pre-rollback - "helm.sh/hook-weight": "5" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - {{- with $app.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- $extraLabels := $app.labels | default dict }} - {{- $_ := set $ctx "extraLabels" $app.labels }} - {{- $_ := set $extraLabels "app.kubernetes.io/component" "upgrade-crds" }} - {{- $_ := set $ctx "extraLabels" $extraLabels }} - labels: {{ include "vm.labels" $ctx | nindent 4 }} - {{- $_ := unset $ctx "extraLabels" }} -spec: - backoffLimit: 3 - template: - metadata: - {{- with $app.podLabels }} - labels: {{ toYaml . | nindent 8 }} - {{- end }} - {{- with $app.podAnnotations }} - annotations: {{ toYaml . | nindent 8 }} - {{- end }} - spec: - {{- with (.Values.imagePullSecrets | default (.Values.global).imagePullSecrets) }} - imagePullSecrets: {{ toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "crds.upgrade.serviceAccountName" . }} - {{- if ($app.podSecurityContext).enabled }} - securityContext: {{ include "vm.securityContext" (dict "securityContext" $app.podSecurityContext "helm" .) | nindent 8 }} - {{- end }} - initContainers: - - name: busybox - {{- $_ := set $ctx "appKey" (list "upgrade" "busybox") }} - image: {{ include "vm.image" $ctx }} - imagePullPolicy: {{ $app.busybox.image.pullPolicy }} - workingDir: /tmp/ - command: - - sh - args: - - -c - - bzcat /crds/crd.yaml.bz2 > /tmp/crd.yaml - {{- with $app.resources }} - resources: {{ toYaml . | nindent 12 }} - {{- end }} - {{- with $app.securityContext }} - securityContext: {{ toYaml . | nindent 12 }} - {{- end }} - volumeMounts: - - mountPath: /crds/ - name: crds - - mountPath: /tmp/ - name: tmp - {{- with $app.extraVolumeMounts }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with $app.env }} - env: {{ toYaml . | nindent 12 }} - {{- end }} - containers: - - name: kubectl - {{- $_ := set $ctx "appKey" (list "upgrade" "kubectl") }} - image: {{ include "vm.image" $ctx }} - imagePullPolicy: {{ $app.kubectl.image.pullPolicy }} - command: - - kubectl - args: - - apply - - --server-side - {{- if $app.forceConflicts }} - - --force-conflicts - {{- end }} - - --filename - - /tmp/crd.yaml - {{- with $app.resources }} - resources: {{ toYaml . | nindent 12 }} - {{- end }} - {{- with $app.securityContext }} - securityContext: {{ toYaml . | nindent 12 }} - {{- end }} - volumeMounts: - - mountPath: /tmp/ - name: tmp - {{- with $app.extraVolumeMounts }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with $app.env }} - env: {{ toYaml . | nindent 12 }} - {{- end }} - volumes: - - name: tmp - emptyDir: {} - - name: crds - configMap: - name: {{ template "crds.upgrade.name" . }} - {{- with $app.extraVolumes }} - {{- toYaml . | nindent 8 }} - {{- end }} - restartPolicy: OnFailure - {{- with $app.nodeSelector }} - nodeSelector: {{ toYaml . | nindent 8 }} - {{- end }} - {{- with $app.tolerations }} - tolerations: {{ toYaml . | nindent 8 }} - {{- end }} - {{- with $app.affinity }} - affinity: {{ toYaml . | nindent 8 }} - {{- end }} - {{- with $app.topologySpreadConstraints }} - topologySpreadConstraints: {{ toYaml . | nindent 8 }} - {{- end }} -{{- end }} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/role.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/role.yaml deleted file mode 100644 index 7cb71a2d..00000000 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/role.yaml +++ /dev/null @@ -1,52 +0,0 @@ -{{- if .Values.upgrade.enabled }} -{{- $ctx := dict "helm" . }} -{{- $_ := set $ctx "extraLabels" (dict "app.kubernetes.io/component" "upgrade-crds") }} -{{- $labels := include "vm.labels" $ctx }} -{{- $_ := unset $ctx "extraLabels" }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "crds.upgrade.name" . }} - namespace: {{ template "vm.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,pre-rollback - "helm.sh/hook-weight": "-5" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: {{ $labels | nindent 4 }} - {{- $crds := .Files.Get "crds/crd.yaml" | splitList "---" }} -rules: - - apiGroups: - - "apiextensions.k8s.io" - resources: - - "customresourcedefinitions" - verbs: - - create - - patch - - update - - get - - list - resourceNames: - {{- range $crds }} - {{- $crd := fromYaml . }} - - {{ $crd.metadata.name }} - {{- end }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "crds.upgrade.name" . }} - namespace: {{ template "vm.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,pre-rollback - "helm.sh/hook-weight": "-3" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: {{ $labels | nindent 4 }} -subjects: - - kind: ServiceAccount - namespace: {{ template "vm.namespace" . }} - name: {{ template "crds.upgrade.serviceAccountName" . }} -roleRef: - kind: ClusterRole - name: {{ template "crds.upgrade.name" . }} - apiGroup: rbac.authorization.k8s.io -{{- end }} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/serviceaccount.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/serviceaccount.yaml deleted file mode 100644 index 2fa0dc40..00000000 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/templates/serviceaccount.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- $upgrade := .Values.upgrade }} -{{- if and $upgrade.enabled $upgrade.serviceAccount.create }} -{{- $ctx := dict "helm" . }} -{{- $fullname := include "vm.plain.fullname" $ctx }} -{{- $ns := include "vm.namespace" $ctx }} -{{- $sa := $upgrade.serviceAccount }} -apiVersion: v1 -kind: ServiceAccount -automountServiceAccountToken: {{ $sa.automountServiceAccountToken }} -metadata: - name: {{ include "crds.upgrade.name" . }} - namespace: {{ $ns }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,pre-rollback - "helm.sh/hook-weight": "-4" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - {{- with $sa.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- $extraLabels := $sa.labels | default dict }} - {{- $_ := set $extraLabels "app.kubernetes.io/component" "upgrade-crds" }} - {{- $_ := set $ctx "extraLabels" $extraLabels }} - labels: {{ include "vm.labels" $ctx | nindent 4 }} - {{- $_ := unset $ctx "extraLabels" }} -{{- end }} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/values.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/values.yaml index 89715f32..e69de29b 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/values.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/crds/values.yaml @@ -1,17 +0,0 @@ -upgrade: - enabled: false - serviceAccount: - labels: {} - create: true - forceConflicts: false - busybox: - image: - repository: busybox - tag: latest - pullPolicy: IfNotPresent - kubectl: - image: - repository: rancher/kubectl - # use image tag that matches k8s API version by default - tag: "" - pullPolicy: IfNotPresent diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/.helmignore b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/.helmignore index e7746f26..2ccbd54f 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/.helmignore +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/.helmignore @@ -20,7 +20,5 @@ .idea/ *.tmproj .vscode/ +*.md *.md.gotmpl -CHANGELOG.md -_changelog.md -_index.md diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml index e8f67b95..a90e9d6e 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml @@ -1,21 +1,16 @@ annotations: artifacthub.io/category: monitoring-logging artifacthub.io/changes: | - - reverted usage of `app` label in `vm.selectorLabels` + - Support custom case for list empty argument. artifacthub.io/license: Apache-2.0 artifacthub.io/links: | - name: Sources url: https://github.com/VictoriaMetrics/helm-charts/tree/master/charts/victoria-metrics-common - name: Charts repo url: https://victoriametrics.github.io/helm-charts/ - artifacthub.io/readme: | - # VictoriaMetrics Common Helm chart - - Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/). - Changelog is [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/changelog/). apiVersion: v2 -description: VictoriaMetrics Common - contains shared templates for all Victoria Metrics - helm charts +description: Victoria Metrics Common - contains shared templates for all Victoria + Metrics helm charts keywords: - victoriametrics - monitoring @@ -30,4 +25,4 @@ name: victoria-metrics-common sources: - https://github.com/VictoriaMetrics/helm-charts type: library -version: 0.3.0 +version: 0.0.42 diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md deleted file mode 100644 index c8ee7051..00000000 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/README.md +++ /dev/null @@ -1,4 +0,0 @@ -# VictoriaMetrics Common Helm chart - -Chart documentation is available [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/). -Changelog is [here](https://docs.victoriametrics.com/helm/victoria-metrics-common/changelog/). diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES index ad0cdfa9..6de533d6 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES @@ -1,7 +1,7 @@ -# Release notes for version 0.3.0 +# Release notes for version 0.0.42 -**Release date:** 16 Apr 2026 +**Release date:** 19 Mar 2025 ![Helm: v3](https://img.shields.io/badge/Helm-v3.14%2B-informational?color=informational&logo=helm&link=https%3A%2F%2Fgithub.com%2Fhelm%2Fhelm%2Freleases%2Ftag%2Fv3.14.0) -- reverted usage of `app` label in `vm.selectorLabels` +- Support custom case for list empty argument. diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_enterprise.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_enterprise.tpl index ffdc750d..1890e499 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_enterprise.tpl +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_enterprise.tpl @@ -36,7 +36,7 @@ {{- if eq (include "vm.enterprise.disabled" .) "true" }} {{ fail `Pass valid license at .Values.license or .Values.global.license if you have an enterprise license for running this software. See https://victoriametrics.com/legal/esa/ for details. - Documentation - https://docs.victoriametrics.com/victoriametrics/enterprise/ + Documentation - https://docs.victoriametrics.com/enterprise for more information, visit https://victoriametrics.com/products/enterprise/ To request a trial license, go to https://victoriametrics.com/products/enterprise/trial/` }} {{- end -}} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl index bd945678..7983440f 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_helpers.tpl @@ -125,8 +125,8 @@ If release name contains chart name it will be used as a full name. {{- $ctx := . -}} {{- $values := $Values -}} {{- range $ak := $appKey }} - {{- $values = ternary (dict) (index $values $ak | default dict) (empty $values) -}} - {{- $ctx = ternary (dict) (index $ctx $ak | default dict) (empty $ctx) -}} + {{- $values = ternary (default dict) (index $values $ak | default dict) (empty $values) -}} + {{- $ctx = ternary (default dict) (index $ctx $ak | default dict) (empty $ctx) -}} {{- if and (empty $values) (empty $ctx) -}} {{- fail (printf "No data for appKey %s" (join "->" $appKey)) -}} {{- end -}} @@ -187,9 +187,6 @@ If release name contains chart name it will be used as a full name. {{- include "vm.validate.args" . -}} {{- $Release := (.helm).Release | default .Release -}} {{- $labels := fromYaml (include "vm.selectorLabels" .) -}} - {{- with $labels.app -}} - {{- $_ := set $labels "app.kubernetes.io/component" . -}} - {{- end -}} {{- $labels = mergeOverwrite $labels (.extraLabels | default dict) -}} {{- $_ := set $labels "app.kubernetes.io/managed-by" $Release.Service -}} {{- toYaml $labels -}} @@ -198,10 +195,8 @@ If release name contains chart name it will be used as a full name. {{- /* Common labels */ -}} {{- define "vm.labels" -}} {{- include "vm.validate.args" . -}} - {{- $Values := (.helm).Values | default .Values -}} - {{- $globalLabels := deepCopy (($Values.global).extraLabels | default dict) -}} - {{- $labels := fromYaml (include "vm.commonLabels" .) -}} - {{- $labels = mergeOverwrite $globalLabels $labels (fromYaml (include "vm.metaLabels" .)) -}} + {{- $labels := fromYaml (include "vm.selectorLabels" .) -}} + {{- $labels = mergeOverwrite $labels (fromYaml (include "vm.metaLabels" .)) -}} {{- with (include "vm.image.tag" .) }} {{- $_ := set $labels "app.kubernetes.io/version" (regexReplaceAll "(.*)(@sha.*)" . "${1}") -}} {{- end -}} @@ -234,16 +229,11 @@ If release name contains chart name it will be used as a full name. {{- $_ := set $labels "app.kubernetes.io/name" (include "vm.name" .) -}} {{- $_ := set $labels "app.kubernetes.io/instance" (include "vm.release" .) -}} {{- with (include "vm.app.name" .) -}} - {{- $_ := set $labels "app" . -}} + {{- if eq $.style "managed" -}} + {{- $_ := set $labels "app.kubernetes.io/component" (printf "%s-%s" (include "vm.name" $) .) -}} + {{- else -}} + {{- $_ := set $labels "app" . -}} + {{- end -}} {{- end -}} {{- toYaml $labels -}} {{- end }} - -{{- define "vm.commonLabels" -}} - {{- $labels := fromYaml (include "vm.selectorLabels" . ) -}} - {{- with $labels.app -}} - {{- $_ := set $labels "app.kubernetes.io/component" . -}} - {{- $_ := unset $labels "app" -}} - {{- end -}} - {{- toYaml $labels -}} -{{- end -}} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl index 66d019e3..cae561dd 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl @@ -42,14 +42,14 @@ Victoria Metrics Image {{- with .appKey -}} {{- $appKey := ternary (list .) . (kindIs "string" .) -}} {{- range $ak := $appKey -}} - {{- $values = ternary (dict) (index $values $ak | default dict) (empty $values) -}} - {{- $ctx = ternary (dict) (index $ctx $ak | default dict) (empty $ctx) -}} + {{- $values = ternary (default dict) (index $values $ak | default dict) (empty $values) -}} + {{- $ctx = ternary (default dict) (index $ctx $ak | default dict) (empty $ctx) -}} {{- if and (empty $values) (empty $ctx) -}} {{- fail (printf "No data for appKey %s" (join "->" $appKey)) -}} {{- end -}} {{- end -}} {{- end -}} - {{- $image := ternary (deepCopy ($ctx.image | default dict)) (deepCopy ($values.image | default dict)) (hasKey $ctx "image") -}} + {{- $image := ternary $ctx.image $values.image (hasKey $ctx "image") -}} {{- if not $image.registry }} {{- if (($Values.global).image).registry -}} {{- $_ := set $image "registry" (($Values.global).image).registry -}} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_pod.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_pod.tpl index 62981dfb..7534ae2d 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_pod.tpl +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_pod.tpl @@ -39,9 +39,9 @@ Render probe {{- define "vm.probe" -}} {{- /* undefined value */ -}} {{- $null := (fromYaml "value: null").value -}} - {{- $probe := dig .type (dict) .app.probe -}} + {{- $probe := dig .type (default dict) .app.probe -}} {{- $probeType := "" -}} - {{- $defaultProbe := dict -}} + {{- $defaultProbe := default dict -}} {{- if ne (dig "httpGet" $null $probe) $null -}} {{- /* httpGet probe */ -}} {{- $defaultProbe = dict "path" (include "vm.probe.http.path" .) "scheme" (include "vm.probe.http.scheme" .) "port" (include "vm.probe.port" .) -}} @@ -51,7 +51,7 @@ Render probe {{- $defaultProbe = dict "port" (include "vm.probe.port" .) -}} {{- $probeType = "tcpSocket" -}} {{- end -}} - {{- $defaultProbe = ternary (dict) (dict $probeType $defaultProbe) (empty $probeType) -}} + {{- $defaultProbe = ternary (default dict) (dict $probeType $defaultProbe) (empty $probeType) -}} {{- $probe = mergeOverwrite $defaultProbe $probe -}} {{- range $key, $value := $probe -}} {{- if and (has (kindOf $value) (list "object" "map")) (ne $key $probeType) -}} @@ -100,7 +100,7 @@ Net probe port command line arguments */ -}} {{- define "vm.args" -}} - {{- $args := list -}} + {{- $args := default list -}} {{- range $key, $value := . -}} {{- if not $key -}} {{- fail "Empty key in command line args is not allowed" -}} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_service.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_service.tpl index 77cdeee7..77a1365f 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_service.tpl +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_service.tpl @@ -37,10 +37,10 @@ {{- $values := $Values -}} {{- $ctx := . -}} {{- range $ak := $appKey -}} - {{- $values = ternary (dict) (index $values $ak | default dict) (empty $values) -}} - {{- $ctx = ternary (dict) (index $ctx $ak | default dict) (empty $ctx) -}} + {{- $values = ternary (default dict) (index $values $ak | default dict) (empty $values) -}} + {{- $ctx = ternary (default dict) (index $ctx $ak | default dict) (empty $ctx) -}} {{- end -}} - {{- $spec := dict -}} + {{- $spec := default dict -}} {{- if $ctx -}} {{- $spec = $ctx -}} {{- else if $values -}} @@ -69,10 +69,10 @@ {{- $values := $Values -}} {{- $ctx := . -}} {{- range $ak := $appKey -}} - {{- $values = ternary (dict) (index $values $ak | default dict) (empty $values) -}} - {{- $ctx = ternary (dict) (index $ctx $ak | default dict) (empty $ctx) -}} + {{- $values = ternary (default dict) (index $values $ak | default dict) (empty $values) -}} + {{- $ctx = ternary (default dict) (index $ctx $ak | default dict) (empty $ctx) -}} {{- end -}} - {{- $spec := dict -}} + {{- $spec := default dict -}} {{- if $values -}} {{- $spec = $values -}} {{- else if $ctx -}} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/crd.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/crd.yaml index d54c82eb..038cc276 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/crd.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/crd.yaml @@ -2,218 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vlagents.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VLAgent - listKind: VLAgentList - plural: vlagents - singular: vlagent - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: current number of replicas - jsonPath: .status.replicas - name: Replica Count - type: integer - - description: Current status of update rollout - jsonPath: .status.updateStatus - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - required: - - remoteWrite - type: object - x-kubernetes-preserve-unknown-fields: true - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - replicas: - format: int32 - type: integer - selector: - type: string - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - scale: - labelSelectorPath: .status.selector - specReplicasPath: .spec.shardCount - statusReplicasPath: .status.shards - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vlclusters.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VLCluster - listKind: VLClusterList - plural: vlclusters - singular: vlcluster - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: replicas of VLInsert - jsonPath: .spec.vlinsert.replicaCount - name: Insert Count - type: string - - description: replicas of VLStorage - jsonPath: .spec.vlstorage.replicaCount - name: Storage Count - type: string - - description: replicas of VLSelect - jsonPath: .spec.vlselect.replicaCount - name: Select Count - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Current status of cluster - jsonPath: .status.updateStatus - name: Status - type: string - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vlogs.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -235,47 +24,1041 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VLogs is fast, cost-effective and scalable logs database. + VLogs is the Schema for the vlogs API properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VLogsSpec defines the desired state of VLogs + properties: + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application container + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + futureRetention: + description: |- + FutureRetention for the stored logs + Log entries with timestamps bigger than now+futureRetention are rejected during data ingestion; see https://docs.victoriametrics.com/victorialogs/#retention + type: string + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace + type: boolean + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's repository + if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: LogFormat for VLogs to be configured with. + enum: + - default + - json + type: string + logIngestedRows: + description: Whether to log all the ingested log entries; this can + be useful for debugging of data ingestion; see https://docs.victoriametrics.com/victorialogs/data-ingestion/ + type: boolean + logLevel: + description: LogLevel for VictoriaLogs to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + logNewStreams: + description: LogNewStreams Whether to log creation of new streams; + this can be useful for debugging of high cardinality issues with + log streams; see https://docs.victoriametrics.com/victorialogs/keyconcepts/#stream-fields + type: boolean + managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + type: object + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the VLogs pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod condition + properties: + conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + removePvcAfterDelete: + description: |- + RemovePvcAfterDelete - if true, controller adds ownership to pvc + and after VLogs object deletion - pvc will be garbage collected + by controller manager + type: boolean + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + retentionPeriod: + description: RetentionPeriod for the stored logs + type: string + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods + type: string + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vlogs VMServiceScrape + spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be added to vlogs service spec + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + storage: + description: |- + Storage is the definition of how storage will be used by the VLogs + by default it`s empty dir + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes to consider + for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the PersistentVolume + backing this claim. + type: string + type: object + storageDataPath: + description: |- + StorageDataPath disables spec.storage option and overrides arg for victoria-logs binary --storageDataPath, + its users responsibility to mount proper device into given path. + type: string + storageMetadata: + description: StorageMeta defines annotations and labels attached to + PVC for given vlogs CR + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array required: - retentionPeriod type: object - x-kubernetes-preserve-unknown-fields: true status: + description: VLogsStatus defines the observed state of VLogs properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -290,11 +1073,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -307,99 +1095,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vlsingles.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VLSingle - listKind: VLSingleList - plural: vlsingles - singular: vlsingle - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: Current status of logs instance update process - jsonPath: .status.status - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmagents.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -429,47 +1125,4677 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMAgent - is a tiny but brave agent, which helps you collect metrics from various sources and stores them in VictoriaMetrics + or any other Prometheus-compatible storage system that supports the remote_write protocol. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMAgentSpec defines the desired state of VMAgent + properties: + aPIServerConfig: + description: |- + APIServerConfig allows specifying a host and auth methods to access apiserver. + If left empty, VMAgent is assumed to run inside of the cluster + and will discover API servers automatically and use the pod's CA certificate + and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/. + aPIServerConfig is deprecated use apiServerConfig instead + required: + - host + type: object + x-kubernetes-preserve-unknown-fields: true + additionalScrapeConfigs: + description: |- + AdditionalScrapeConfigs As scrape configs are appended, the user is responsible to make sure it + is valid. Note that using this feature may expose the possibility to + break upgrades of VMAgent. It is advised to review VMAgent release + notes to ensure that no incompatible scrape configs are going to break + VMAgent after the upgrade. + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + apiServerConfig: + description: |- + APIServerConfig allows specifying a host and auth methods to access apiserver. + If left empty, VMAgent is assumed to run inside of the cluster + and will discover API servers automatically and use the pod's CA certificate + and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/. + properties: + authorization: + description: Authorization configures generic authorization params + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerToken: + description: Bearer token for accessing apiserver. + type: string + bearerTokenFile: + description: File to read bearer token for accessing apiserver. + type: string + host: + description: |- + Host of apiserver. + A valid string consisting of a hostname or IP followed by an optional port number + type: string + tlsConfig: + description: TLSConfig Config to use for accessing apiserver. + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use for + the targets. + type: string + cert: + description: Struct containing the client cert file for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + required: + - host + type: object + arbitraryFSAccessThroughSMs: + description: |- + ArbitraryFSAccessThroughSMs configures whether configuration + based on EndpointAuth can access arbitrary files on the file system + of the VMAgent container e.g. bearer token files, basic auth, tls certs + properties: + deny: + type: boolean + type: object + claimTemplates: + description: ClaimTemplates allows adding additional VolumeClaimTemplates + for VMAgent in StatefulMode + items: + description: PersistentVolumeClaim is a user's request for and claim + to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + type: object + x-kubernetes-preserve-unknown-fields: true + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes to consider + for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status of + resource being resized for the given PVC.\nKey names follow + standard Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus + can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with a + terminal error.\n\t- NodeResizePending:\n\t\tState set + when resize controller has finished resizing the volume + but further resizing of\n\t\tvolume is needed on the node.\n\t- + NodeResizeInProgress:\n\t\tState set when kubelet starts + resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, it + means that no resize operation is in progress for the + given PVC.\n\nA controller that receives PVC update with + previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources allocated + to a PVC including its capacity.\nKey names follow standard + Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nCapacity + reported here may be larger than the actual capacity when + a volume expansion operation\nis requested.\nFor storage + quota, the larger value from allocatedResources and PVC.spec.resources + is used.\nIf allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and if + the actual volume capacity\nis equal or lower than the + requested capacity.\n\nA controller that receives PVC + update with previously unknown resourceName\nshould ignore + the update for the purpose it was designed. For example + - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources of + the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains details + about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed the + condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the condition + transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible indicates + that the request has been rejected as invalid by the + CSI driver. To\n\t resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can be + added in the future. Consumers should check for unknown + statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + type: object + type: object + type: array + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + configReloaderExtraArgs: + additionalProperties: + type: string + description: |- + ConfigReloaderExtraArgs that will be passed to VMAuths config-reloader container + for example resyncInterval: "30s" + type: object + configReloaderImageTag: + description: ConfigReloaderImageTag defines image:tag for config-reloader + container + type: string + configReloaderResources: + description: |- + ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + daemonSetMode: + description: |- + DaemonSetMode enables DaemonSet deployment mode instead of Deployment. + Supports only VMPodScrape + (available from v0.55.0). + Cannot be used with statefulMode + type: boolean + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + enableKubernetesAPISelectors: + description: |- + EnableKubernetesAPISelectors instructs vmagent to use CRD scrape objects spec.selectors for + Kubernetes API list and watch requests. + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#list-and-watch-filtering + It could be useful to reduce Kubernetes API server resource usage for serving less than 100 CRD scrape objects in total. + type: boolean + enforcedNamespaceLabel: + description: |- + EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert + and metric that is user created. The label value will always be the namespace of the object that is + being created. + type: string + externalLabels: + additionalProperties: + type: string + description: |- + ExternalLabels The labels to add to any time series scraped by vmagent. + it doesn't affect metrics ingested directly by push API's + type: object + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application container + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace + type: boolean + ignoreNamespaceSelectors: + description: |- + IgnoreNamespaceSelectors if set to true will ignore NamespaceSelector settings from + scrape objects, and they will only discover endpoints + within their current namespace. Defaults to false. + type: boolean + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's repository + if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + ingestOnlyMode: + description: |- + IngestOnlyMode switches vmagent into unmanaged mode + it disables any config generation for scraping + Currently it prevents vmagent from managing tls and auth options for remote write + type: boolean + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + inlineRelabelConfig: + description: InlineRelabelConfig - defines GlobalRelabelConfig for + vmagent, can be defined directly at CRD. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + inlineScrapeConfig: + description: |- + InlineScrapeConfig As scrape configs are appended, the user is responsible to make sure it + is valid. Note that using this feature may expose the possibility to + break upgrades of VMAgent. It is advised to review VMAgent release + notes to ensure that no incompatible scrape configs are going to break + VMAgent after the upgrade. + it should be defined as single yaml file. + inlineScrapeConfig: | + - job_name: "prometheus" + static_configs: + - targets: ["localhost:9090"] + type: string + insertPorts: + description: InsertPorts - additional listen ports for data ingestion. + properties: + graphitePort: + description: GraphitePort listen port + type: string + influxPort: + description: InfluxPort listen port + type: string + openTSDBHTTPPort: + description: OpenTSDBHTTPPort for http connections. + type: string + openTSDBPort: + description: OpenTSDBPort for tcp and udp listen + type: string + type: object + license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) + properties: + forceOffline: + description: Enforce offline verification of the license key. + type: boolean + key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) + type: string + keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. + type: string + type: object + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: LogFormat for VMAgent to be configured with. + enum: + - default + - json + type: string + logLevel: + description: |- + LogLevel for VMAgent to be configured with. + INFO, WARN, ERROR, FATAL, PANIC + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + type: object + maxScrapeInterval: + description: |- + MaxScrapeInterval allows limiting maximum scrape interval for VMServiceScrape, VMPodScrape and other scrapes + If interval is higher than defined limit, `maxScrapeInterval` will be used. + type: string + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + minScrapeInterval: + description: |- + MinScrapeInterval allows limiting minimal scrape interval for VMServiceScrape, VMPodScrape and other scrapes + If interval is lower than defined limit, `minScrapeInterval` will be used. + type: string + nodeScrapeNamespaceSelector: + description: |- + NodeScrapeNamespaceSelector defines Namespaces to be selected for VMNodeScrape discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + nodeScrapeRelabelTemplate: + description: |- + NodeScrapeRelabelTemplate defines relabel config, that will be added to each VMNodeScrape. + it's useful for adding specific labels to all targets + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + nodeScrapeSelector: + description: |- + NodeScrapeSelector defines VMNodeScrape to be selected for scraping. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + overrideHonorLabels: + description: |- + OverrideHonorLabels if set to true overrides all user configured honor_labels. + If HonorLabels is set in scrape objects to true, this overrides honor_labels to false. + type: boolean + overrideHonorTimestamps: + description: OverrideHonorTimestamps allows to globally enforce honoring + timestamps in all scrape configs. + type: boolean + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + podDisruptionBudget: + description: PodDisruptionBudget created by operator + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selectorLabels: + additionalProperties: + type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget + type: object + type: object + podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the vmagent pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + podScrapeNamespaceSelector: + description: |- + PodScrapeNamespaceSelector defines Namespaces to be selected for VMPodScrape discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podScrapeRelabelTemplate: + description: |- + PodScrapeRelabelTemplate defines relabel config, that will be added to each VMPodScrape. + it's useful for adding specific labels to all targets + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + podScrapeSelector: + description: |- + PodScrapeSelector defines PodScrapes to be selected for target discovery. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + probeNamespaceSelector: + description: |- + ProbeNamespaceSelector defines Namespaces to be selected for VMProbe discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + probeScrapeRelabelTemplate: + description: |- + ProbeScrapeRelabelTemplate defines relabel config, that will be added to each VMProbeScrape. + it's useful for adding specific labels to all targets + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + probeSelector: + description: |- + ProbeSelector defines VMProbe to be selected for target probing. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod condition + properties: + conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + relabelConfig: + description: |- + RelabelConfig ConfigMap with global relabel config -remoteWrite.relabelConfig + This relabeling is applied to all the collected metrics before sending them to remote storage. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + remoteWrite: + description: |- + RemoteWrite list of victoria metrics /some other remote write system + for vm it must looks like: http://victoria-metrics-single:8429/api/v1/write + or for cluster different url + https://github.com/VictoriaMetrics/VictoriaMetrics/tree/master/app/vmagent#splitting-data-streams-among-multiple-systems + items: + description: VMAgentRemoteWriteSpec defines the remote storage configuration + for VmAgent + properties: + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + forceVMProto: + description: ForceVMProto forces using VictoriaMetrics protocol + for sending data to -remoteWrite.url + type: boolean + headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName: headerValue + vmagent supports since 1.79.0 version + items: + type: string + type: array + inlineUrlRelabelConfig: + description: InlineUrlRelabelConfig defines relabeling config + for remoteWriteURL, it can be defined at crd spec. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + maxDiskUsage: + description: |- + MaxDiskUsage defines the maximum file-based buffer size in bytes for the given remoteWrite + It overrides global configuration defined at remoteWriteSettings.maxDiskUsagePerURL + x-kubernetes-preserve-unknown-fields: true + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 + client id + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret + file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + sendTimeout: + description: Timeout for sending a single block of data to -remoteWrite.url + (default 1m0s) + pattern: '[0-9]+(ms|s|m|h)' + type: string + streamAggrConfig: + description: StreamAggrConfig defines stream aggregation configuration + for VMAgent for -remoteWrite.url + properties: + configmap: + description: ConfigMap with stream aggregation rules + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + dedupInterval: + description: Allows setting different de-duplication intervals + per each configured remote storage + type: string + dropInput: + description: Allow drop all the input samples after the + aggregation + type: boolean + dropInputLabels: + description: labels to drop from samples for aggregator + before stream de-duplication and aggregation + items: + type: string + type: array + enableWindows: + description: EnableWindows enables aggregating data in separate + windows ( available from v0.54.0). + type: boolean + ignoreFirstIntervals: + description: IgnoreFirstIntervals instructs to ignore first + interval + type: integer + ignoreOldSamples: + description: IgnoreOldSamples instructs to ignore samples + with old timestamps outside the current aggregation interval. + type: boolean + keepInput: + description: Allows writing both raw and aggregate data + type: boolean + rules: + description: Stream aggregation rules + items: + description: StreamAggrRule defines the rule in stream + aggregation config + properties: + by: + description: |- + By is an optional list of labels for grouping input series. + + See also Without. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. + items: + type: string + type: array + dedup_interval: + description: DedupInterval is an optional interval + for deduplication. + type: string + drop_input_labels: + description: |- + DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples. + + Labels are dropped before de-duplication and aggregation. + items: + type: string + type: array + enable_windows: + description: EnableWindows enables aggregating data + in separate windows + type: boolean + flush_on_shutdown: + description: |- + FlushOnShutdown defines whether to flush the aggregation state on process termination + or config reload. Is `false` by default. + It is not recommended changing this setting, unless unfinished aggregations states + are preferred to missing data points. + type: boolean + ignore_first_intervals: + type: integer + ignore_old_samples: + description: IgnoreOldSamples instructs to ignore + samples with old timestamps outside the current + aggregation interval. + type: boolean + input_relabel_configs: + description: |- + InputRelabelConfigs is an optional relabeling rules, which are applied on the input + before aggregation. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex + matching. Default is 'replace' + type: string + if: + description: 'If represents metricsQL match + expression (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match + for `action: graphite`' + type: object + match: + description: 'Match is used together with Labels + for `action: graphite`' + type: string + modulus: + description: Modulus to take of the hash of + the source label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated + source label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + interval: + description: Interval is the interval between aggregations. + type: string + keep_metric_names: + description: KeepMetricNames instructs to leave metric + names as is for the output time series without adding + any suffix. + type: boolean + match: + description: |- + Match is a label selector (or list of label selectors) for filtering time series for the given selector. + + If the match isn't set, then all the input time series are processed. + x-kubernetes-preserve-unknown-fields: true + no_align_flush_to_interval: + description: |- + NoAlignFlushToInterval disables aligning of flushes to multiples of Interval. + By default flushes are aligned to Interval. + type: boolean + output_relabel_configs: + description: |- + OutputRelabelConfigs is an optional relabeling rules, which are applied + on the aggregated output before being sent to remote storage. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex + matching. Default is 'replace' + type: string + if: + description: 'If represents metricsQL match + expression (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match + for `action: graphite`' + type: object + match: + description: 'Match is used together with Labels + for `action: graphite`' + type: string + modulus: + description: Modulus to take of the hash of + the source label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated + source label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + outputs: + description: |- + Outputs is a list of output aggregate functions to produce. + + The following names are allowed: + + - total - aggregates input counters + - increase - counts the increase over input counters + - count_series - counts the input series + - count_samples - counts the input samples + - sum_samples - sums the input samples + - last - the last biggest sample value + - min - the minimum sample value + - max - the maximum sample value + - avg - the average value across all the samples + - stddev - standard deviation across all the samples + - stdvar - standard variance across all the samples + - histogram_bucket - creates VictoriaMetrics histogram for input samples + - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1] + + The output time series will have the following names: + + input_name:aggr__ + items: + type: string + type: array + staleness_interval: + description: |- + Staleness interval is interval after which the series state will be reset if no samples have been sent during it. + The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket. + type: string + without: + description: |- + Without is an optional list of labels, which must be excluded when grouping input series. + + See also By. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. + items: + type: string + type: array + required: + - interval + - outputs + type: object + type: array + type: object + tlsConfig: + description: TLSConfig describes tls configuration for remote + write target + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use + for the targets. + type: string + cert: + description: Struct containing the client cert file for + the targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + url: + description: URL of the endpoint to send samples to. + type: string + urlRelabelConfig: + description: ConfigMap with relabeling config which is applied + to metrics before sending them to the corresponding -remoteWrite.url + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + required: + - url + type: object + type: array + remoteWriteSettings: + description: RemoteWriteSettings defines global settings for all remoteWrite + urls. + properties: + flushInterval: + description: Interval for flushing the data to remote storage. + (default 1s) + pattern: '[0-9]+(ms|s|m|h)' + type: string + label: + additionalProperties: + type: string + description: Labels in the form 'name=value' to add to all the + metrics before sending them. This overrides the label if it + already exists. + type: object + maxBlockSize: + description: The maximum size in bytes of unpacked request to + send to remote storage + format: int32 + type: integer + maxDiskUsagePerURL: + description: The maximum file-based buffer size in bytes at -remoteWrite.tmpDataPath + x-kubernetes-preserve-unknown-fields: true + queues: + description: The number of concurrent queues + format: int32 + type: integer + showURL: + description: Whether to show -remoteWrite.url in the exported + metrics. It is hidden by default, since it can contain sensitive + auth info + type: boolean + tmpDataPath: + description: Path to directory where temporary data for remote + write component is stored (default vmagent-remotewrite-data) + type: string + useMultiTenantMode: + description: |- + Configures vmagent accepting data via the same multitenant endpoints as vminsert at VictoriaMetrics cluster does, + see [here](https://docs.victoriametrics.com/vmagent/#multitenancy). + it's global setting and affects all remote storage configurations + type: boolean + type: object + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + rollingUpdate: + description: RollingUpdate - overrides deployment update params. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. + x-kubernetes-int-or-string: true + type: object + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + scrapeConfigNamespaceSelector: + description: |- + ScrapeConfigNamespaceSelector defines Namespaces to be selected for VMScrapeConfig discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + scrapeConfigRelabelTemplate: + description: |- + ScrapeConfigRelabelTemplate defines relabel config, that will be added to each VMScrapeConfig. + it's useful for adding specific labels to all targets + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + scrapeConfigSelector: + description: |- + ScrapeConfigSelector defines VMScrapeConfig to be selected for target discovery. + Works in combination with NamespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + scrapeInterval: + description: ScrapeInterval defines how often scrape targets by default + pattern: '[0-9]+(ms|s|m|h)' + type: string + scrapeTimeout: + description: ScrapeTimeout defines global timeout for targets scrape + pattern: '[0-9]+(ms|s|m|h)' + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + selectAllByDefault: + description: |- + SelectAllByDefault changes default behavior for empty CRD selectors, such ServiceScrapeSelector. + with selectAllByDefault: true and empty serviceScrapeSelector and ServiceScrapeNamespaceSelector + Operator selects all exist serviceScrapes + with selectAllByDefault: false - selects nothing + type: boolean + serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods + type: string + serviceScrapeNamespaceSelector: + description: |- + ServiceScrapeNamespaceSelector Namespaces to be selected for VMServiceScrape discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + serviceScrapeRelabelTemplate: + description: |- + ServiceScrapeRelabelTemplate defines relabel config, that will be added to each VMServiceScrape. + it's useful for adding specific labels to all targets + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + serviceScrapeSelector: + description: |- + ServiceScrapeSelector defines ServiceScrapes to be selected for target discovery. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmagent VMServiceScrape + spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be added to vmagent service spec + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + shardCount: + description: |- + ShardCount - numbers of shards of VMAgent + in this case operator will use 1 deployment/sts per shard with + replicas count according to spec.replicas, + see [here](https://docs.victoriametrics.com/vmagent/#scraping-big-number-of-targets) + type: integer + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + statefulMode: + description: |- + StatefulMode enables StatefulSet for `VMAgent` instead of Deployment + it allows using persistent storage for vmagent's persistentQueue + type: boolean + statefulRollingUpdateStrategy: + description: |- + StatefulRollingUpdateStrategy allows configuration for strategyType + set it to RollingUpdate for disabling operator statefulSet rollingUpdate + type: string + statefulStorage: + description: StatefulStorage configures storage for StatefulSet + properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean + emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: EmbeddedMetadata contains metadata relevant to + an EmbeddedResource. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + Spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes to + consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + Status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage - + the capacity of the volume.\n\t* Custom resources must + use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have + kubernetes.io prefix are considered\nreserved and hence + may not be used.\n\nClaimResourceStatus can be in any + of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with + a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing the + volume but further resizing of\n\t\tvolume is needed + on the node.\n\t- NodeResizeInProgress:\n\t\tState set + when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this + field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress for + the given PVC.\n\nA controller that receives PVC update + with previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for + resizing capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage - + the capacity of the volume.\n\t* Custom resources must + use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have + kubernetes.io prefix are considered\nreserved and hence + may not be used.\n\nCapacity reported here may be larger + than the actual capacity when a volume expansion operation\nis + requested.\nFor storage quota, the larger value from + allocatedResources and PVC.spec.resources is used.\nIf + allocatedResources is not set, PVC.spec.resources alone + is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and + if the actual volume capacity\nis equal or lower than + the requested capacity.\n\nA controller that receives + PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for + resizing capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains + details about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed + the condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the + condition transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible + indicates that the request has been rejected as + invalid by the CSI driver. To\n\t resolve the error, + a valid VolumeAttributesClass needs to be specified.\nNote: + New statuses can be added in the future. Consumers + should check for unknown statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + type: object + type: object + type: object + staticScrapeNamespaceSelector: + description: |- + StaticScrapeNamespaceSelector defines Namespaces to be selected for VMStaticScrape discovery. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + staticScrapeRelabelTemplate: + description: |- + StaticScrapeRelabelTemplate defines relabel config, that will be added to each VMStaticScrape. + it's useful for adding specific labels to all targets + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + staticScrapeSelector: + description: |- + StaticScrapeSelector defines VMStaticScrape to be selected for target discovery. + Works in combination with NamespaceSelector. + If both nil - match everything. + NamespaceSelector nil - only objects at VMAgent namespace. + Selector nil - only objects at NamespaceSelector namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + streamAggrConfig: + description: StreamAggrConfig defines global stream aggregation configuration + for VMAgent + properties: + configmap: + description: ConfigMap with stream aggregation rules + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + dedupInterval: + description: Allows setting different de-duplication intervals + per each configured remote storage + type: string + dropInput: + description: Allow drop all the input samples after the aggregation + type: boolean + dropInputLabels: + description: labels to drop from samples for aggregator before + stream de-duplication and aggregation + items: + type: string + type: array + enableWindows: + description: EnableWindows enables aggregating data in separate + windows ( available from v0.54.0). + type: boolean + ignoreFirstIntervals: + description: IgnoreFirstIntervals instructs to ignore first interval + type: integer + ignoreOldSamples: + description: IgnoreOldSamples instructs to ignore samples with + old timestamps outside the current aggregation interval. + type: boolean + keepInput: + description: Allows writing both raw and aggregate data + type: boolean + rules: + description: Stream aggregation rules + items: + description: StreamAggrRule defines the rule in stream aggregation + config + properties: + by: + description: |- + By is an optional list of labels for grouping input series. + + See also Without. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. + items: + type: string + type: array + dedup_interval: + description: DedupInterval is an optional interval for deduplication. + type: string + drop_input_labels: + description: |- + DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples. + + Labels are dropped before de-duplication and aggregation. + items: + type: string + type: array + enable_windows: + description: EnableWindows enables aggregating data in separate + windows + type: boolean + flush_on_shutdown: + description: |- + FlushOnShutdown defines whether to flush the aggregation state on process termination + or config reload. Is `false` by default. + It is not recommended changing this setting, unless unfinished aggregations states + are preferred to missing data points. + type: boolean + ignore_first_intervals: + type: integer + ignore_old_samples: + description: IgnoreOldSamples instructs to ignore samples + with old timestamps outside the current aggregation interval. + type: boolean + input_relabel_configs: + description: |- + InputRelabelConfigs is an optional relabeling rules, which are applied on the input + before aggregation. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for + `action: graphite`' + type: object + match: + description: 'Match is used together with Labels for + `action: graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated + source label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + interval: + description: Interval is the interval between aggregations. + type: string + keep_metric_names: + description: KeepMetricNames instructs to leave metric names + as is for the output time series without adding any suffix. + type: boolean + match: + description: |- + Match is a label selector (or list of label selectors) for filtering time series for the given selector. + + If the match isn't set, then all the input time series are processed. + x-kubernetes-preserve-unknown-fields: true + no_align_flush_to_interval: + description: |- + NoAlignFlushToInterval disables aligning of flushes to multiples of Interval. + By default flushes are aligned to Interval. + type: boolean + output_relabel_configs: + description: |- + OutputRelabelConfigs is an optional relabeling rules, which are applied + on the aggregated output before being sent to remote storage. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for + `action: graphite`' + type: object + match: + description: 'Match is used together with Labels for + `action: graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated + source label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + outputs: + description: |- + Outputs is a list of output aggregate functions to produce. + + The following names are allowed: + + - total - aggregates input counters + - increase - counts the increase over input counters + - count_series - counts the input series + - count_samples - counts the input samples + - sum_samples - sums the input samples + - last - the last biggest sample value + - min - the minimum sample value + - max - the maximum sample value + - avg - the average value across all the samples + - stddev - standard deviation across all the samples + - stdvar - standard variance across all the samples + - histogram_bucket - creates VictoriaMetrics histogram for input samples + - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1] + + The output time series will have the following names: + + input_name:aggr__ + items: + type: string + type: array + staleness_interval: + description: |- + Staleness interval is interval after which the series state will be reset if no samples have been sent during it. + The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket. + type: string + without: + description: |- + Without is an optional list of labels, which must be excluded when grouping input series. + + See also By. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. + items: + type: string + type: array + required: + - interval + - outputs + type: object + type: array + type: object + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + updateStrategy: + description: |- + UpdateStrategy - overrides default update strategy. + works only for deployments, statefulset always use OnDelete. + enum: + - Recreate + - RollingUpdate + type: string + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + useVMConfigReloader: + description: |- + UseVMConfigReloader replaces prometheus-like config-reloader + with vm one. It uses secrets watch instead of file watch + which greatly increases speed of config updates + type: boolean + vmAgentExternalLabelName: + description: |- + VMAgentExternalLabelName Name of vmAgent external label used to denote vmAgent instance + name. Defaults to the value of `prometheus`. External label will + _not_ be added when value is set to empty string (`""`). + type: string + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array required: - remoteWrite type: object - x-kubernetes-preserve-unknown-fields: true status: + description: VMAgentStatus defines the observed state of VMAgent properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -484,19 +5810,28 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string replicas: + description: ReplicaCount Total number of pods targeted by this VMAgent format: int32 type: integer selector: + description: Selector string form of label value set for autoscaling type: string shards: + description: Shards represents total number of vmagent deployments + with uniq scrape targets format: int32 type: integer updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -513,7 +5848,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmalertmanagerconfigs.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -537,45 +5872,4266 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMAlertmanagerConfig is the Schema for the vmalertmanagerconfigs + API properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: |- + VMAlertmanagerConfigSpec defines configuration for VMAlertmanagerConfig + it must reference only locally defined objects + properties: + inhibit_rules: + description: |- + InhibitRules will only apply for alerts matching + the resource's namespace. + items: + description: |- + InhibitRule defines an inhibition rule that allows to mute alerts when other + alerts are already firing. + Note, it doesn't support deprecated alertmanager config options. + See https://prometheus.io/docs/alerting/latest/configuration/#inhibit_rule + properties: + equal: + description: |- + Labels that must have an equal value in the source and target alert for + the inhibition to take effect. + items: + type: string + type: array + source_matchers: + description: |- + SourceMatchers defines a list of matchers for which one or more alerts have + to exist for the inhibition to take effect. + items: + type: string + type: array + target_matchers: + description: |- + TargetMatchers defines a list of matchers that have to be fulfilled by the target + alerts to be muted. + items: + type: string + type: array + type: object + type: array + receivers: + description: Receivers defines alert receivers + items: + description: Receiver defines one or more notification integrations. + properties: + discord_configs: + items: + properties: + avatar_url: + description: |- + AvatarURL defines message avatar URL + Available from operator v0.55.0 and alertmanager v0.28.0 + type: string + content: + description: |- + Content defines message content template + Available from operator v0.55.0 and alertmanager v0.28.0 + maxLength: 2000 + type: string + http_config: + description: HTTP client configuration. + properties: + authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. + properties: + credentials: + description: Reference to the secret with value + for authorization + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to + bearer + type: string + type: object + basic_auth: + description: BasicAuth for the client. + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. + type: string + bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + client_id: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for + client secret file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + proxyURL: + description: Optional proxy URL. + type: string + tls_config: + description: TLS configuration for the client. + properties: + ca: + description: Struct containing the CA cert to + use for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container + to use for the targets. + type: string + cert: + description: Struct containing the client cert + file for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the + container for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the + container for the targets. + type: string + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message: + description: The message body template + type: string + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + title: + description: The message title template + type: string + username: + description: |- + Username defines message username + Available from operator v0.55.0 and alertmanager v0.28.0 + type: string + webhook_url: + description: |- + The discord webhook URL + one of `urlSecret` and `url` must be defined. + type: string + webhook_url_secret: + description: |- + URLSecret defines secret name and key at the CRD namespace. + It must contain the webhook URL. + one of `urlSecret` and `url` must be defined. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + type: array + email_configs: + description: EmailConfigs defines email notification configurations. + items: + description: EmailConfig configures notifications via Email. + properties: + auth_identity: + description: The identity to use for authentication. + type: string + auth_password: + description: AuthPassword defines secret name and key + at CRD namespace. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + auth_secret: + description: |- + AuthSecret defines secrent name and key at CRD namespace. + It must contain the CRAM-MD5 secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + auth_username: + description: The username to use for authentication. + type: string + from: + description: |- + The sender address. + fallback to global setting if empty + type: string + headers: + additionalProperties: + type: string + description: |- + Further headers email header key/value pairs. Overrides any headers + previously set by the notification implementation. + type: object + hello: + description: The hostname to identify to the SMTP server. + type: string + html: + description: The HTML body of the email notification. + type: string + require_tls: + description: |- + The SMTP TLS requirement. + Note that Go does not support unencrypted connections to remote SMTP endpoints. + type: boolean + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + smarthost: + description: |- + The SMTP host through which emails are sent. + fallback to global setting if empty + type: string + text: + description: The text body of the email notification. + type: string + tls_config: + description: TLS configuration + properties: + ca: + description: Struct containing the CA cert to use + for the targets. + properties: + configMap: + description: ConfigMap containing data to use + for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for + the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container + to use for the targets. + type: string + cert: + description: Struct containing the client cert file + for the targets. + properties: + configMap: + description: ConfigMap containing data to use + for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for + the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file + for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + to: + description: The email address to send notifications to. + type: string + type: object + type: array + jira_configs: + items: + description: |- + JiraConfig represent alertmanager's jira_config entry + https://prometheus.io/docs/alerting/latest/configuration/#jira_config + available from v0.55.0 operator version + and v0.28.0 alertmanager version + properties: + api_url: + description: |- + The URL to send API requests to. The full API path must be included. + Example: https://company.atlassian.net/rest/api/2/ + type: string + custom_fields: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: |- + Other issue and custom fields. + Jira issue field can have multiple types. + Depends on the field type, the values must be provided differently. + See https://developer.atlassian.com/server/jira/platform/jira-rest-api-examples/#setting-custom-field-data-for-other-field-types for further examples. + type: object + description: + description: Issue description template. + type: string + http_config: + description: |- + The HTTP client's configuration. You must use this configuration to supply the personal access token (PAT) as part of the HTTP `Authorization` header. + For Jira Cloud, use basic_auth with the email address as the username and the PAT as the password. + For Jira Data Center, use the 'authorization' field with 'credentials: '. + x-kubernetes-preserve-unknown-fields: true + issue_type: + description: Type of the issue (e.g. Bug) + type: string + labels: + description: Labels to be added to the issue + items: + type: string + type: array + priority: + description: Priority of the issue + type: string + project: + description: The project key where issues are created + type: string + reopen_duration: + description: |- + If reopen_transition is defined, reopen the issue when it is not older than this value (rounded down to the nearest minute). + The resolutiondate field is used to determine the age of the issue. + pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + reopen_transition: + description: |- + Name of the workflow transition to resolve an issue. + The target status must have the category "done". + type: string + resolve_transition: + description: |- + Name of the workflow transition to reopen an issue. + The target status should not have the category "done". + type: string + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + summary: + description: Issue summary template + type: string + wont_fix_resolution: + description: If reopen_transition is defined, ignore issues + with that resolution. + type: string + required: + - issue_type + - project + type: object + type: array + msteams_configs: + items: + properties: + http_config: + description: HTTP client configuration. + properties: + authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. + properties: + credentials: + description: Reference to the secret with value + for authorization + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to + bearer + type: string + type: object + basic_auth: + description: BasicAuth for the client. + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. + type: string + bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + client_id: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for + client secret file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + proxyURL: + description: Optional proxy URL. + type: string + tls_config: + description: TLS configuration for the client. + properties: + ca: + description: Struct containing the CA cert to + use for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container + to use for the targets. + type: string + cert: + description: Struct containing the client cert + file for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the + container for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the + container for the targets. + type: string + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + text: + description: The text body of the teams notification. + type: string + title: + description: The title of the teams notification. + type: string + webhook_url: + description: |- + The incoming webhook URL + one of `urlSecret` and `url` must be defined. + type: string + webhook_url_secret: + description: |- + URLSecret defines secret name and key at the CRD namespace. + It must contain the webhook URL. + one of `urlSecret` and `url` must be defined. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + type: array + msteamsv2_configs: + items: + description: |- + MSTeamsV2Config sends notifications using the new message format with adaptive cards as required by flows. + https://support.microsoft.com/en-gb/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498 + available from v0.55.0 operator version + and v0.28.0 alertmanager version + properties: + http_config: + x-kubernetes-preserve-unknown-fields: true + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + text: + description: Message body template. + type: string + title: + description: Message title template. + type: string + webhook_url: + description: |- + The incoming webhook URL + one of `urlSecret` and `url` must be defined. + type: string + webhook_url_secret: + description: |- + URLSecret defines secret name and key at the CRD namespace. + It must contain the webhook URL. + one of `webhook_url` or `webhook_url_secret` must be defined. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + type: array + name: + description: Name of the receiver. Must be unique across all + items from the list. + minLength: 1 + type: string + opsgenie_configs: + description: OpsGenieConfigs defines ops genie notification + configurations. + items: + description: |- + OpsGenieConfig configures notifications via OpsGenie. + See https://prometheus.io/docs/alerting/latest/configuration/#opsgenie_config + properties: + actions: + description: Comma separated list of actions that will + be available for the alert. + type: string + api_key: + description: |- + The secret's key that contains the OpsGenie API key. + It must be at them same namespace as CRD + fallback to global setting if empty + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + apiURL: + description: The URL to send OpsGenie API requests to. + type: string + description: + description: Description of the incident. + type: string + details: + additionalProperties: + type: string + description: A set of arbitrary key/value pairs that provide + further detail about the incident. + type: object + entity: + description: Optional field that can be used to specify + which domain alert is related to. + type: string + http_config: + description: HTTP client configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + message: + description: Alert text limited to 130 characters. + type: string + note: + description: Additional alert note. + type: string + priority: + description: Priority level of alert. Possible values + are P1, P2, P3, P4, and P5. + type: string + responders: + description: List of responders responsible for notifications. + items: + description: |- + OpsGenieConfigResponder defines a responder to an incident. + One of `id`, `name` or `username` has to be defined. + properties: + id: + description: ID of the responder. + type: string + name: + description: Name of the responder. + type: string + type: + description: Type of responder. + minLength: 1 + type: string + username: + description: Username of the responder. + type: string + required: + - type + type: object + type: array + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + source: + description: Backlink to the sender of the notification. + type: string + tags: + description: Comma separated list of tags attached to + the notifications. + type: string + update_alerts: + description: |- + Whether to update message and description of the alert in OpsGenie if it already exists + By default, the alert is never updated in OpsGenie, the new message only appears in activity log. + type: boolean + type: object + type: array + pagerduty_configs: + description: PagerDutyConfigs defines pager duty notification + configurations. + items: + description: |- + PagerDutyConfig configures notifications via PagerDuty. + See https://prometheus.io/docs/alerting/latest/configuration/#pagerduty_config + properties: + class: + description: The class/type of the event. + type: string + client: + description: Client identification. + type: string + client_url: + description: Backlink to the sender of notification. + type: string + component: + description: The part or component of the affected system + that is broken. + type: string + description: + description: Description of the incident. + type: string + details: + additionalProperties: + type: string + description: Arbitrary key/value pairs that provide further + detail about the incident. + type: object + group: + description: A cluster or grouping of sources. + type: string + http_config: + description: HTTP client configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + images: + description: Images to attach to the incident. + items: + description: |- + ImageConfig is used to attach images to the incident. + See https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event#the-images-property + for more information. + properties: + alt: + type: string + href: + type: string + source: + type: string + required: + - source + type: object + type: array + links: + description: Links to attach to the incident. + items: + description: |- + LinkConfig is used to attach text links to the incident. + See https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event#the-links-property + for more information. + properties: + href: + type: string + text: + type: string + required: + - href + type: object + type: array + routing_key: + description: |- + The secret's key that contains the PagerDuty integration key (when using + Events API v2). Either this field or `serviceKey` needs to be defined. + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + service_key: + description: |- + The secret's key that contains the PagerDuty service key (when using + integration type "Prometheus"). Either this field or `routingKey` needs to + be defined. + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + severity: + description: Severity of the incident. + type: string + url: + description: The URL to send requests to. + type: string + type: object + type: array + pushover_configs: + description: PushoverConfigs defines push over notification + configurations. + items: + description: |- + PushoverConfig configures notifications via Pushover. + See https://prometheus.io/docs/alerting/latest/configuration/#pushover_config + properties: + expire: + description: |- + How long your notification will continue to be retried for, unless the user + acknowledges the notification. + type: string + html: + description: Whether notification message is HTML or plain + text. + type: boolean + http_config: + description: HTTP client configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + message: + description: Notification message. + type: string + priority: + description: Priority, see https://pushover.net/api#priority + type: string + retry: + description: |- + How often the Pushover servers will send the same notification to the user. + Must be at least 30 seconds. + type: string + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + sound: + description: The name of one of the sounds supported by + device clients to override the user's default sound + choice + type: string + title: + description: Notification title. + type: string + token: + description: |- + The secret's key that contains the registered application’s API token, see https://pushover.net/apps. + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + url: + description: A supplementary URL shown alongside the message. + type: string + url_title: + description: A title for supplementary URL, otherwise + just the URL is shown + type: string + user_key: + description: |- + The secret's key that contains the recipient user’s user key. + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + type: array + rocketchat_configs: + items: + description: |- + RocketchatConfig configures notifications via Rocketchat. + https://prometheus.io/docs/alerting/latest/configuration/#rocketchat_config + available from v0.55.0 operator version + and v0.28.0 alertmanager version + properties: + actions: + items: + description: |- + RocketchatAttachmentAction defines message attachements + https://github.com/RocketChat/Rocket.Chat.Go.SDK/blob/master/models/message.go + properties: + msg: + type: string + text: + type: string + type: + type: string + url: + type: string + type: object + type: array + api_url: + type: string + channel: + description: 'RocketChat channel override, (like #other-channel + or @username).' + type: string + color: + type: string + emoji: + type: string + fields: + items: + description: |- + RocketchatAttachmentField defines API fields + https://developer.rocket.chat/reference/api/rest-api/endpoints/messaging/chat-endpoints/postmessage#attachment-field-objects + properties: + short: + type: boolean + title: + type: string + value: + type: string + type: object + type: array + http_config: + x-kubernetes-preserve-unknown-fields: true + icon_url: + type: string + image_url: + type: string + link_names: + type: boolean + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + short_fields: + type: boolean + text: + type: string + thumb_url: + type: string + title: + type: string + title_link: + type: string + token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + token_id: + description: |- + The sender token and token_id + See https://docs.rocket.chat/use-rocket.chat/user-guides/user-panel/my-account#personal-access-tokens + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + type: array + slack_configs: + description: SlackConfigs defines slack notification configurations. + items: + description: |- + SlackConfig configures notifications via Slack. + See https://prometheus.io/docs/alerting/latest/configuration/#slack_config + properties: + actions: + description: A list of Slack actions that are sent with + each notification. + items: + description: |- + SlackAction configures a single Slack action that is sent with each + notification. + See https://api.slack.com/docs/message-attachments#action_fields and + https://api.slack.com/docs/message-buttons for more information. + properties: + confirm: + description: |- + SlackConfirmationField protect users from destructive actions or + particularly distinguished decisions by asking them to confirm their button + click one more time. + See https://api.slack.com/docs/interactive-message-field-guide#confirmation_fields + for more information. + properties: + dismiss_text: + type: string + ok_text: + type: string + text: + minLength: 1 + type: string + title: + type: string + required: + - text + type: object + name: + type: string + style: + type: string + text: + minLength: 1 + type: string + type: + minLength: 1 + type: string + url: + type: string + value: + type: string + required: + - text + - type + type: object + type: array + api_url: + description: |- + The secret's key that contains the Slack webhook URL. + It must be at them same namespace as CRD + fallback to global setting if empty + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + callback_id: + type: string + channel: + description: The channel or user to send notifications + to. + type: string + color: + type: string + fallback: + type: string + fields: + description: A list of Slack fields that are sent with + each notification. + items: + description: |- + SlackField configures a single Slack field that is sent with each notification. + See https://api.slack.com/docs/message-attachments#fields for more information. + properties: + short: + type: boolean + title: + minLength: 1 + type: string + value: + minLength: 1 + type: string + required: + - title + - value + type: object + type: array + footer: + type: string + http_config: + description: HTTP client configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + icon_emoji: + type: string + icon_url: + type: string + image_url: + type: string + link_names: + type: boolean + mrkdwn_in: + items: + type: string + type: array + pretext: + type: string + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + short_fields: + type: boolean + text: + type: string + thumb_url: + type: string + title: + type: string + title_link: + type: string + username: + type: string + type: object + type: array + sns_configs: + items: + properties: + api_url: + description: The api URL + type: string + attributes: + additionalProperties: + type: string + description: SNS message attributes + type: object + http_config: + description: HTTP client configuration. + properties: + authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. + properties: + credentials: + description: Reference to the secret with value + for authorization + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to + bearer + type: string + type: object + basic_auth: + description: BasicAuth for the client. + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. + type: string + bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + client_id: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for + client secret file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + proxyURL: + description: Optional proxy URL. + type: string + tls_config: + description: TLS configuration for the client. + properties: + ca: + description: Struct containing the CA cert to + use for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container + to use for the targets. + type: string + cert: + description: Struct containing the client cert + file for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the + container for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the + container for the targets. + type: string + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message: + description: The message content of the SNS notification. + type: string + phone_number: + description: |- + Phone number if message is delivered via SMS + Specify this, topic_arn or target_arn + type: string + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + sigv4: + description: Configure the AWS Signature Verification + 4 signing process + properties: + access_key: + description: |- + The AWS API keys. Both access_key and secret_key must be supplied or both must be blank. + If blank the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are used. + type: string + access_key_selector: + description: secret key selector to get the keys from + a Kubernetes Secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + profile: + description: Named AWS profile used to authenticate + type: string + region: + description: AWS region, if blank the region from + the default credentials chain is used + type: string + role_arn: + description: AWS Role ARN, an alternative to using + AWS API keys + type: string + secret_key_selector: + description: secret key selector to get the keys from + a Kubernetes Secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + subject: + description: The subject line if message is delivered + to an email endpoint. + type: string + target_arn: + description: |- + Mobile platform endpoint ARN if message is delivered via mobile notifications + Specify this, topic_arn or phone_number + type: string + topic_arn: + description: SNS topic ARN, either specify this, phone_number + or target_arn + type: string + type: object + type: array + telegram_configs: + items: + description: |- + TelegramConfig configures notification via telegram + https://prometheus.io/docs/alerting/latest/configuration/#telegram_config + properties: + api_url: + description: APIUrl the Telegram API URL i.e. https://api.telegram.org. + type: string + bot_token: + description: |- + BotToken token for the bot + https://core.telegram.org/bots/api + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + chat_id: + description: ChatID is ID of the chat where to send the + messages. + type: integer + disable_notifications: + description: DisableNotifications + type: boolean + http_config: + description: HTTP client configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + message: + description: Message is templated message + type: string + message_thread_id: + description: MessageThreadID defines ID of the message + thread where to send the messages. + type: integer + parse_mode: + description: |- + ParseMode for telegram message, + supported values are MarkdownV2, Markdown, Markdown and empty string for plain text. + type: string + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + required: + - bot_token + - chat_id + type: object + type: array + victorops_configs: + description: VictorOpsConfigs defines victor ops notification + configurations. + items: + description: |- + VictorOpsConfig configures notifications via VictorOps. + See https://prometheus.io/docs/alerting/latest/configuration/#victorops_config + properties: + api_key: + description: |- + The secret's key that contains the API key to use when talking to the VictorOps API. + It must be at them same namespace as CRD + fallback to global setting if empty + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + api_url: + description: The VictorOps API URL. + type: string + custom_fields: + additionalProperties: + type: string + description: |- + Adds optional custom fields + https://github.com/prometheus/alertmanager/blob/v0.24.0/config/notifiers.go#L537 + type: object + entity_display_name: + description: Contains summary of the alerted problem. + type: string + http_config: + description: The HTTP client's configuration. + properties: + authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. + properties: + credentials: + description: Reference to the secret with value + for authorization + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to + bearer + type: string + type: object + basic_auth: + description: BasicAuth for the client. + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. + type: string + bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + client_id: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for + client secret file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + proxyURL: + description: Optional proxy URL. + type: string + tls_config: + description: TLS configuration for the client. + properties: + ca: + description: Struct containing the CA cert to + use for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container + to use for the targets. + type: string + cert: + description: Struct containing the client cert + file for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the + container for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the + container for the targets. + type: string + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message_type: + description: Describes the behavior of the alert (CRITICAL, + WARNING, INFO). + type: string + monitoring_tool: + description: The monitoring tool the state message is + from. + type: string + routing_key: + description: A key used to map the alert to a team. + type: string + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + state_message: + description: Contains long explanation of the alerted + problem. + type: string + required: + - routing_key + type: object + type: array + webex_configs: + items: + properties: + api_url: + description: The Webex Teams API URL, i.e. https://webexapis.com/v1/messages + type: string + http_config: + description: HTTP client configuration. You must use this + configuration to supply the bot token as part of the + HTTP `Authorization` header. + properties: + authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. + properties: + credentials: + description: Reference to the secret with value + for authorization + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to + bearer + type: string + type: object + basic_auth: + description: BasicAuth for the client. + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. + type: string + bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + client_id: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for + client secret file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + proxyURL: + description: Optional proxy URL. + type: string + tls_config: + description: TLS configuration for the client. + properties: + ca: + description: Struct containing the CA cert to + use for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container + to use for the targets. + type: string + cert: + description: Struct containing the client cert + file for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the + container for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the + container for the targets. + type: string + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message: + description: The message body template + type: string + room_id: + description: The ID of the Webex Teams room where to send + the messages + type: string + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + required: + - room_id + type: object + type: array + webhook_configs: + description: WebhookConfigs defines webhook notification configurations. + items: + description: |- + WebhookConfig configures notifications via a generic receiver supporting the webhook payload. + See https://prometheus.io/docs/alerting/latest/configuration/#webhook_config + properties: + http_config: + description: HTTP client configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + max_alerts: + description: Maximum number of alerts to be sent per webhook + message. When 0, all alerts are included. + format: int32 + minimum: 0 + type: integer + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + url: + description: |- + URL to send requests to, + one of `urlSecret` and `url` must be defined. + type: string + url_secret: + description: |- + URLSecret defines secret name and key at the CRD namespace. + It must contain the webhook URL. + one of `urlSecret` and `url` must be defined. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + type: array + wechat_configs: + description: WeChatConfigs defines wechat notification configurations. + items: + description: |- + WeChatConfig configures notifications via WeChat. + See https://prometheus.io/docs/alerting/latest/configuration/#wechat_config + properties: + agent_id: + type: string + api_secret: + description: |- + The secret's key that contains the WeChat API key. + The secret needs to be in the same namespace as the AlertmanagerConfig + fallback to global alertmanager setting if empty + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + api_url: + description: |- + The WeChat API URL. + fallback to global alertmanager setting if empty + type: string + corp_id: + description: |- + The corp id for authentication. + fallback to global alertmanager setting if empty + type: string + http_config: + description: HTTP client configuration. + properties: + authorization: + description: |- + Authorization header configuration for the client. + This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+. + properties: + credentials: + description: Reference to the secret with value + for authorization + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to + bearer + type: string + type: object + basic_auth: + description: BasicAuth for the client. + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token_file: + description: BearerTokenFile defines filename for + bearer token, it must be mounted to pod. + type: string + bearer_token_secret: + description: |- + The secret's key that contains the bearer token + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + client_id: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for + client secret file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + proxyURL: + description: Optional proxy URL. + type: string + tls_config: + description: TLS configuration for the client. + properties: + ca: + description: Struct containing the CA cert to + use for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container + to use for the targets. + type: string + cert: + description: Struct containing the client cert + file for the targets. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the + container for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the + container for the targets. + type: string + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message: + description: API request data as defined by the WeChat + API. + type: string + message_type: + type: string + send_resolved: + description: SendResolved controls notify about resolved + alerts. + type: boolean + to_party: + type: string + to_tag: + type: string + to_user: + type: string + type: object + type: array + required: + - name + type: object + type: array + route: + description: Route definition for alertmanager, may include nested + routes. + properties: + active_time_intervals: + description: |- + ActiveTimeIntervals Times when the route should be active + These must match the name at time_intervals + items: + type: string + type: array + continue: + description: |- + Continue indicating whether an alert should continue matching subsequent + sibling nodes. It will always be true for the first-level route if disableRouteContinueEnforce for vmalertmanager not set. + type: boolean + group_by: + description: List of labels to group by. + items: + type: string + type: array + group_interval: + description: How long to wait before sending an updated notification. + pattern: '[0-9]+(ms|s|m|h)' + type: string + group_wait: + description: How long to wait before sending the initial notification. + pattern: '[0-9]+(ms|s|m|h)' + type: string + matchers: + description: |- + List of matchers that the alert’s labels should match. For the first + level route, the operator adds a namespace: "CRD_NS" matcher. + https://prometheus.io/docs/alerting/latest/configuration/#matcher + items: + type: string + type: array + mute_time_intervals: + description: MuteTimeIntervals is a list of interval names that + will mute matched alert + items: + type: string + type: array + receiver: + description: Name of the receiver for this route. + type: string + repeat_interval: + description: How long to wait before repeating the last notification. + pattern: '[0-9]+(ms|s|m|h)' + type: string + routes: + description: |- + Child routes. + https://prometheus.io/docs/alerting/latest/configuration/#route + items: + x-kubernetes-preserve-unknown-fields: true + type: array + required: + - receiver + type: object + time_intervals: + description: |- + TimeIntervals defines named interval for active/mute notifications interval + See https://prometheus.io/docs/alerting/latest/configuration/#time_interval + items: + description: TimeIntervals for alerts + properties: + name: + description: Name of interval + type: string + time_intervals: + description: TimeIntervals interval configuration + items: + description: TimeInterval defines intervals of time + properties: + days_of_month: + description: |- + DayOfMonth defines list of numerical days in the month. Days begin at 1. Negative values are also accepted. + for example, ['1:5', '-3:-1'] + items: + type: string + type: array + location: + description: Location in golang time location form, e.g. + UTC + type: string + months: + description: |- + Months defines list of calendar months identified by a case-insensitive name (e.g. ‘January’) or numeric 1. + For example, ['1:3', 'may:august', 'december'] + items: + type: string + type: array + times: + description: Times defines time range for mute + items: + description: TimeRange ranges inclusive of the starting + time and exclusive of the end time + properties: + end_time: + description: EndTime for example HH:MM + type: string + start_time: + description: StartTime for example HH:MM + type: string + required: + - end_time + - start_time + type: object + type: array + weekdays: + description: Weekdays defines list of days of the week, + where the week begins on Sunday and ends on Saturday. + items: + type: string + type: array + years: + description: |- + Years defines numerical list of years, ranges are accepted. + For example, ['2020:2022', '2030'] + items: + type: string + type: array + type: object + type: array + required: + - name + - time_intervals + type: object + type: array + required: + - receivers + - route type: object - x-kubernetes-preserve-unknown-fields: true status: + description: VMAlertmanagerConfigStatus defines the observed state of + VMAlertmanagerConfig properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -592,11 +10148,16 @@ spec: lastErrorParentAlertmanagerName: type: string observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -609,7 +10170,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmalertmanagers.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -637,45 +10198,2433 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMAlertmanager represents Victoria-Metrics deployment for Alertmanager. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: |- + Specification of the desired behavior of the VMAlertmanager cluster. More info: + https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + properties: + additionalPeers: + description: AdditionalPeers allows injecting a set of additional + Alertmanagers to peer with to form a highly available cluster. + items: + type: string + type: array + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + claimTemplates: + description: ClaimTemplates allows adding additional VolumeClaimTemplates + for StatefulSet + items: + description: PersistentVolumeClaim is a user's request for and claim + to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + type: object + x-kubernetes-preserve-unknown-fields: true + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes to consider + for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status of + resource being resized for the given PVC.\nKey names follow + standard Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus + can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with a + terminal error.\n\t- NodeResizePending:\n\t\tState set + when resize controller has finished resizing the volume + but further resizing of\n\t\tvolume is needed on the node.\n\t- + NodeResizeInProgress:\n\t\tState set when kubelet starts + resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, it + means that no resize operation is in progress for the + given PVC.\n\nA controller that receives PVC update with + previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources allocated + to a PVC including its capacity.\nKey names follow standard + Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nCapacity + reported here may be larger than the actual capacity when + a volume expansion operation\nis requested.\nFor storage + quota, the larger value from allocatedResources and PVC.spec.resources + is used.\nIf allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and if + the actual volume capacity\nis equal or lower than the + requested capacity.\n\nA controller that receives PVC + update with previously unknown resourceName\nshould ignore + the update for the purpose it was designed. For example + - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources of + the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains details + about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed the + condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the condition + transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible indicates + that the request has been rejected as invalid by the + CSI driver. To\n\t resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can be + added in the future. Consumers should check for unknown + statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + type: object + type: object + type: array + clusterAdvertiseAddress: + description: |- + ClusterAdvertiseAddress is the explicit address to advertise in cluster. + Needs to be provided for non RFC1918 [1] (public) addresses. + [1] RFC1918: https://tools.ietf.org/html/rfc1918 + type: string + clusterDomainName: + description: |- + ClusterDomainName defines domain name suffix for in-cluster dns addresses + aka .cluster.local + used to build pod peer addresses for in-cluster communication + type: string + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + configNamespaceSelector: + description: |2- + ConfigNamespaceSelector defines namespace selector for VMAlertmanagerConfig. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAlertmanager namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + configRawYaml: + description: |- + ConfigRawYaml - raw configuration for alertmanager, + it helps it to start without secret. + priority -> hardcoded ConfigRaw -> ConfigRaw, provided by user -> ConfigSecret. + type: string + configReloaderExtraArgs: + additionalProperties: + type: string + description: |- + ConfigReloaderExtraArgs that will be passed to VMAuths config-reloader container + for example resyncInterval: "30s" + type: object + configReloaderImageTag: + description: ConfigReloaderImageTag defines image:tag for config-reloader + container + type: string + configReloaderResources: + description: |- + ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + configSecret: + description: |- + ConfigSecret is the name of a Kubernetes Secret in the same namespace as the + VMAlertmanager object, which contains configuration for this VMAlertmanager, + configuration must be inside secret key: alertmanager.yaml. + It must be created by user. + instance. Defaults to 'vmalertmanager-' + The secret is mounted into /etc/alertmanager/config. + type: string + configSelector: + description: |- + ConfigSelector defines selector for VMAlertmanagerConfig, result config will be merged with with Raw or Secret config. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAlertmanager namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableNamespaceMatcher: + description: |- + DisableNamespaceMatcher disables top route namespace label matcher for VMAlertmanagerConfig + It may be useful if alert doesn't have namespace label for some reason + type: boolean + disableRouteContinueEnforce: + description: DisableRouteContinueEnforce cancel the behavior for VMAlertmanagerConfig + that always enforce first-level route continue to true + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + enforcedTopRouteMatchers: + description: |- + EnforcedTopRouteMatchers defines label matchers to be added for the top route + of VMAlertmanagerConfig + It allows to make some set of labels required for alerts. + https://prometheus.io/docs/alerting/latest/configuration/#matcher + items: + type: string + type: array + externalURL: + description: |- + ExternalURL the VMAlertmanager instances will be available under. This is + necessary to generate correct URLs. This is necessary if VMAlertmanager is not + served from root of a DNS name. + type: string + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application container + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + gossipConfig: + description: GossipConfig defines gossip TLS configuration for Alertmanager + cluster + properties: + tls_client_config: + description: TLSClientConfig defines client TLS configuration + for alertmanager + properties: + ca_file: + description: |- + CAFile defines path to the pre-mounted file with CA + mutually exclusive with CASecretRef + type: string + ca_secret_ref: + description: |- + CA defines reference for secret with CA content under given key + mutually exclusive with CAFile + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + cert_file: + description: |- + CertFile defines path to the pre-mounted file with certificate + mutually exclusive with CertSecretRef + type: string + cert_secret_ref: + description: |- + CertSecretRef defines reference for secret with certificate content under given key + mutually exclusive with CertFile + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + insecure_skip_verify: + description: |- + Cert defines reference for secret with CA content under given key + mutually exclusive with CertFile + type: boolean + key_file: + description: |- + KeyFile defines path to the pre-mounted file with certificate key + mutually exclusive with KeySecretRef + type: string + key_secret_ref: + description: |- + Key defines reference for secret with certificate key content under given key + mutually exclusive with KeyFile + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + server_name: + description: ServerName indicates a name of a server + type: string + type: object + tls_server_config: + description: TLSServerConfig defines server TLS configuration + for alertmanager + properties: + cert_file: + description: |- + CertFile defines path to the pre-mounted file with certificate + mutually exclusive with CertSecretRef + type: string + cert_secret_ref: + description: |- + CertSecretRef defines reference for secret with certificate content under given key + mutually exclusive with CertFile + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + cipher_suites: + description: |- + CipherSuites defines list of supported cipher suites for TLS versions up to TLS 1.2 + https://golang.org/pkg/crypto/tls/#pkg-constants + items: + type: string + type: array + client_auth_type: + description: |- + Cert defines reference for secret with CA content under given key + mutually exclusive with CertFile + ClientAuthType defines server policy for client authentication + If you want to enable client authentication (aka mTLS), you need to use RequireAndVerifyClientCert + Note, mTLS is supported only at enterprise version of VictoriaMetrics components + enum: + - NoClientCert + - RequireAndVerifyClientCert + type: string + client_ca_file: + description: |- + ClientCAFile defines path to the pre-mounted file with CA + mutually exclusive with ClientCASecretRef + type: string + client_ca_secret_ref: + description: |- + ClientCASecretRef defines reference for secret with CA content under given key + mutually exclusive with ClientCAFile + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + curve_preferences: + description: |- + CurvePreferences defines elliptic curves that will be used in an ECDHE handshake, in preference order. + https://golang.org/pkg/crypto/tls/#CurveID + items: + type: string + type: array + key_file: + description: |- + KeyFile defines path to the pre-mounted file with certificate key + mutually exclusive with KeySecretRef + type: string + key_secret_ref: + description: |- + Key defines reference for secret with certificate key content under given key + mutually exclusive with KeyFile + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + max_version: + description: MaxVersion maximum TLS version that is acceptable. + enum: + - TLS10 + - TLS11 + - TLS12 + - TLS13 + type: string + min_version: + description: MinVersion minimum TLS version that is acceptable. + enum: + - TLS10 + - TLS11 + - TLS12 + - TLS13 + type: string + prefer_server_cipher_suites: + description: |- + PreferServerCipherSuites controls whether the server selects the + client's most preferred ciphersuite + type: boolean + type: object + type: object + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace + type: boolean + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's repository + if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + listenLocal: + description: |- + ListenLocal makes the VMAlertmanager server listen on loopback, so that it + does not bind against the Pod IP. Note this is only for the VMAlertmanager + UI, not the gossip communication. + type: boolean + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: LogFormat for VMAlertmanager to be configured with. + enum: + - logfmt + - json + type: string + logLevel: + description: Log level for VMAlertmanager to be configured with. + enum: + - debug + - info + - warn + - error + - DEBUG + - INFO + - WARN + - ERROR + type: string + managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + type: object + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + podDisruptionBudget: + description: PodDisruptionBudget created by operator + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selectorLabels: + additionalProperties: + type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget + type: object + type: object + podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the alertmanager pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + portName: + description: |- + PortName used for the pods and governing service. + This defaults to web + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod condition + properties: + conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + retention: + description: |- + Retention Time duration VMAlertmanager shall retain data for. Default is '120h', + and must match the regular expression `[0-9]+(ms|s|m|h)` (milliseconds seconds minutes hours). + pattern: '[0-9]+(ms|s|m|h)' + type: string + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + rollingUpdateStrategy: + description: |- + RollingUpdateStrategy defines strategy for application updates + Default is OnDelete, in this case operator handles update process + Can be changed for RollingUpdate + type: string + routePrefix: + description: |- + RoutePrefix VMAlertmanager registers HTTP handlers for. This is useful, + if using ExternalURL and a proxy is rewriting HTTP routes of a request, + and the actual ExternalURL is still true, but the server serves requests + under a different route prefix. For example for use with `kubectl proxy`. + type: string + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + selectAllByDefault: + description: |- + SelectAllByDefault changes default behavior for empty CRD selectors, such ConfigSelector. + with selectAllByDefault: true and undefined ConfigSelector and ConfigNamespaceSelector + Operator selects all exist alertManagerConfigs + with selectAllByDefault: false - selects nothing + type: boolean + serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods + type: string + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmalertmanager + VMServiceScrape spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be added to vmalertmanager service + spec + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + storage: + description: |- + Storage is the definition of how storage will be used by the VMAlertmanager + instances. + properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean + emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: EmbeddedMetadata contains metadata relevant to + an EmbeddedResource. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + Spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes to + consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + Status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage - + the capacity of the volume.\n\t* Custom resources must + use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have + kubernetes.io prefix are considered\nreserved and hence + may not be used.\n\nClaimResourceStatus can be in any + of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with + a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing the + volume but further resizing of\n\t\tvolume is needed + on the node.\n\t- NodeResizeInProgress:\n\t\tState set + when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this + field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress for + the given PVC.\n\nA controller that receives PVC update + with previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for + resizing capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage - + the capacity of the volume.\n\t* Custom resources must + use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have + kubernetes.io prefix are considered\nreserved and hence + may not be used.\n\nCapacity reported here may be larger + than the actual capacity when a volume expansion operation\nis + requested.\nFor storage quota, the larger value from + allocatedResources and PVC.spec.resources is used.\nIf + allocatedResources is not set, PVC.spec.resources alone + is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and + if the actual volume capacity\nis equal or lower than + the requested capacity.\n\nA controller that receives + PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for + resizing capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with PVC.\n\nThis + is an alpha field and requires enabling RecoverVolumeExpansionFailure + feature." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains + details about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed + the condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the + condition transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible + indicates that the request has been rejected as + invalid by the CSI driver. To\n\t resolve the error, + a valid VolumeAttributesClass needs to be specified.\nNote: + New statuses can be added in the future. Consumers + should check for unknown statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + type: object + type: object + type: object + templates: + description: |- + Templates is a list of ConfigMap key references for ConfigMaps in the same namespace as the VMAlertmanager + object, which shall be mounted into the VMAlertmanager Pods. + The Templates are mounted into /etc/vm/templates//. + items: + description: ConfigMapKeyReference refers to a key in a ConfigMap. + properties: + key: + description: The ConfigMap key to refer to. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - key + type: object + x-kubernetes-map-type: atomic + type: array + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + useVMConfigReloader: + description: |- + UseVMConfigReloader replaces prometheus-like config-reloader + with vm one. It uses secrets watch instead of file watch + which greatly increases speed of config updates + type: boolean + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + webConfig: + description: |- + WebConfig defines configuration for webserver + https://github.com/prometheus/alertmanager/blob/main/docs/https.md + properties: + basic_auth_users: + additionalProperties: + type: string + description: |- + BasicAuthUsers Usernames and hashed passwords that have full access to the web server + Passwords must be hashed with bcrypt + type: object + http_server_config: + description: HTTPServerConfig defines http server configuration + for alertmanager web server + properties: + headers: + additionalProperties: + type: string + description: Headers defines list of headers that can be added + to HTTP responses. + type: object + http2: + description: |- + HTTP2 enables HTTP/2 support. Note that HTTP/2 is only supported with TLS. + This can not be changed on the fly. + type: boolean + type: object + tls_server_config: + description: TLSServerConfig defines server TLS configuration + for alertmanager + properties: + cert_file: + description: |- + CertFile defines path to the pre-mounted file with certificate + mutually exclusive with CertSecretRef + type: string + cert_secret_ref: + description: |- + CertSecretRef defines reference for secret with certificate content under given key + mutually exclusive with CertFile + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + cipher_suites: + description: |- + CipherSuites defines list of supported cipher suites for TLS versions up to TLS 1.2 + https://golang.org/pkg/crypto/tls/#pkg-constants + items: + type: string + type: array + client_auth_type: + description: |- + Cert defines reference for secret with CA content under given key + mutually exclusive with CertFile + ClientAuthType defines server policy for client authentication + If you want to enable client authentication (aka mTLS), you need to use RequireAndVerifyClientCert + Note, mTLS is supported only at enterprise version of VictoriaMetrics components + enum: + - NoClientCert + - RequireAndVerifyClientCert + type: string + client_ca_file: + description: |- + ClientCAFile defines path to the pre-mounted file with CA + mutually exclusive with ClientCASecretRef + type: string + client_ca_secret_ref: + description: |- + ClientCASecretRef defines reference for secret with CA content under given key + mutually exclusive with ClientCAFile + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + curve_preferences: + description: |- + CurvePreferences defines elliptic curves that will be used in an ECDHE handshake, in preference order. + https://golang.org/pkg/crypto/tls/#CurveID + items: + type: string + type: array + key_file: + description: |- + KeyFile defines path to the pre-mounted file with certificate key + mutually exclusive with KeySecretRef + type: string + key_secret_ref: + description: |- + Key defines reference for secret with certificate key content under given key + mutually exclusive with KeyFile + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + max_version: + description: MaxVersion maximum TLS version that is acceptable. + enum: + - TLS10 + - TLS11 + - TLS12 + - TLS13 + type: string + min_version: + description: MinVersion minimum TLS version that is acceptable. + enum: + - TLS10 + - TLS11 + - TLS12 + - TLS13 + type: string + prefer_server_cipher_suites: + description: |- + PreferServerCipherSuites controls whether the server selects the + client's most preferred ciphersuite + type: boolean + type: object + type: object type: object - x-kubernetes-preserve-unknown-fields: true status: + description: |- + Most recent observed status of the VMAlertmanager cluster. + Operator API itself. More info: + https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -690,11 +12639,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -709,7 +12663,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmalerts.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -725,7 +12679,7 @@ spec: jsonPath: .status.updateStatus name: Status type: string - - description: The desired replicas number of VMAlerts + - description: The desired replicas number of Alertmanagers jsonPath: .spec.replicaCount name: ReplicaCount type: integer @@ -735,47 +12689,1924 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMAlert executes a list of given alerting or recording rules + against configured address. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMAlertSpec defines the desired state of VMAlert + properties: + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + configReloaderExtraArgs: + additionalProperties: + type: string + description: |- + ConfigReloaderExtraArgs that will be passed to VMAuths config-reloader container + for example resyncInterval: "30s" + type: object + configReloaderImageTag: + description: ConfigReloaderImageTag defines image:tag for config-reloader + container + type: string + configReloaderResources: + description: |- + ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + datasource: + description: Datasource Victoria Metrics or VMSelect url. Required + parameter. e.g. http://127.0.0.1:8428 + properties: + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: Path to bearer token file + type: string + bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version + items: + type: string + type: array + oauth2: + description: OAuth2 defines OAuth2 configuration + required: + - client_id + - token_url + type: object + x-kubernetes-preserve-unknown-fields: true + tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. + type: object + x-kubernetes-preserve-unknown-fields: true + url: + description: Victoria Metrics or VMSelect url. Required parameter. + E.g. http://127.0.0.1:8428 + type: string + required: + - url + type: object + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + enforcedNamespaceLabel: + description: |- + EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert + and metric that is user created. The label value will always be the namespace of the object that is + being created. + type: string + evaluationInterval: + description: EvaluationInterval defines how often to evaluate rules + by default + pattern: '[0-9]+(ms|s|m|h)' + type: string + externalLabels: + additionalProperties: + type: string + description: 'ExternalLabels in the form ''name: value'' to add to + all generated recording rules and alerts.' + type: object + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application container + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace + type: boolean + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's repository + if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) + properties: + forceOffline: + description: Enforce offline verification of the license key. + type: boolean + key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) + type: string + keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. + type: string + type: object + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: |- + LogFormat for VMAlert to be configured with. + default or json + enum: + - default + - json + type: string + logLevel: + description: LogLevel for VMAlert to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + type: object + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + notifier: + description: |- + Notifier prometheus alertmanager endpoint spec. Required at least one of notifier or notifiers when there are alerting rules. e.g. http://127.0.0.1:9093 + If specified both notifier and notifiers, notifier will be added as last element to notifiers. + only one of notifier options could be chosen: notifierConfigRef or notifiers + notifier + properties: + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: Path to bearer token file + type: string + bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version + items: + type: string + type: array + oauth2: + description: OAuth2 defines OAuth2 configuration + required: + - client_id + - token_url + type: object + x-kubernetes-preserve-unknown-fields: true + selector: + description: |- + Selector allows service discovery for alertmanager + in this case all matched vmalertmanager replicas will be added into vmalert notifier.url + as statefulset pod.fqdn + properties: + labelSelector: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: |- + NamespaceSelector is a selector for selecting either all namespaces or a + list of namespaces. + properties: + any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. + type: boolean + matchNames: + description: List of namespace names. + items: + type: string + type: array + type: object + type: object + tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. + type: object + x-kubernetes-preserve-unknown-fields: true + url: + description: AlertManager url. E.g. http://127.0.0.1:9093 + type: string + type: object + notifierConfigRef: + description: |- + NotifierConfigRef reference for secret with notifier configuration for vmalert + only one of notifier options could be chosen: notifierConfigRef or notifiers + notifier + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + notifiers: + description: |- + Notifiers prometheus alertmanager endpoints. Required at least one of notifier or notifiers when there are alerting rules. e.g. http://127.0.0.1:9093 + If specified both notifier and notifiers, notifier will be added as last element to notifiers. + only one of notifier options could be chosen: notifierConfigRef or notifiers + notifier + items: + description: VMAlertNotifierSpec defines the notifier url for sending + information about alerts + properties: + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: Path to bearer token file + type: string + bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version + items: + type: string + type: array + oauth2: + description: OAuth2 defines OAuth2 configuration + required: + - client_id + - token_url + type: object + x-kubernetes-preserve-unknown-fields: true + selector: + description: |- + Selector allows service discovery for alertmanager + in this case all matched vmalertmanager replicas will be added into vmalert notifier.url + as statefulset pod.fqdn + properties: + labelSelector: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: |- + NamespaceSelector is a selector for selecting either all namespaces or a + list of namespaces. + properties: + any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. + type: boolean + matchNames: + description: List of namespace names. + items: + type: string + type: array + type: object + type: object + tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. + type: object + x-kubernetes-preserve-unknown-fields: true + url: + description: AlertManager url. E.g. http://127.0.0.1:9093 + type: string + type: object + type: array + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + podDisruptionBudget: + description: PodDisruptionBudget created by operator + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selectorLabels: + additionalProperties: + type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget + type: object + type: object + podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the VMAlert pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod condition + properties: + conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + remoteRead: + description: |- + RemoteRead Optional URL to read vmalert state (persisted via RemoteWrite) + This configuration only makes sense if alerts state has been successfully + persisted (via RemoteWrite) before. + see -remoteRead.url docs in vmalerts for details. + E.g. http://127.0.0.1:8428 + properties: + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: Path to bearer token file + type: string + bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version + items: + type: string + type: array + lookback: + description: |- + Lookback defines how far to look into past for alerts timeseries. For example, if lookback=1h then range from now() to now()-1h will be scanned. (default 1h0m0s) + Applied only to RemoteReadSpec + type: string + oauth2: + description: OAuth2 defines OAuth2 configuration + required: + - client_id + - token_url + type: object + x-kubernetes-preserve-unknown-fields: true + tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. + type: object + x-kubernetes-preserve-unknown-fields: true + url: + description: URL of the endpoint to send samples to. + type: string + required: + - url + type: object + remoteWrite: + description: |- + RemoteWrite Optional URL to remote-write compatible storage to persist + vmalert state and rule results to. + Rule results will be persisted according to each rule. + Alerts state will be persisted in the form of time series named ALERTS and ALERTS_FOR_STATE + see -remoteWrite.url docs in vmalerts for details. + E.g. http://127.0.0.1:8428 + properties: + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: Path to bearer token file + type: string + bearerTokenSecret: + description: Optional bearer auth token to use for -remoteWrite.url + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + concurrency: + description: Defines number of readers that concurrently write + into remote storage (default 1) + format: int32 + type: integer + flushInterval: + description: Defines interval of flushes to remote write endpoint + (default 5s) + pattern: '[0-9]+(ms|s|m|h)' + type: string + headers: + description: |- + Headers allow configuring custom http headers + Must be in form of semicolon separated header with value + e.g. + headerName:headerValue + vmalert supports it since 1.79.0 version + items: + type: string + type: array + maxBatchSize: + description: Defines defines max number of timeseries to be flushed + at once (default 1000) + format: int32 + type: integer + maxQueueSize: + description: Defines the max number of pending datapoints to remote + write endpoint (default 100000) + format: int32 + type: integer + oauth2: + description: OAuth2 defines OAuth2 configuration + required: + - client_id + - token_url + type: object + x-kubernetes-preserve-unknown-fields: true + tlsConfig: + description: TLSConfig specifies TLSConfig configuration parameters. + type: object + x-kubernetes-preserve-unknown-fields: true + url: + description: URL of the endpoint to send samples to. + type: string + required: + - url + type: object + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + rollingUpdate: + description: RollingUpdate - overrides deployment update params. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. + x-kubernetes-int-or-string: true + type: object + ruleNamespaceSelector: + description: |- + RuleNamespaceSelector to be selected for VMRules discovery. + Works in combination with Selector. + If both nil - behaviour controlled by selectAllByDefault + NamespaceSelector nil - only objects at VMAlert namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + rulePath: + description: |- + RulePath to the file with alert rules. + Supports patterns. Flag can be specified multiple times. + Examples: + -rule /path/to/file. Path to a single file with alerting rules + -rule dir/*.yaml -rule /*.yaml. Relative path to all .yaml files in folder, + absolute path to all .yaml files in root. + by default operator adds /etc/vmalert/configs/base/vmalert.yaml + items: + type: string + type: array + ruleSelector: + description: |- + RuleSelector selector to select which VMRules to mount for loading alerting + rules from. + Works in combination with NamespaceSelector. + If both nil - behaviour controlled by selectAllByDefault + NamespaceSelector nil - only objects at VMAlert namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + selectAllByDefault: + description: |- + SelectAllByDefault changes default behavior for empty CRD selectors, such RuleSelector. + with selectAllByDefault: true and empty serviceScrapeSelector and RuleNamespaceSelector + Operator selects all exist serviceScrapes + with selectAllByDefault: false - selects nothing + type: boolean + serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods + type: string + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmalert VMServiceScrape + spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be added to vmalert service spec + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + updateStrategy: + description: UpdateStrategy - overrides default update strategy. + enum: + - Recreate + - RollingUpdate + type: string + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + useVMConfigReloader: + description: |- + UseVMConfigReloader replaces prometheus-like config-reloader + with vm one. It uses secrets watch instead of file watch + which greatly increases speed of config updates + type: boolean + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array required: - datasource type: object - x-kubernetes-preserve-unknown-fields: true status: + description: VMAlertStatus defines the observed state of VMAlert properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -790,11 +14621,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -807,113 +14643,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vmanomalies.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VMAnomaly - listKind: VMAnomalyList - plural: vmanomalies - singular: vmanomaly - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: current number of shards - jsonPath: .status.shards - name: Shards Count - type: integer - - description: Current status of update rollout - jsonPath: .status.updateStatus - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - required: - - reader - - writer - type: object - x-kubernetes-preserve-unknown-fields: true - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - shards: - format: int32 - type: integer - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - scale: - labelSelectorPath: .status.selector - specReplicasPath: .spec.shardCount - statusReplicasPath: .status.shards - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmauths.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -932,52 +14662,1659 @@ spec: - jsonPath: .metadata.creationTimestamp name: Age type: date - - description: The desired replicas number of VMAuth + - description: The desired replicas number of Alertmanagers jsonPath: .spec.replicaCount name: ReplicaCount type: integer name: v1beta1 schema: openAPIV3Schema: + description: VMAuth is the Schema for the vmauths API properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMAuthSpec defines the desired state of VMAuth + properties: + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + configReloaderExtraArgs: + additionalProperties: + type: string + description: |- + ConfigReloaderExtraArgs that will be passed to VMAuths config-reloader container + for example resyncInterval: "30s" + type: object + configReloaderImageTag: + description: ConfigReloaderImageTag defines image:tag for config-reloader + container + type: string + configReloaderResources: + description: |- + ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + configSecret: + description: |- + ConfigSecret is the name of a Kubernetes Secret in the same namespace as the + VMAuth object, which contains auth configuration for vmauth, + configuration must be inside secret key: config.yaml. + It must be created and managed manually. + If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders + Deprecated, use externalConfig.secretRef instead + type: string + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + externalConfig: + description: |- + ExternalConfig defines a source of external VMAuth configuration. + If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders + properties: + localPath: + description: |- + LocalPath contains static path to a config, which is managed externally for cases + when using secrets is not applicable, e.g.: Vault sidecar. + type: string + secretRef: + description: SecretRef defines selector for externally managed + secret which contains configuration + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application container + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace + type: boolean + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's repository + if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + ingress: + description: Ingress enables ingress configuration for VMAuth. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + class_name: + description: ClassName defines ingress class name for VMAuth + type: string + extraRules: + description: |- + ExtraRules - additional rules for ingress, + must be checked for correctness by user. + items: + description: |- + IngressRule represents the rules mapping the paths under a specified host to + the related backend services. Incoming requests are first evaluated for a host + match, then routed to the backend associated with the matching IngressRuleValue. + properties: + host: + description: "host is the fully qualified domain name of + a network host, as defined by RFC 3986.\nNote the following + deviations from the \"host\" part of the\nURI as defined + in RFC 3986:\n1. IPs are not allowed. Currently an IngressRuleValue + can only apply to\n the IP in the Spec of the parent + Ingress.\n2. The `:` delimiter is not respected because + ports are not allowed.\n\t Currently the port of an Ingress + is implicitly :80 for http and\n\t :443 for https.\nBoth + these may change in the future.\nIncoming requests are + matched against the host before the\nIngressRuleValue. + If the host is unspecified, the Ingress routes all\ntraffic + based on the specified IngressRuleValue.\n\nhost can be + \"precise\" which is a domain name without the terminating + dot of\na network host (e.g. \"foo.bar.com\") or \"wildcard\", + which is a domain name\nprefixed with a single wildcard + label (e.g. \"*.foo.com\").\nThe wildcard character '*' + must appear by itself as the first DNS label and\nmatches + only a single label. You cannot have a wildcard label + by itself (e.g. Host == \"*\").\nRequests will be matched + against the Host field in the following way:\n1. If host + is precise, the request matches this rule if the http + host header is equal to Host.\n2. If host is a wildcard, + then the request matches this rule if the http host header\nis + to equal to the suffix (removing the first label) of the + wildcard rule." + type: string + http: + description: |- + HTTPIngressRuleValue is a list of http selectors pointing to backends. + In the example: http:///? -> backend where + where parts of the url correspond to RFC 3986, this resource will be used + to match against everything after the last '/' and before the first '?' + or '#'. + properties: + paths: + description: paths is a collection of paths that map + requests to backends. + items: + description: |- + HTTPIngressPath associates a path with a backend. Incoming urls matching the + path are forwarded to the backend. + properties: + backend: + description: |- + backend defines the referenced service endpoint to which the traffic + will be forwarded to. + properties: + resource: + description: |- + resource is an ObjectRef to another Kubernetes resource in the namespace + of the Ingress object. If resource is specified, a service.Name and + service.Port must not be specified. + This is a mutually exclusive setting with "Service". + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + service: + description: |- + service references a service as a backend. + This is a mutually exclusive setting with "Resource". + properties: + name: + description: |- + name is the referenced service. The service must exist in + the same namespace as the Ingress object. + type: string + port: + description: |- + port of the referenced service. A port name or port number + is required for a IngressServiceBackend. + properties: + name: + description: |- + name is the name of the port on the Service. + This is a mutually exclusive setting with "Number". + type: string + number: + description: |- + number is the numerical port number (e.g. 80) on the Service. + This is a mutually exclusive setting with "Name". + format: int32 + type: integer + type: object + x-kubernetes-map-type: atomic + required: + - name + type: object + type: object + path: + description: |- + path is matched against the path of an incoming request. Currently it can + contain characters disallowed from the conventional "path" part of a URL + as defined by RFC 3986. Paths must begin with a '/' and must be present + when using PathType with value "Exact" or "Prefix". + type: string + pathType: + description: |- + pathType determines the interpretation of the path matching. PathType can + be one of the following values: + * Exact: Matches the URL path exactly. + * Prefix: Matches based on a URL path prefix split by '/'. Matching is + done on a path element by element basis. A path element refers is the + list of labels in the path split by the '/' separator. A request is a + match for path p if every p is an element-wise prefix of p of the + request path. Note that if the last element of the path is a substring + of the last element in request path, it is not a match (e.g. /foo/bar + matches /foo/bar/baz, but does not match /foo/barbaz). + * ImplementationSpecific: Interpretation of the Path matching is up to + the IngressClass. Implementations can treat this as a separate PathType + or treat it identically to Prefix or Exact path types. + Implementations are required to support all path types. + type: string + required: + - backend + - pathType + type: object + type: array + x-kubernetes-list-type: atomic + required: + - paths + type: object + type: object + type: array + extraTls: + description: |- + ExtraTLS - additional TLS configuration for ingress + must be checked for correctness by user. + items: + description: IngressTLS describes the transport layer security + associated with an ingress. + properties: + hosts: + description: |- + hosts is a list of hosts included in the TLS certificate. The values in + this list must match the name/s used in the tlsSecret. Defaults to the + wildcard host setting for the loadbalancer controller fulfilling this + Ingress, if left unspecified. + items: + type: string + type: array + x-kubernetes-list-type: atomic + secretName: + description: |- + secretName is the name of the secret used to terminate TLS traffic on + port 443. Field is left optional to allow TLS routing based on SNI + hostname alone. If the SNI host in a listener conflicts with the "Host" + header field used by an IngressRule, the SNI host is used for termination + and value of the "Host" header is used for routing. + type: string + type: object + type: array + host: + description: |- + Host defines ingress host parameter for default rule + It will be used, only if TlsHosts is empty + type: string + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + tlsHosts: + description: TlsHosts configures TLS access for ingress, tlsSecretName + must be defined for it. + items: + type: string + type: array + tlsSecretName: + description: |- + TlsSecretName defines secretname at the VMAuth namespace with cert and key + https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + type: string + type: object + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) + properties: + forceOffline: + description: Enforce offline verification of the license key. + type: boolean + key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) + type: string + keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. + type: string + type: object + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: LogFormat for VMAuth to be configured with. + enum: + - default + - json + type: string + logLevel: + description: LogLevel for victoria metrics single to be configured + with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + type: object + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + podDisruptionBudget: + description: PodDisruptionBudget created by operator + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selectorLabels: + additionalProperties: + type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget + type: object + type: object + podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the VMAuth pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod condition + properties: + conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + selectAllByDefault: + description: |- + SelectAllByDefault changes default behavior for empty CRD selectors, such userSelector. + with selectAllByDefault: true and empty userSelector and userNamespaceSelector + Operator selects all exist users + with selectAllByDefault: false - selects nothing + type: boolean + serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods + type: string + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmauth VMServiceScrape + spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be added to vmsingle service spec + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + unauthorizedAccessConfig: + description: |- + UnauthorizedAccessConfig configures access for un authorized users + + Deprecated, use unauthorizedUserAccessSpec instead + will be removed at v1.0 release + x-kubernetes-preserve-unknown-fields: true + unauthorizedUserAccessSpec: + description: UnauthorizedUserAccessSpec defines unauthorized_user + config section of vmauth config + properties: + default_url: + description: |- + DefaultURLs backend url for non-matching paths filter + usually used for default backend with error message + items: + type: string + type: array + discover_backend_ips: + description: DiscoverBackendIPs instructs discovering URLPrefix + backend IPs via DNS. + type: boolean + drop_src_path_prefix_parts: + description: |- + DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend. + See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details. + type: integer + dump_request_on_errors: + description: |- + DumpRequestOnErrors instructs vmauth to return detailed request params to the client + if routing rules don't allow to forward request to the backends. + Useful for debugging `src_hosts` and `src_headers` based routing rules + + available since v1.107.0 vmauth version + type: boolean + headers: + description: |- + Headers represent additional http headers, that vmauth uses + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.68.0 version of vmauth + items: + type: string + type: array + ip_filters: + description: |- + IPFilters defines per target src ip filters + supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/vmauth/#ip-filters) + properties: + allow_list: + items: + type: string + type: array + deny_list: + items: + type: string + type: array + type: object + load_balancing_policy: + description: |- + LoadBalancingPolicy defines load balancing policy to use for backend urls. + Supported policies: least_loaded, first_available. + See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded") + enum: + - least_loaded + - first_available + type: string + max_concurrent_requests: + description: |- + MaxConcurrentRequests defines max concurrent requests per user + 300 is default value for vmauth + type: integer + metric_labels: + additionalProperties: + type: string + description: MetricLabels - additional labels for metrics exported + by vmauth for given user. + type: object + response_headers: + description: |- + ResponseHeaders represent additional http headers, that vmauth adds for request response + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.93.0 version of vmauth + items: + type: string + type: array + retry_status_codes: + description: |- + RetryStatusCodes defines http status codes in numeric format for request retries + e.g. [429,503] + items: + type: integer + type: array + tlsConfig: + description: TLSConfig defines tls configuration for the backend + connection + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use for + the targets. + type: string + cert: + description: Struct containing the client cert file for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + url_map: + items: + description: |- + UnauthorizedAccessConfigURLMap defines element of url_map routing configuration + For UnauthorizedAccessConfig and VMAuthUnauthorizedUserAccessSpec.URLMap + properties: + discover_backend_ips: + description: DiscoverBackendIPs instructs discovering URLPrefix + backend IPs via DNS. + type: boolean + drop_src_path_prefix_parts: + description: |- + DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend. + See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details. + type: integer + headers: + description: |- + RequestHeaders represent additional http headers, that vmauth uses + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.68.0 version of vmauth + items: + type: string + type: array + load_balancing_policy: + description: |- + LoadBalancingPolicy defines load balancing policy to use for backend urls. + Supported policies: least_loaded, first_available. + See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded") + enum: + - least_loaded + - first_available + type: string + response_headers: + description: |- + ResponseHeaders represent additional http headers, that vmauth adds for request response + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.93.0 version of vmauth + items: + type: string + type: array + retry_status_codes: + description: |- + RetryStatusCodes defines http status codes in numeric format for request retries + Can be defined per target or at VMUser.spec level + e.g. [429,503] + items: + type: integer + type: array + src_headers: + description: SrcHeaders is an optional list of headers, + which must match request headers. + items: + type: string + type: array + src_hosts: + description: SrcHosts is an optional list of regular expressions, + which must match the request hostname. + items: + type: string + type: array + src_paths: + description: SrcPaths is an optional list of regular expressions, + which must match the request path. + items: + type: string + type: array + src_query_args: + description: SrcQueryArgs is an optional list of query args, + which must match request URL query args. + items: + type: string + type: array + url_prefix: + description: |- + UrlPrefix contains backend url prefixes for the proxied request url. + URLPrefix defines prefix prefix for destination + x-kubernetes-preserve-unknown-fields: true + type: object + type: array + url_prefix: + description: URLPrefix defines prefix prefix for destination + x-kubernetes-preserve-unknown-fields: true + type: object + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + useVMConfigReloader: + description: |- + UseVMConfigReloader replaces prometheus-like config-reloader + with vm one. It uses secrets watch instead of file watch + which greatly increases speed of config updates + type: boolean + userNamespaceSelector: + description: |- + UserNamespaceSelector Namespaces to be selected for VMAuth discovery. + Works in combination with Selector. + NamespaceSelector nil - only objects at VMAuth namespace. + Selector nil - only objects at NamespaceSelector namespaces. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + userSelector: + description: |- + UserSelector defines VMUser to be selected for config file generation. + Works in combination with NamespaceSelector. + NamespaceSelector nil - only objects at VMAuth namespace. + If both nil - behaviour controlled by selectAllByDefault + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array type: object x-kubernetes-preserve-unknown-fields: true status: + description: VMAuthStatus defines the observed state of VMAuth properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -992,11 +16329,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -1009,7 +16351,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmclusters.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1043,45 +16385,4338 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMCluster is fast, cost-effective and scalable time-series database. + Cluster version with properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: - type: object - x-kubernetes-preserve-unknown-fields: true - status: + description: VMClusterSpec defines the desired state of VMCluster properties: - conditions: + clusterDomainName: + description: |- + ClusterDomainName defines domain name suffix for in-cluster dns addresses + aka .cluster.local + used by vminsert and vmselect to build vmstorage address + type: string + clusterVersion: + description: |- + ClusterVersion defines default images tag for all components. + it can be overwritten with component specific image.tag value. + type: string + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) + properties: + forceOffline: + description: Enforce offline verification of the license key. + type: boolean + key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) + type: string + keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. + type: string + type: object + managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + replicationFactor: + description: |- + ReplicationFactor defines how many copies of data make among + distinct storage nodes + format: int32 + type: integer + requestsLoadBalancer: + description: |- + RequestsLoadBalancer configures load-balancing for vminsert and vmselect requests + it helps to evenly spread load across pods + usually it's not possible with kubernetes TCP based service + properties: + disableInsertBalancing: + type: boolean + disableSelectBalancing: + type: boolean + enabled: + type: boolean + spec: + description: |- + VMAuthLoadBalancerSpec defines configuration spec for VMAuth used as load-balancer + for VMCluster component + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + retentionPeriod: + description: |- + RetentionPeriod for the stored metrics + Note VictoriaMetrics has data/ and indexdb/ folders + metrics from data/ removed eventually as soon as partition leaves retention period + reverse index data at indexdb rotates once at the half of configured + [retention period](https://docs.victoriametrics.com/Single-server-VictoriaMetrics/#retention) + type: string + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run the + VMSelect, VMStorage and VMInsert Pods. + type: string + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + vminsert: + properties: + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + clusterNativeListenPort: + description: |- + ClusterNativePort for multi-level cluster setup. + More [details](https://docs.victoriametrics.com/Cluster-VictoriaMetrics#multi-level-cluster-setup) + type: string + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application + container + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of + ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key + in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the + node network namespace + type: boolean + hpa: + description: HPA defines kubernetes PodAutoScaling configuration + version 2. + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's + repository if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + insertPorts: + description: InsertPorts - additional listen ports for data ingestion. + properties: + graphitePort: + description: GraphitePort listen port + type: string + influxPort: + description: InfluxPort listen port + type: string + openTSDBHTTPPort: + description: OpenTSDBHTTPPort for http connections. + type: string + openTSDBPort: + description: OpenTSDBPort for tcp and udp listen + type: string + type: object + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: |- + LogFormat for VMInsert to be configured with. + default or json + enum: + - default + - json + type: string + logLevel: + description: LogLevel for VMInsert to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + podDisruptionBudget: + description: PodDisruptionBudget created by operator + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selectorLabels: + additionalProperties: + type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget + type: object + type: object + podMetadata: + description: PodMetadata configures Labels and Annotations which + are propagated to the VMInsert pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod + condition + properties: + conditionType: + description: ConditionType refers to a condition in the + pod's condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + rollingUpdate: + description: RollingUpdate - overrides deployment update params. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. + x-kubernetes-int-or-string: true + type: object + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vminsert + VMServiceScrape spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be added to vminsert service + spec + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for + additional service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container + graceful termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + updateStrategy: + description: UpdateStrategy - overrides default update strategy. + enum: + - Recreate + - RollingUpdate + type: string + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + vmselect: + description: VMSelect defines configuration section for vmselect components + of the victoria-metrics cluster + properties: + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + cacheMountPath: + description: |- + CacheMountPath allows to add cache persistent for VMSelect, + will use "/cache" as default if not specified. + type: string + claimTemplates: + description: ClaimTemplates allows adding additional VolumeClaimTemplates + for StatefulSet + items: + description: PersistentVolumeClaim is a user's request for and + claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + type: object + x-kubernetes-preserve-unknown-fields: true + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey + names follow standard Kubernetes label syntax. Valid + values are either:\n\t* Un-prefixed keys:\n\t\t- storage + - the capacity of the volume.\n\t* Custom resources + must use implementation-defined prefixed names such + as \"example.com/my-custom-resource\"\nApart from + above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not + be used.\n\nClaimResourceStatus can be in any of following + states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with + a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing the + volume but further resizing of\n\t\tvolume is needed + on the node.\n\t- NodeResizeInProgress:\n\t\tState + set when kubelet starts resizing the volume.\n\t- + NodeResizeFailed:\n\t\tState set when resizing has + failed in kubelet with a terminal error. Transient + errors don't set\n\t\tNodeResizeFailed.\nFor example: + if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress for + the given PVC.\n\nA controller that receives PVC update + with previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage + - the capacity of the volume.\n\t* Custom resources + must use implementation-defined prefixed names such + as \"example.com/my-custom-resource\"\nApart from + above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not + be used.\n\nCapacity reported here may be larger than + the actual capacity when a volume expansion operation\nis + requested.\nFor storage quota, the larger value from + allocatedResources and PVC.spec.resources is used.\nIf + allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume + expansion capacity request is lowered, allocatedResources + is only\nlowered if there are no expansion operations + in progress and if the actual volume capacity\nis + equal or lower than the requested capacity.\n\nA controller + that receives PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains + details about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed + the condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the + condition transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, + such as\n the specified VolumeAttributesClass + not existing.\n - InProgress\n InProgress indicates + that the volume is being modified.\n - Infeasible\n + \ Infeasible indicates that the request has been + rejected as invalid by the CSI driver. To\n\t + \ resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can + be added in the future. Consumers should check + for unknown statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is + the name of the VolumeAttributesClass the PVC + currently being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + type: object + type: object + type: array + clusterNativeListenPort: + description: |- + ClusterNativePort for multi-level cluster setup. + More [details](https://docs.victoriametrics.com/Cluster-VictoriaMetrics#multi-level-cluster-setup) + type: string + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application + container + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of + ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key + in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the + node network namespace + type: boolean + hpa: + description: |- + Configures horizontal pod autoscaling. + Note, enabling this option disables vmselect to vmselect communication. In most cases it's not an issue. + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's + repository if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: |- + LogFormat for VMSelect to be configured with. + default or json + enum: + - default + - json + type: string + logLevel: + description: LogLevel for VMSelect to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + persistentVolume: + description: |- + Storage - add persistent volume for cacheMountPath + its useful for persistent cache + use storage instead of persistentVolume. + properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean + emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + podDisruptionBudget: + description: PodDisruptionBudget created by operator + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selectorLabels: + additionalProperties: + type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget + type: object + type: object + podMetadata: + description: PodMetadata configures Labels and Annotations which + are propagated to the VMSelect pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod + condition + properties: + conditionType: + description: ConditionType refers to a condition in the + pod's condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + rollingUpdateStrategy: + description: |- + RollingUpdateStrategy defines strategy for application updates + Default is OnDelete, in this case operator handles update process + Can be changed for RollingUpdate + type: string + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmselect + VMServiceScrape spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be added to vmselect service + spec + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for + additional service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + storage: + description: |- + StorageSpec - add persistent volume claim for cacheMountPath + its needed for persistent cache + properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean + emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: EmbeddedMetadata contains metadata relevant + to an EmbeddedResource. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + Spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + Status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey + names follow standard Kubernetes label syntax. Valid + values are either:\n\t* Un-prefixed keys:\n\t\t- + storage - the capacity of the volume.\n\t* Custom + resources must use implementation-defined prefixed + names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or + have kubernetes.io prefix are considered\nreserved + and hence may not be used.\n\nClaimResourceStatus + can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller + with a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing + the volume but further resizing of\n\t\tvolume is + needed on the node.\n\t- NodeResizeInProgress:\n\t\tState + set when kubelet starts resizing the volume.\n\t- + NodeResizeFailed:\n\t\tState set when resizing has + failed in kubelet with a terminal error. Transient + errors don't set\n\t\tNodeResizeFailed.\nFor example: + if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress + for the given PVC.\n\nA controller that receives + PVC update with previously unknown resourceName + or ClaimResourceStatus\nshould ignore the update + for the purpose it was designed. For example - a + controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates + that change other valid\nresources associated with + PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey + names follow standard Kubernetes label syntax. Valid + values are either:\n\t* Un-prefixed keys:\n\t\t- + storage - the capacity of the volume.\n\t* Custom + resources must use implementation-defined prefixed + names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or + have kubernetes.io prefix are considered\nreserved + and hence may not be used.\n\nCapacity reported + here may be larger than the actual capacity when + a volume expansion operation\nis requested.\nFor + storage quota, the larger value from allocatedResources + and PVC.spec.resources is used.\nIf allocatedResources + is not set, PVC.spec.resources alone is used for + quota calculation.\nIf a volume expansion capacity + request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress + and if the actual volume capacity\nis equal or lower + than the requested capacity.\n\nA controller that + receives PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires + enabling RecoverVolumeExpansionFailure feature." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains + details about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed + the condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time + the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, + such as\n the specified VolumeAttributesClass + not existing.\n - InProgress\n InProgress + indicates that the volume is being modified.\n + - Infeasible\n Infeasible indicates that the + request has been rejected as invalid by the + CSI driver. To\n\t resolve the error, a valid + VolumeAttributesClass needs to be specified.\nNote: + New statuses can be added in the future. Consumers + should check for unknown statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is + the name of the VolumeAttributesClass the PVC + currently being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of + PersistentVolumeClaim. + type: string + type: object + type: object + type: object + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container + graceful termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + vmstorage: + properties: + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + claimTemplates: + description: ClaimTemplates allows adding additional VolumeClaimTemplates + for StatefulSet + items: + description: PersistentVolumeClaim is a user's request for and + claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + type: object + x-kubernetes-preserve-unknown-fields: true + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status + of resource being resized for the given PVC.\nKey + names follow standard Kubernetes label syntax. Valid + values are either:\n\t* Un-prefixed keys:\n\t\t- storage + - the capacity of the volume.\n\t* Custom resources + must use implementation-defined prefixed names such + as \"example.com/my-custom-resource\"\nApart from + above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not + be used.\n\nClaimResourceStatus can be in any of following + states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with + a terminal error.\n\t- NodeResizePending:\n\t\tState + set when resize controller has finished resizing the + volume but further resizing of\n\t\tvolume is needed + on the node.\n\t- NodeResizeInProgress:\n\t\tState + set when kubelet starts resizing the volume.\n\t- + NodeResizeFailed:\n\t\tState set when resizing has + failed in kubelet with a terminal error. Transient + errors don't set\n\t\tNodeResizeFailed.\nFor example: + if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, + it means that no resize operation is in progress for + the given PVC.\n\nA controller that receives PVC update + with previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources + allocated to a PVC including its capacity.\nKey names + follow standard Kubernetes label syntax. Valid values + are either:\n\t* Un-prefixed keys:\n\t\t- storage + - the capacity of the volume.\n\t* Custom resources + must use implementation-defined prefixed names such + as \"example.com/my-custom-resource\"\nApart from + above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not + be used.\n\nCapacity reported here may be larger than + the actual capacity when a volume expansion operation\nis + requested.\nFor storage quota, the larger value from + allocatedResources and PVC.spec.resources is used.\nIf + allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume + expansion capacity request is lowered, allocatedResources + is only\nlowered if there are no expansion operations + in progress and if the actual volume capacity\nis + equal or lower than the requested capacity.\n\nA controller + that receives PVC update with previously unknown resourceName\nshould + ignore the update for the purpose it was designed. + For example - a controller that\nonly is responsible + for resizing capacity of the volume, should ignore + PVC updates that change other valid\nresources associated + with PVC.\n\nThis is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains + details about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed + the condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the + condition transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is a beta field and requires enabling VolumeAttributesClass feature (off by default). + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, + such as\n the specified VolumeAttributesClass + not existing.\n - InProgress\n InProgress indicates + that the volume is being modified.\n - Infeasible\n + \ Infeasible indicates that the request has been + rejected as invalid by the CSI driver. To\n\t + \ resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can + be added in the future. Consumers should check + for unknown statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is + the name of the VolumeAttributesClass the PVC + currently being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + type: object + type: object + type: array + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application + container + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of + ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key + in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the + node network namespace + type: boolean + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's + repository if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to + run within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: |- + LogFormat for VMStorage to be configured with. + default or json + enum: + - default + - json + type: string + logLevel: + description: LogLevel for VMStorage to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + maintenanceInsertNodeIDs: + description: |- + MaintenanceInsertNodeIDs - excludes given node ids from insert requests routing, must contain pod suffixes - for pod-0, id will be 0 and etc. + lets say, you have pod-0, pod-1, pod-2, pod-3. to exclude pod-0 and pod-3 from insert routing, define nodeIDs: [0,3]. + Useful at storage expanding, when you want to rebalance some data at cluster. + items: + format: int32 + type: integer + type: array + maintenanceSelectNodeIDs: + description: MaintenanceInsertNodeIDs - excludes given node ids + from select requests routing, must contain pod suffixes - for + pod-0, id will be 0 and etc. + items: + format: int32 + type: integer + type: array + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + podDisruptionBudget: + description: PodDisruptionBudget created by operator + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selectorLabels: + additionalProperties: + type: string + description: |- + replaces default labels selector generated by operator + it's useful when you need to create custom budget + type: object + type: object + podMetadata: + description: PodMetadata configures Labels and Annotations which + are propagated to the VMStorage pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod + condition + properties: + conditionType: + description: ConditionType refers to a condition in the + pod's condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + rollingUpdateStrategy: + description: |- + RollingUpdateStrategy defines strategy for application updates + Default is OnDelete, in this case operator handles update process + Can be changed for RollingUpdate + type: string + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmstorage + VMServiceScrape spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be create additional service + for vmstorage + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for + additional service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + storage: + description: |- + Storage - add persistent volume for StorageDataPath + its useful for persistent cache + properties: + disableMountSubPath: + description: |- + Deprecated: subPath usage will be disabled by default in a future release, this option will become unnecessary. + DisableMountSubPath allows to remove any subPath usage in volume mounts. + type: boolean + emptyDir: + description: |- + EmptyDirVolumeSource to be used by the Prometheus StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the VMAlertManager StatefulSets. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + storageDataPath: + description: StorageDataPath - path to storage data + type: string + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container + graceful termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + vmBackup: + description: VMBackup configuration for backup + properties: + acceptEULA: + description: |- + AcceptEULA accepts enterprise feature usage, must be set to true. + otherwise backupmanager cannot be added to single/cluster version. + https://victoriametrics.com/legal/esa/ + type: boolean + concurrency: + description: Defines number of concurrent workers. Higher + concurrency may reduce backup duration (default 10) + format: int32 + type: integer + credentialsSecret: + description: |- + CredentialsSecret is secret in the same namespace for access to remote storage + The secret is mounted into /etc/vm/creds. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + customS3Endpoint: + description: Custom S3 endpoint for use with S3-compatible + storages (e.g. MinIO). S3 is used if not set + type: string + destination: + description: Defines destination for backup + type: string + destinationDisableSuffixAdd: + description: |- + DestinationDisableSuffixAdd - disables suffix adding for cluster version backups + each vmstorage backup must have unique backup folder + so operator adds POD_NAME as suffix for backup destination folder. + type: boolean + disableDaily: + description: Defines if daily backups disabled (default false) + type: boolean + disableHourly: + description: Defines if hourly backups disabled (default false) + type: boolean + disableMonthly: + description: Defines if monthly backups disabled (default + false) + type: boolean + disableWeekly: + description: Defines if weekly backups disabled (default false) + type: boolean + extraArgs: + additionalProperties: + type: string + description: extra args like maxBytesPerSecond default 0 + type: object + extraEnvs: + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set + of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be + defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + description: Image - docker image settings for VMBackuper + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + + it's repository if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + logFormat: + description: |- + LogFormat for VMBackup to be configured with. + default or json + enum: + - default + - json + type: string + logLevel: + description: LogLevel for VMBackup to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + port: + description: Port for health check connections + type: string + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + restore: + description: |- + Restore Allows to enable restore options for pod + Read [more](https://docs.victoriametrics.com/vmbackupmanager#restore-commands) + properties: + onStart: + description: OnStart defines configuration for restore + on pod start + properties: + enabled: + description: Enabled defines if restore on start enabled + type: boolean + type: object + type: object + snapshotCreateURL: + description: SnapshotCreateURL overwrites url for snapshot + create + type: string + snapshotDeleteURL: + description: SnapShotDeleteURL overwrites url for snapshot + delete + type: string + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment definition. + VolumeMounts specified will be appended to other VolumeMounts in the vmbackupmanager container, + that are generated as a result of StorageSpec objects. + items: + description: VolumeMount describes a mounting of a Volume + within a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + type: object + vmInsertPort: + description: VMInsertPort for VMInsert connections + type: string + vmSelectPort: + description: VMSelectPort for VMSelect connections + type: string + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + required: + - retentionPeriod + type: object + status: + description: VMClusterStatus defines the observed state of VMCluster + properties: + clusterStatus: + description: LegacyStatus is deprecated and will be removed at v0.52.0 + version + type: string + conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' + items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -1096,11 +20731,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -1115,101 +20755,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vmdistributed.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VMDistributed - listKind: VMDistributedList - plural: vmdistributed - singular: vmdistributed - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: current status of update rollout - jsonPath: .status.updateStatus - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: - type: string - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmnodescrapes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1233,45 +20779,869 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMNodeScrape defines discovery for targets placed on kubernetes nodes, + usually its node-exporters and other host services. + InternalIP is used as __address__ for scraping. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMNodeScrapeSpec defines specification for VMNodeScrape. + properties: + authorization: + description: Authorization with http header Authorization + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + basicAuth: + description: BasicAuth allow an endpoint to authenticate over basic + authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: File to read bearer token for scraping targets. + type: string + bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. + nullable: true + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + follow_redirects: + description: FollowRedirects controls redirects for scraping. + type: boolean + honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. + type: boolean + honorTimestamps: + description: HonorTimestamps controls whether vmagent respects the + timestamps present in scraped data. + type: boolean + interval: + description: Interval at which metrics should be scraped + type: string + jobLabel: + description: The label to use to retrieve the job name from. + type: string + max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped data + for a job + type: string + metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after scrapping. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 client + id + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + params: + additionalProperties: + items: + type: string + type: array + description: Optional HTTP URL parameters + type: object + path: + description: HTTP path to scrape for metrics. + type: string + port: + description: Name of the port exposed at Node. + type: string + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes to + proxy through this endpoint. + type: string + relabelConfigs: + description: RelabelConfigs to apply to samples during service discovery. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 + type: integer + scheme: + description: HTTP scheme to use for scraping. + enum: + - http + - https + - HTTPS + - HTTP + type: string + scrape_interval: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used + type: string + scrapeTimeout: + description: Timeout after which the scrape is ended + type: string + selector: + description: Selector to select kubernetes Nodes. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 + type: integer + targetLabels: + description: TargetLabels transfers labels on the Kubernetes Node + onto the target. + items: + type: string + type: array + tlsConfig: + description: TLSConfig configuration to use when scraping the endpoint + properties: + ca: + description: Struct containing the CA cert to use for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use for the + targets. + type: string + cert: + description: Struct containing the client cert file for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container for + the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container for + the targets. + type: string + keySecret: + description: Secret containing the client key file for the targets. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific scrape + parameters + properties: + disable_compression: + description: DisableCompression + type: boolean + disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements + type: boolean + headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version + items: + type: string + type: array + no_stale_markers: + type: boolean + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + scrape_align_interval: + type: string + scrape_offset: + type: string + stream_parse: + type: boolean + type: object type: object - x-kubernetes-preserve-unknown-fields: true status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -1286,11 +21656,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -1303,7 +21678,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmpodscrapes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1327,47 +21702,957 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMPodScrape is scrape configuration for pods, + it generates vmagent's config for scraping pod targets + based on selectors. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMPodScrapeSpec defines the desired state of VMPodScrape + properties: + attach_metadata: + description: AttachMetadata configures metadata attaching from service + discovery + properties: + node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. + type: boolean + type: object + jobLabel: + description: The label to use to retrieve the job name from. + type: string + namespaceSelector: + description: Selector to select which namespaces the Endpoints objects + are discovered from. + properties: + any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. + type: boolean + matchNames: + description: List of namespace names. + items: + type: string + type: array + type: object + podMetricsEndpoints: + description: A list of endpoints allowed as part of this PodMonitor. + items: + description: PodMetricsEndpoint defines a scrapeable endpoint of + a Kubernetes Pod serving metrics. + properties: + attach_metadata: + description: AttachMetadata configures metadata attaching from + service discovery + properties: + node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. + type: boolean + type: object + authorization: + description: Authorization with http header Authorization + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: File to read bearer token for scraping targets. + type: string + bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. + nullable: true + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + filterRunning: + description: |- + FilterRunning applies filter with pod status == running + it prevents from scrapping metrics at failed or succeed state pods. + enabled by default + type: boolean + follow_redirects: + description: FollowRedirects controls redirects for scraping. + type: boolean + honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. + type: boolean + honorTimestamps: + description: HonorTimestamps controls whether vmagent respects + the timestamps present in scraped data. + type: boolean + interval: + description: Interval at which metrics should be scraped + type: string + max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped + data for a job + type: string + metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after + scrapping. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 + client id + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret + file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + params: + additionalProperties: + items: + type: string + type: array + description: Optional HTTP URL parameters + type: object + path: + description: HTTP path to scrape for metrics. + type: string + port: + description: Name of the port exposed at Pod. + type: string + portNumber: + description: PortNumber defines the `Pod` port number which + exposes the endpoint. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. + type: string + relabelConfigs: + description: RelabelConfigs to apply to samples during service + discovery. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + sampleLimit: + description: SampleLimit defines per-scrape limit on number + of scraped samples that will be accepted. + format: int64 + type: integer + scheme: + description: HTTP scheme to use for scraping. + enum: + - http + - https + - HTTPS + - HTTP + type: string + scrape_interval: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used + type: string + scrapeTimeout: + description: Timeout after which the scrape is ended + type: string + seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 + type: integer + targetPort: + anyOf: + - type: integer + - type: string + description: |- + TargetPort defines name or number of the pod port this endpoint refers to. + Mutually exclusive with Port and PortNumber. + x-kubernetes-int-or-string: true + tlsConfig: + description: TLSConfig configuration to use when scraping the + endpoint + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use + for the targets. + type: string + cert: + description: Struct containing the client cert file for + the targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific + scrape parameters + properties: + disable_compression: + description: DisableCompression + type: boolean + disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements + type: boolean + headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version + items: + type: string + type: array + no_stale_markers: + type: boolean + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + scrape_align_interval: + type: string + scrape_offset: + type: string + stream_parse: + type: boolean + type: object + type: object + type: array + podTargetLabels: + description: PodTargetLabels transfers labels on the Kubernetes Pod + onto the target. + items: + type: string + type: array + sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 + type: integer + selector: + description: Selector to select Pod objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 + type: integer required: - podMetricsEndpoints type: object - x-kubernetes-preserve-unknown-fields: true status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -1382,11 +22667,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -1399,7 +22689,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmprobes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1423,47 +22713,1013 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMProbe defines a probe for targets, that will be executed with prober, + like blackbox exporter. + It helps to monitor reachability of target with various checks. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMProbeSpec contains specification parameters for a Probe. + properties: + authorization: + description: Authorization with http header Authorization + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + basicAuth: + description: BasicAuth allow an endpoint to authenticate over basic + authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: File to read bearer token for scraping targets. + type: string + bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. + nullable: true + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + follow_redirects: + description: FollowRedirects controls redirects for scraping. + type: boolean + honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. + type: boolean + honorTimestamps: + description: HonorTimestamps controls whether vmagent respects the + timestamps present in scraped data. + type: boolean + interval: + description: Interval at which metrics should be scraped + type: string + jobName: + description: The job name assigned to scraped metrics by default. + type: string + max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped data + for a job + type: string + metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after scrapping. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + module: + description: |- + The module to use for probing specifying how to probe the target. + Example module configuring in the blackbox exporter: + https://github.com/prometheus/blackbox_exporter/blob/master/example.yml + type: string + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 client + id + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + params: + additionalProperties: + items: + type: string + type: array + description: Optional HTTP URL parameters + type: object + path: + description: HTTP path to scrape for metrics. + type: string + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes to + proxy through this endpoint. + type: string + sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 + type: integer + scheme: + description: HTTP scheme to use for scraping. + enum: + - http + - https + - HTTPS + - HTTP + type: string + scrape_interval: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used + type: string + scrapeTimeout: + description: Timeout after which the scrape is ended + type: string + seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 + type: integer + targets: + description: Targets defines a set of static and/or dynamically discovered + targets to be probed using the prober. + properties: + ingress: + description: Ingress defines the set of dynamically discovered + ingress objects which hosts are considered for probing. + properties: + namespaceSelector: + description: Select Ingress objects by namespace. + properties: + any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. + type: boolean + matchNames: + description: List of namespace names. + items: + type: string + type: array + type: object + relabelingConfigs: + description: RelabelConfigs to apply to samples during service + discovery. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for + `action: graphite`' + type: object + match: + description: 'Match is used together with Labels for + `action: graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + selector: + description: Select Ingress objects by labels. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + staticConfig: + description: StaticConfig defines static targets which are considers + for probing. + properties: + labels: + additionalProperties: + type: string + description: Labels assigned to all metrics scraped from the + targets. + type: object + relabelingConfigs: + description: RelabelConfigs to apply to samples during service + discovery. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for + `action: graphite`' + type: object + match: + description: 'Match is used together with Labels for + `action: graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + targets: + description: Targets is a list of URLs to probe using the + configured prober. + items: + type: string + type: array + required: + - targets + type: object + type: object + tlsConfig: + description: TLSConfig configuration to use when scraping the endpoint + properties: + ca: + description: Struct containing the CA cert to use for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use for the + targets. + type: string + cert: + description: Struct containing the client cert file for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container for + the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container for + the targets. + type: string + keySecret: + description: Secret containing the client key file for the targets. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific scrape + parameters + properties: + disable_compression: + description: DisableCompression + type: boolean + disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements + type: boolean + headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version + items: + type: string + type: array + no_stale_markers: + type: boolean + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + scrape_align_interval: + type: string + scrape_offset: + type: string + stream_parse: + type: boolean + type: object + vmProberSpec: + description: |- + Specification for the prober to use for probing targets. + The prober.URL parameter is required. Targets cannot be probed if left empty. + properties: + path: + description: |- + Path to collect metrics from. + Defaults to `/probe`. + type: string + scheme: + description: |- + HTTP scheme to use for scraping. + Defaults to `http`. + enum: + - http + - https + type: string + url: + description: Mandatory URL of the prober. + type: string + required: + - url + type: object required: - vmProberSpec type: object - x-kubernetes-preserve-unknown-fields: true status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -1478,11 +23734,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -1497,7 +23758,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmrules.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1521,47 +23782,234 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMRule defines rule records for vmalert application properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMRuleSpec defines the desired state of VMRule + properties: + groups: + description: Groups list of group rules + items: + description: RuleGroup is a list of sequentially evaluated recording + and alerting rules. + properties: + concurrency: + description: Concurrency defines how many rules execute at once. + type: integer + eval_alignment: + description: |- + Optional + The evaluation timestamp will be aligned with group's interval, + instead of using the actual timestamp that evaluation happens at. + It is enabled by default to get more predictable results + and to visually align with graphs plotted via Grafana or vmui. + type: boolean + eval_delay: + description: |- + Optional + Adjust the `time` parameter of group evaluation requests to compensate intentional query delay from the datasource. + type: string + eval_offset: + description: |- + Optional + Group will be evaluated at the exact offset in the range of [0...interval]. + type: string + extra_filter_labels: + additionalProperties: + type: string + description: |- + ExtraFilterLabels optional list of label filters applied to every rule's + request within a group. Is compatible only with VM datasource. + See more details [here](https://docs.victoriametrics.com/#prometheus-querying-api-enhancements) + Deprecated, use params instead + type: object + headers: + description: |- + Headers contains optional HTTP headers added to each rule request + Must be in form `header-name: value` + For example: + headers: + - "CustomHeader: foo" + - "CustomHeader2: bar" + items: + type: string + type: array + interval: + description: evaluation interval for group + type: string + labels: + additionalProperties: + type: string + description: |- + Labels optional list of labels added to every rule within a group. + It has priority over the external labels. + Labels are commonly used for adding environment + or tenant-specific tag. + type: object + limit: + description: |- + Limit the number of alerts an alerting rule and series a recording + rule can produce + type: integer + name: + description: Name of group + type: string + notifier_headers: + description: |- + NotifierHeaders contains optional HTTP headers added to each alert request which will send to notifier + Must be in form `header-name: value` + For example: + headers: + - "CustomHeader: foo" + - "CustomHeader2: bar" + items: + type: string + type: array + params: + additionalProperties: + items: + type: string + type: array + description: Params optional HTTP URL parameters added to each + rule request + type: object + rules: + description: Rules list of alert rules + items: + description: Rule describes an alerting or recording rule. + properties: + alert: + description: Alert is a name for alert + type: string + annotations: + additionalProperties: + type: string + description: Annotations will be added to rule configuration + type: object + debug: + description: |- + Debug enables logging for rule + it useful for tracking + type: boolean + expr: + description: Expr is query, that will be evaluated at + dataSource + type: string + for: + description: |- + For evaluation interval in time.Duration format + 30s, 1m, 1h or nanoseconds + type: string + keep_firing_for: + description: |- + KeepFiringFor will make alert continue firing for this long + even when the alerting expression no longer has results. + Use time.Duration format, 30s, 1m, 1h or nanoseconds + type: string + labels: + additionalProperties: + type: string + description: Labels will be added to rule configuration + type: object + record: + description: Record represents a query, that will be recorded + to dataSource + type: string + update_entries_limit: + description: |- + UpdateEntriesLimit defines max number of rule's state updates stored in memory. + Overrides `-rule.updateEntriesLimit` in vmalert. + type: integer + type: object + type: array + tenant: + description: |- + Tenant id for group, can be used only with enterprise version of vmalert. + See more details [here](https://docs.victoriametrics.com/vmalert#multitenancy). + type: string + type: + description: |- + Type defines datasource type for enterprise version of vmalert + possible values - prometheus,graphite,vlogs + type: string + required: + - name + - rules + type: object + type: array required: - groups type: object - x-kubernetes-preserve-unknown-fields: true status: + description: VMRuleStatus defines the observed state of VMRule properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -1576,11 +24024,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -1595,7 +24048,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmscrapeconfigs.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1619,45 +24072,3255 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMScrapeConfig specifies a set of targets and parameters describing + how to scrape them. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMScrapeConfigSpec defines the desired state of VMScrapeConfig + properties: + authorization: + description: Authorization with http header Authorization + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + azureSDConfigs: + description: AzureSDConfigs defines a list of Azure service discovery + configurations. + items: + description: |- + AzureSDConfig allow retrieving scrape targets from Azure VMs. + See [here](https://docs.victoriametrics.com/sd_configs#azure_sd_configs) + properties: + authenticationMethod: + description: |- + # The authentication method, either OAuth or ManagedIdentity. + See https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview + enum: + - OAuth + - ManagedIdentity + type: string + clientID: + description: Optional client ID. Only required with the OAuth + authentication method. + type: string + clientSecret: + description: Optional client secret. Only required with the + OAuth authentication method. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + environment: + description: The Azure environment. + type: string + port: + description: |- + The port to scrape metrics from. If using the public IP address, this must + instead be specified in the relabeling rule. + type: integer + resourceGroup: + description: Optional resource group name. Limits discovery + to this resource group. + type: string + subscriptionID: + description: The subscription ID. Always required. + minLength: 1 + type: string + tenantID: + description: Optional tenant ID. Only required with the OAuth + authentication method. + type: string + required: + - subscriptionID + type: object + type: array + basicAuth: + description: BasicAuth allow an endpoint to authenticate over basic + authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: File to read bearer token for scraping targets. + type: string + bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. + nullable: true + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + consulSDConfigs: + description: ConsulSDConfigs defines a list of Consul service discovery + configurations. + items: + description: |- + ConsulSDConfig defines a Consul service discovery configuration. + See [here](https://docs.victoriametrics.com/sd_configs/#consul_sd_configs) + properties: + allowStale: + description: |- + Allow stale Consul results (see https://developer.hashicorp.com/consul/api-docs/features/consistency). Will reduce load on Consul. + If unset, use its default value. + type: boolean + authorization: + description: Authorization header to use on every scrape request. + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + basicAuth: + description: BasicAuth information to use on every scrape request. + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + datacenter: + description: Consul Datacenter name, if not provided it will + use the local Consul Agent Datacenter. + type: string + filter: + description: |- + Filter defines filter for /v1/catalog/services requests + See https://developer.hashicorp.com/consul/api-docs/features/filtering + type: string + followRedirects: + description: |- + Configure whether HTTP requests follow HTTP 3xx redirects. + If unset, use its default value. + type: boolean + namespace: + description: Namespaces are only supported in Consul Enterprise. + type: string + nodeMeta: + additionalProperties: + type: string + description: Node metadata key/value pairs to filter nodes for + a given service. + type: object + x-kubernetes-map-type: atomic + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 + client id + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret + file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + partition: + description: Admin Partitions are only supported in Consul Enterprise. + type: string + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy) + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. + type: string + scheme: + description: HTTP Scheme default "http" + enum: + - HTTP + - HTTPS + type: string + server: + description: A valid string consisting of a hostname or IP followed + by an optional port number. + minLength: 1 + type: string + services: + description: A list of services for which targets are retrieved. + If omitted, all services are scraped. + items: + type: string + type: array + x-kubernetes-list-type: atomic + tagSeparator: + description: |- + The string by which Consul tags are joined into the tag label. + If unset, use its default value. + type: string + tags: + description: An optional list of tags used to filter nodes for + a given service. Services must contain all tags in the list. + items: + type: string + type: array + x-kubernetes-list-type: atomic + tlsConfig: + description: TLS configuration to use on every scrape request + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use + for the targets. + type: string + cert: + description: Struct containing the client cert file for + the targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + tokenRef: + description: Consul ACL TokenRef, if not provided it will use + the ACL from the local Consul Agent. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + required: + - server + type: object + type: array + digitalOceanSDConfigs: + description: DigitalOceanSDConfigs defines a list of DigitalOcean + service discovery configurations. + items: + description: |- + DigitalOceanSDConfig allow retrieving scrape targets from DigitalOcean's Droplets API. + This service discovery uses the public IPv4 address by default, by that can be changed with relabeling. + See [here](https://docs.victoriametrics.com/sd_configs#digitalocean_sd_configs) + properties: + authorization: + description: Authorization header to use on every scrape request. + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + followRedirects: + description: Configure whether HTTP requests follow HTTP 3xx + redirects. + type: boolean + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 + client id + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret + file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + port: + description: The port to scrape metrics from. + type: integer + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy) + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. + type: string + tlsConfig: + description: TLS configuration to use on every scrape request + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use + for the targets. + type: string + cert: + description: Struct containing the client cert file for + the targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + type: object + type: array + dnsSDConfigs: + description: DNSSDConfigs defines a list of DNS service discovery + configurations. + items: + description: |- + DNSSDConfig allows specifying a set of DNS domain names which are periodically queried to discover a list of targets. + The DNS servers to be contacted are read from /etc/resolv.conf. + See [here](https://docs.victoriametrics.com/sd_configs#dns_sd_configs) + properties: + names: + description: A list of DNS domain names to be queried. + items: + type: string + minItems: 1 + type: array + port: + description: |- + The port number used if the query type is not SRV + Ignored for SRV records + type: integer + type: + enum: + - SRV + - A + - AAAA + - MX + type: string + required: + - names + type: object + type: array + ec2SDConfigs: + description: EC2SDConfigs defines a list of EC2 service discovery + configurations. + items: + description: |- + EC2SDConfig allow retrieving scrape targets from AWS EC2 instances. + The private IP address is used by default, but may be changed to the public IP address with relabeling. + The IAM credentials used must have the ec2:DescribeInstances permission to discover scrape targets. + See [here](https://docs.victoriametrics.com/sd_configs#ec2_sd_configs) + properties: + accessKey: + description: AccessKey is the AWS API key. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + filters: + description: |- + Filters can be used optionally to filter the instance list by other criteria. + Available filter criteria can be found here: + https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html + Filter API documentation: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Filter.html + items: + description: EC2Filter is the configuration for filtering + EC2 instances. + properties: + name: + type: string + values: + items: + type: string + type: array + required: + - name + - values + type: object + type: array + port: + description: |- + The port to scrape metrics from. If using the public IP address, this must + instead be specified in the relabeling rule. + type: integer + region: + description: The AWS region + type: string + roleARN: + description: AWS Role ARN, an alternative to using AWS API keys. + type: string + secretKey: + description: SecretKey is the AWS API secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + type: array + fileSDConfigs: + description: FileSDConfigs defines a list of file service discovery + configurations. + items: + description: |- + FileSDConfig defines a file service discovery configuration. + See [here](https://docs.victoriametrics.com/sd_configs#file_sd_configs) + properties: + files: + description: List of files to be used for file discovery. + items: + type: string + minItems: 1 + type: array + required: + - files + type: object + type: array + follow_redirects: + description: FollowRedirects controls redirects for scraping. + type: boolean + gceSDConfigs: + description: GCESDConfigs defines a list of GCE service discovery + configurations. + items: + description: |- + GCESDConfig configures scrape targets from GCP GCE instances. + The private IP address is used by default, but may be changed to + the public IP address with relabeling. + See [here](https://docs.victoriametrics.com/sd_configs#gce_sd_configs) + + The GCE service discovery will load the Google Cloud credentials + from the file specified by the GOOGLE_APPLICATION_CREDENTIALS environment variable. + See https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform + properties: + filter: + description: |- + Filter can be used optionally to filter the instance list by other criteria + Syntax of this filter is described in the filter query parameter section: + https://cloud.google.com/compute/docs/reference/latest/instances/list + type: string + port: + description: |- + The port to scrape metrics from. If using the public IP address, this must + instead be specified in the relabeling rule. + type: integer + project: + description: The Google Cloud Project ID + minLength: 1 + type: string + tagSeparator: + description: The tag separator is used to separate the tags + on concatenation + type: string + zone: + description: The zone of the scrape targets. If you need multiple + zones use multiple GCESDConfigs. + x-kubernetes-preserve-unknown-fields: true + required: + - project + - zone + type: object + type: array + honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. + type: boolean + honorTimestamps: + description: HonorTimestamps controls whether vmagent respects the + timestamps present in scraped data. + type: boolean + httpSDConfigs: + description: HTTPSDConfigs defines a list of HTTP service discovery + configurations. + items: + description: |- + HTTPSDConfig defines a HTTP service discovery configuration. + See [here](https://docs.victoriametrics.com/sd_configs#http_sd_configs) + properties: + authorization: + description: Authorization header to use on every scrape request. + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + basicAuth: + description: BasicAuth information to use on every scrape request. + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy) + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. + type: string + tlsConfig: + description: TLS configuration to use on every scrape request + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use + for the targets. + type: string + cert: + description: Struct containing the client cert file for + the targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + url: + description: URL from which the targets are fetched. + minLength: 1 + pattern: ^http(s)?://.+$ + type: string + required: + - url + type: object + type: array + interval: + description: Interval at which metrics should be scraped + type: string + kubernetesSDConfigs: + description: KubernetesSDConfigs defines a list of Kubernetes service + discovery configurations. + items: + description: |- + KubernetesSDConfig allows retrieving scrape targets from Kubernetes' REST API. + See [here](https://docs.victoriametrics.com/sd_configs#kubernetes_sd_configs) + properties: + apiServer: + description: |- + The API server address consisting of a hostname or IP address followed + by an optional port number. + If left empty, assuming process is running inside + of the cluster. It will discover API servers automatically and use the pod's + CA certificate and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/. + type: string + attach_metadata: + description: AttachMetadata configures metadata attaching from + service discovery + properties: + node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. + type: boolean + type: object + authorization: + description: Authorization header to use on every scrape request. + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + basicAuth: + description: BasicAuth information to use on every scrape request. + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + followRedirects: + description: Configure whether HTTP requests follow HTTP 3xx + redirects. + type: boolean + namespaces: + description: Optional namespace discovery. If omitted, discover + targets across all namespaces. + properties: + names: + description: |- + List of namespaces where to watch for resources. + If empty and `ownNamespace` isn't true, watch for resources in all namespaces. + items: + type: string + type: array + ownNamespace: + description: Includes the namespace in which the pod exists + to the list of watched namespaces. + type: boolean + type: object + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 + client id + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret + file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See [feature description](https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy) + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. + type: string + role: + description: Role of the Kubernetes entities that should be + discovered. + type: string + selectors: + description: Selector to select objects. + items: + description: K8SSelectorConfig is Kubernetes Selector Config + properties: + field: + type: string + label: + type: string + role: + type: string + required: + - role + type: object + type: array + x-kubernetes-list-map-keys: + - role + x-kubernetes-list-type: map + tlsConfig: + description: TLS configuration to use on every scrape request + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use + for the targets. + type: string + cert: + description: Struct containing the client cert file for + the targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + required: + - role + type: object + type: array + max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped data + for a job + type: string + metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after scrapping. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 client + id + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + openstackSDConfigs: + description: OpenStackSDConfigs defines a list of OpenStack service + discovery configurations. + items: + description: |- + OpenStackSDConfig allow retrieving scrape targets from OpenStack Nova instances. + See [here](https://docs.victoriametrics.com/sd_configs#openstack_sd_configs) + properties: + allTenants: + description: |- + Whether the service discovery should list all instances for all projects. + It is only relevant for the 'instance' role and usually requires admin permissions. + type: boolean + applicationCredentialId: + description: ApplicationCredentialID + type: string + applicationCredentialName: + description: |- + The ApplicationCredentialID or ApplicationCredentialName fields are + required if using an application credential to authenticate. Some providers + allow you to create an application credential to authenticate rather than a + password. + type: string + applicationCredentialSecret: + description: |- + The applicationCredentialSecret field is required if using an application + credential to authenticate. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + availability: + description: Availability of the endpoint to connect to. + enum: + - Public + - public + - Admin + - admin + - Internal + - internal + type: string + domainID: + description: DomainID + type: string + domainName: + description: |- + At most one of domainId and domainName must be provided if using username + with Identity V3. Otherwise, either are optional. + type: string + identityEndpoint: + description: |- + IdentityEndpoint specifies the HTTP endpoint that is required to work with + the Identity API of the appropriate version. + type: string + password: + description: |- + Password for the Identity V2 and V3 APIs. Consult with your provider's + control panel to discover your account's preferred method of authentication. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + port: + description: |- + The port to scrape metrics from. If using the public IP address, this must + instead be specified in the relabeling rule. + type: integer + projectID: + description: ' ProjectID' + type: string + projectName: + description: |- + The ProjectId and ProjectName fields are optional for the Identity V2 API. + Some providers allow you to specify a ProjectName instead of the ProjectId. + Some require both. Your provider's authentication policies will determine + how these fields influence authentication. + type: string + region: + description: The OpenStack Region. + minLength: 1 + type: string + role: + description: The OpenStack role of entities that should be discovered. + enum: + - Instance + - instance + - Hypervisor + - hypervisor + type: string + tlsConfig: + description: TLS configuration to use on every scrape request + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use + for the targets. + type: string + cert: + description: Struct containing the client cert file for + the targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + userid: + description: UserID + type: string + username: + description: |- + Username is required if using Identity V2 API. Consult with your provider's + control panel to discover your account's username. + In Identity V3, either userid or a combination of username + and domainId or domainName are needed + type: string + required: + - region + - role + type: object + type: array + params: + additionalProperties: + items: + type: string + type: array + description: Optional HTTP URL parameters + type: object + path: + description: HTTP path to scrape for metrics. + type: string + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes to + proxy through this endpoint. + type: string + relabelConfigs: + description: RelabelConfigs to apply to samples during service discovery. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. Default + is 'replace' + type: string + if: + description: 'If represents metricsQL match expression (or list + of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 + type: integer + scheme: + description: HTTP scheme to use for scraping. + enum: + - http + - https + - HTTPS + - HTTP + type: string + scrape_interval: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used + type: string + scrapeTimeout: + description: Timeout after which the scrape is ended + type: string + seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 + type: integer + staticConfigs: + description: StaticConfigs defines a list of static targets with a + common label set. + items: + description: |- + StaticConfig defines a static configuration. + See [here](https://docs.victoriametrics.com/sd_configs#static_configs) + properties: + labels: + additionalProperties: + type: string + description: Labels assigned to all metrics scraped from the + targets. + type: object + x-kubernetes-map-type: atomic + targets: + description: List of targets for this static configuration. + items: + type: string + type: array + type: object + type: array + tlsConfig: + description: TLSConfig configuration to use when scraping the endpoint + properties: + ca: + description: Struct containing the CA cert to use for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use for the + targets. + type: string + cert: + description: Struct containing the client cert file for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container for + the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container for + the targets. + type: string + keySecret: + description: Secret containing the client key file for the targets. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific scrape + parameters + properties: + disable_compression: + description: DisableCompression + type: boolean + disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements + type: boolean + headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version + items: + type: string + type: array + no_stale_markers: + type: boolean + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + scrape_align_interval: + type: string + scrape_offset: + type: string + stream_parse: + type: boolean + type: object type: object - x-kubernetes-preserve-unknown-fields: true status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -1672,11 +27335,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -1689,7 +27357,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmservicescrapes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1713,47 +27381,963 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: |- + VMServiceScrape is scrape configuration for endpoints associated with + kubernetes service, + it generates scrape configuration for vmagent based on selectors. + result config will scrape service endpoints properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMServiceScrapeSpec defines the desired state of VMServiceScrape + properties: + attach_metadata: + description: AttachMetadata configures metadata attaching from service + discovery + properties: + node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. + type: boolean + type: object + discoveryRole: + description: |- + DiscoveryRole - defines kubernetes_sd role for objects discovery. + by default, its endpoints. + can be changed to service or endpointslices. + note, that with service setting, you have to use port: "name" + and cannot use targetPort for endpoints. + enum: + - endpoints + - service + - endpointslices + type: string + endpoints: + description: A list of endpoints allowed as part of this ServiceScrape. + items: + description: Endpoint defines a scrapeable endpoint serving metrics. + properties: + attach_metadata: + description: AttachMetadata configures metadata attaching from + service discovery + properties: + node: + description: |- + Node instructs vmagent to add node specific metadata from service discovery + Valid for roles: pod, endpoints, endpointslice. + type: boolean + type: object + authorization: + description: Authorization with http header Authorization + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: File to read bearer token for scraping targets. + type: string + bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. + nullable: true + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + follow_redirects: + description: FollowRedirects controls redirects for scraping. + type: boolean + honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. + type: boolean + honorTimestamps: + description: HonorTimestamps controls whether vmagent respects + the timestamps present in scraped data. + type: boolean + interval: + description: Interval at which metrics should be scraped + type: string + max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped + data for a job + type: string + metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after + scrapping. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 + client id + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret + file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + params: + additionalProperties: + items: + type: string + type: array + description: Optional HTTP URL parameters + type: object + path: + description: HTTP path to scrape for metrics. + type: string + port: + description: Name of the port exposed at Service. + type: string + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. + type: string + relabelConfigs: + description: RelabelConfigs to apply to samples during service + discovery. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + sampleLimit: + description: SampleLimit defines per-scrape limit on number + of scraped samples that will be accepted. + format: int64 + type: integer + scheme: + description: HTTP scheme to use for scraping. + enum: + - http + - https + - HTTPS + - HTTP + type: string + scrape_interval: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used + type: string + scrapeTimeout: + description: Timeout after which the scrape is ended + type: string + seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 + type: integer + targetPort: + anyOf: + - type: integer + - type: string + description: |- + TargetPort + Name or number of the pod port this endpoint refers to. Mutually exclusive with port. + x-kubernetes-int-or-string: true + tlsConfig: + description: TLSConfig configuration to use when scraping the + endpoint + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use + for the targets. + type: string + cert: + description: Struct containing the client cert file for + the targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific + scrape parameters + properties: + disable_compression: + description: DisableCompression + type: boolean + disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements + type: boolean + headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version + items: + type: string + type: array + no_stale_markers: + type: boolean + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + scrape_align_interval: + type: string + scrape_offset: + type: string + stream_parse: + type: boolean + type: object + type: object + type: array + jobLabel: + description: The label to use to retrieve the job name from. + type: string + namespaceSelector: + description: Selector to select which namespaces the Endpoints objects + are discovered from. + properties: + any: + description: |- + Boolean describing whether all namespaces are selected in contrast to a + list restricting them. + type: boolean + matchNames: + description: List of namespace names. + items: + type: string + type: array + type: object + podTargetLabels: + description: PodTargetLabels transfers labels on the Kubernetes Pod + onto the target. + items: + type: string + type: array + sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 + type: integer + selector: + description: Selector to select Endpoints objects by corresponding + Service labels. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 + type: integer + targetLabels: + description: TargetLabels transfers labels on the Kubernetes Service + onto the target. + items: + type: string + type: array required: - endpoints type: object - x-kubernetes-preserve-unknown-fields: true status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -1768,11 +28352,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object required: @@ -1787,7 +28376,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmsingles.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1809,45 +28398,1833 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMSingle is fast, cost-effective and scalable time-series database. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMSingleSpec defines the desired state of VMSingle + properties: + affinity: + description: Affinity If specified, the pod's scheduling constraints. + type: object + x-kubernetes-preserve-unknown-fields: true + configMaps: + description: |- + ConfigMaps is a list of ConfigMaps in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/configs/CONFIGMAP_NAME folder + items: + type: string + type: array + containers: + description: |- + Containers property allows to inject additions sidecars or to patch existing containers. + It can be useful for proxies, backup, etc. + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + disableAutomountServiceAccountToken: + description: |- + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. + For example, vmagent and vm-config-reloader requires k8s API access. + Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. + And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. + type: boolean + disableSelfServiceScrape: + description: |- + DisableSelfServiceScrape controls creation of VMServiceScrape by operator + for the application. + Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + items: + x-kubernetes-preserve-unknown-fields: true + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + dnsPolicy: + description: DNSPolicy sets DNS policy for the pod + type: string + extraArgs: + additionalProperties: + type: string + description: |- + ExtraArgs that will be passed to the application container + for example remoteWrite.tmpDataPath: /tmp + type: object + extraEnvs: + description: ExtraEnvs that will be passed to the application container + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key in + the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + host_aliases: + description: |- + HostAliasesUnderScore provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + Has Priority over hostAliases field + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostAliases: + description: |- + HostAliases provides mapping for ip and hostname, + that would be propagated to pod, + cannot be used with HostNetwork. + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + required: + - ip + type: object + type: array + hostNetwork: + description: HostNetwork controls whether the pod may use the node + network namespace + type: boolean + image: + description: |- + Image - docker image settings + if no specified operator uses default version from operator config + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's repository + if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + imagePullSecrets: + description: |- + ImagePullSecrets An optional list of references to secrets in the same namespace + to use for pulling images from registries + see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: |- + InitContainers allows adding initContainers to the pod definition. + Any errors during the execution of an initContainer will lead to a restart of the Pod. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + items: + description: A single application container that you want to run + within a pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + insertPorts: + description: InsertPorts - additional listen ports for data ingestion. + properties: + graphitePort: + description: GraphitePort listen port + type: string + influxPort: + description: InfluxPort listen port + type: string + openTSDBHTTPPort: + description: OpenTSDBHTTPPort for http connections. + type: string + openTSDBPort: + description: OpenTSDBPort for tcp and udp listen + type: string + type: object + license: + description: |- + License allows to configure license key to be used for enterprise features. + Using license key is supported starting from VictoriaMetrics v1.94.0. + See [here](https://docs.victoriametrics.com/enterprise) + properties: + forceOffline: + description: Enforce offline verification of the license key. + type: boolean + key: + description: |- + Enterprise license key. This flag is available only in [VictoriaMetrics enterprise](https://docs.victoriametrics.com/enterprise). + To request a trial license, [go to](https://victoriametrics.com/products/enterprise/trial) + type: string + keyRef: + description: KeyRef is reference to secret with license key for + enterprise features. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + reloadInterval: + description: Interval to be used for checking for license key + changes. Note that this is only applicable when using KeyRef. + type: string + type: object + livenessProbe: + description: LivenessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + logFormat: + description: LogFormat for VMSingle to be configured with. + enum: + - default + - json + type: string + logLevel: + description: LogLevel for victoria metrics single to be configured + with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + managedMetadata: + description: |- + ManagedMetadata defines metadata that will be added to the all objects + created by operator for the given CustomResource + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + type: object + minReadySeconds: + description: |- + MinReadySeconds defines a minimum number of seconds to wait before starting update next pod + if previous in healthy state + Has no effect for VLogs and VMSingle + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: NodeSelector Define which Nodes the Pods are scheduled + on. + type: object + paused: + description: |- + Paused If set to true all actions on the underlying managed objects are not + going to be performed, except for delete actions. + type: boolean + podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the VMSingle pods. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + port: + description: Port listen address + type: string + priorityClassName: + description: PriorityClassName class assigned to the Pods + type: string + readinessGates: + description: ReadinessGates defines pod readiness gates + items: + description: PodReadinessGate contains the reference to a pod condition + properties: + conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. + type: string + required: + - conditionType + type: object + type: array + readinessProbe: + description: ReadinessProbe that will be added CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + removePvcAfterDelete: + description: |- + RemovePvcAfterDelete - if true, controller adds ownership to pvc + and after VMSingle object deletion - pvc will be garbage collected + by controller manager + type: boolean + replicaCount: + description: ReplicaCount is the expected size of the Application. + format: int32 + type: integer + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + retentionPeriod: + description: |- + RetentionPeriod for the stored metrics + Note VictoriaMetrics has data/ and indexdb/ folders + metrics from data/ removed eventually as soon as partition leaves retention period + reverse index data at indexdb rotates once at the half of configured [retention period](https://docs.victoriametrics.com/Single-server-VictoriaMetrics/#retention) + type: string + revisionHistoryLimitCount: + description: |- + The number of old ReplicaSets to retain to allow rollback in deployment or + maximum number of revisions that will be maintained in the Deployment revision history. + Has no effect at StatefulSets + Defaults to 10. + format: int32 + type: integer + runtimeClassName: + description: |- + RuntimeClassName - defines runtime class for kubernetes pod. + https://kubernetes.io/docs/concepts/containers/runtime-class/ + type: string + schedulerName: + description: SchedulerName - defines kubernetes scheduler name + type: string + secrets: + description: |- + Secrets is a list of Secrets in the same namespace as the Application + object, which shall be mounted into the Application container + at /etc/vm/secrets/SECRET_NAME folder + items: + type: string + type: array + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + This defaults to the default PodSecurityContext. + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the pods + type: string + serviceScrapeSpec: + description: ServiceScrapeSpec that will be added to vmsingle VMServiceScrape + spec + required: + - endpoints + type: object + x-kubernetes-preserve-unknown-fields: true + serviceSpec: + description: ServiceSpec that will be added to vmsingle service spec + properties: + metadata: + description: EmbeddedObjectMetadata defines objectMeta for additional + service. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + ServiceSpec describes the attributes that a user creates on a service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-preserve-unknown-fields: true + useAsDefault: + description: |- + UseAsDefault applies changes from given service definition to the main object Service + Changing from headless service to clusterIP or loadbalancer may break cross-component communication + type: boolean + required: + - spec + type: object + startupProbe: + description: StartupProbe that will be added to CRD pod + type: object + x-kubernetes-preserve-unknown-fields: true + storage: + description: |- + Storage is the definition of how storage will be used by the VMSingle + by default it`s empty dir + this option is ignored if storageDataPath is set + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes to consider + for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the PersistentVolume + backing this claim. + type: string + type: object + storageDataPath: + description: |- + StorageDataPath disables spec.storage option and overrides arg for victoria-metrics binary --storageDataPath, + its users responsibility to mount proper device into given path. + It requires to provide spec.volumes and spec.volumeMounts with at least 1 value + type: string + storageMetadata: + description: StorageMeta defines annotations and labels attached to + PVC for given vmsingle CR + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + streamAggrConfig: + description: StreamAggrConfig defines stream aggregation configuration + for VMSingle + properties: + configmap: + description: ConfigMap with stream aggregation rules + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + dedupInterval: + description: Allows setting different de-duplication intervals + per each configured remote storage + type: string + dropInput: + description: Allow drop all the input samples after the aggregation + type: boolean + dropInputLabels: + description: labels to drop from samples for aggregator before + stream de-duplication and aggregation + items: + type: string + type: array + enableWindows: + description: EnableWindows enables aggregating data in separate + windows ( available from v0.54.0). + type: boolean + ignoreFirstIntervals: + description: IgnoreFirstIntervals instructs to ignore first interval + type: integer + ignoreOldSamples: + description: IgnoreOldSamples instructs to ignore samples with + old timestamps outside the current aggregation interval. + type: boolean + keepInput: + description: Allows writing both raw and aggregate data + type: boolean + rules: + description: Stream aggregation rules + items: + description: StreamAggrRule defines the rule in stream aggregation + config + properties: + by: + description: |- + By is an optional list of labels for grouping input series. + + See also Without. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. + items: + type: string + type: array + dedup_interval: + description: DedupInterval is an optional interval for deduplication. + type: string + drop_input_labels: + description: |- + DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples. + + Labels are dropped before de-duplication and aggregation. + items: + type: string + type: array + enable_windows: + description: EnableWindows enables aggregating data in separate + windows + type: boolean + flush_on_shutdown: + description: |- + FlushOnShutdown defines whether to flush the aggregation state on process termination + or config reload. Is `false` by default. + It is not recommended changing this setting, unless unfinished aggregations states + are preferred to missing data points. + type: boolean + ignore_first_intervals: + type: integer + ignore_old_samples: + description: IgnoreOldSamples instructs to ignore samples + with old timestamps outside the current aggregation interval. + type: boolean + input_relabel_configs: + description: |- + InputRelabelConfigs is an optional relabeling rules, which are applied on the input + before aggregation. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for + `action: graphite`' + type: object + match: + description: 'Match is used together with Labels for + `action: graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated + source label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + interval: + description: Interval is the interval between aggregations. + type: string + keep_metric_names: + description: KeepMetricNames instructs to leave metric names + as is for the output time series without adding any suffix. + type: boolean + match: + description: |- + Match is a label selector (or list of label selectors) for filtering time series for the given selector. + + If the match isn't set, then all the input time series are processed. + x-kubernetes-preserve-unknown-fields: true + no_align_flush_to_interval: + description: |- + NoAlignFlushToInterval disables aligning of flushes to multiples of Interval. + By default flushes are aligned to Interval. + type: boolean + output_relabel_configs: + description: |- + OutputRelabelConfigs is an optional relabeling rules, which are applied + on the aggregated output before being sent to remote storage. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for + `action: graphite`' + type: object + match: + description: 'Match is used together with Labels for + `action: graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated + source label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + outputs: + description: |- + Outputs is a list of output aggregate functions to produce. + + The following names are allowed: + + - total - aggregates input counters + - increase - counts the increase over input counters + - count_series - counts the input series + - count_samples - counts the input samples + - sum_samples - sums the input samples + - last - the last biggest sample value + - min - the minimum sample value + - max - the maximum sample value + - avg - the average value across all the samples + - stddev - standard deviation across all the samples + - stdvar - standard variance across all the samples + - histogram_bucket - creates VictoriaMetrics histogram for input samples + - quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1] + + The output time series will have the following names: + + input_name:aggr__ + items: + type: string + type: array + staleness_interval: + description: |- + Staleness interval is interval after which the series state will be reset if no samples have been sent during it. + The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket. + type: string + without: + description: |- + Without is an optional list of labels, which must be excluded when grouping input series. + + See also By. + + If neither By nor Without are set, then the Outputs are calculated + individually per each input time series. + items: + type: string + type: array + required: + - interval + - outputs + type: object + type: array + type: object + terminationGracePeriodSeconds: + description: TerminationGracePeriodSeconds period for container graceful + termination + format: int64 + type: integer + tolerations: + description: Tolerations If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + TopologySpreadConstraints embedded kubernetes pod configuration option, + controls how pods are spread across your cluster among failure-domains + such as regions, zones, nodes, and other user-defined topology domains + https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + useDefaultResources: + description: |- + UseDefaultResources controls resource settings + By default, operator sets built-in resource requirements + type: boolean + useStrictSecurity: + description: |- + UseStrictSecurity enables strict security mode for component + it restricts disk writes access + uses non-root user out of the box + drops not needed security permissions + type: boolean + vmBackup: + description: VMBackup configuration for backup + properties: + acceptEULA: + description: |- + AcceptEULA accepts enterprise feature usage, must be set to true. + otherwise backupmanager cannot be added to single/cluster version. + https://victoriametrics.com/legal/esa/ + type: boolean + concurrency: + description: Defines number of concurrent workers. Higher concurrency + may reduce backup duration (default 10) + format: int32 + type: integer + credentialsSecret: + description: |- + CredentialsSecret is secret in the same namespace for access to remote storage + The secret is mounted into /etc/vm/creds. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + customS3Endpoint: + description: Custom S3 endpoint for use with S3-compatible storages + (e.g. MinIO). S3 is used if not set + type: string + destination: + description: Defines destination for backup + type: string + destinationDisableSuffixAdd: + description: |- + DestinationDisableSuffixAdd - disables suffix adding for cluster version backups + each vmstorage backup must have unique backup folder + so operator adds POD_NAME as suffix for backup destination folder. + type: boolean + disableDaily: + description: Defines if daily backups disabled (default false) + type: boolean + disableHourly: + description: Defines if hourly backups disabled (default false) + type: boolean + disableMonthly: + description: Defines if monthly backups disabled (default false) + type: boolean + disableWeekly: + description: Defines if weekly backups disabled (default false) + type: boolean + extraArgs: + additionalProperties: + type: string + description: extra args like maxBytesPerSecond default 0 + type: object + extraEnvs: + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + extraEnvsFrom: + description: |- + ExtraEnvsFrom defines source of env variables for the application container + could either be secret or configmap + items: + description: EnvFromSource represents the source of a set of + ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each key + in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + description: Image - docker image settings for VMBackuper + properties: + pullPolicy: + description: PullPolicy describes how to pull docker image + type: string + repository: + description: Repository contains name of docker image + it's + repository if needed + type: string + tag: + description: Tag contains desired docker image version + type: string + type: object + logFormat: + description: |- + LogFormat for VMBackup to be configured with. + default or json + enum: + - default + - json + type: string + logLevel: + description: LogLevel for VMBackup to be configured with. + enum: + - INFO + - WARN + - ERROR + - FATAL + - PANIC + type: string + port: + description: Port for health check connections + type: string + resources: + description: |- + Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + if not defined default resources from operator config will be used + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + restore: + description: |- + Restore Allows to enable restore options for pod + Read [more](https://docs.victoriametrics.com/vmbackupmanager#restore-commands) + properties: + onStart: + description: OnStart defines configuration for restore on + pod start + properties: + enabled: + description: Enabled defines if restore on start enabled + type: boolean + type: object + type: object + snapshotCreateURL: + description: SnapshotCreateURL overwrites url for snapshot create + type: string + snapshotDeleteURL: + description: SnapShotDeleteURL overwrites url for snapshot delete + type: string + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment definition. + VolumeMounts specified will be appended to other VolumeMounts in the vmbackupmanager container, + that are generated as a result of StorageSpec objects. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + type: object + volumeMounts: + description: |- + VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. + VolumeMounts specified will be appended to other VolumeMounts in the Application container + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. + Volumes specified will be appended to other volumes that are generated. + / +optional + items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. + required: + - name + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + required: + - retentionPeriod type: object - x-kubernetes-preserve-unknown-fields: true status: + description: VMSingleStatus defines the observed state of VMSingle properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -1862,11 +30239,20 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason + type: string + singleStatus: + description: LegacyStatus is deprecated and will be removed at v0.52.0 + version type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -1879,7 +30265,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmstaticscrapes.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1903,47 +30289,855 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMStaticScrape defines static targets configuration for scraping. properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMStaticScrapeSpec defines the desired state of VMStaticScrape. + properties: + jobName: + description: JobName name of job. + type: string + sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 + type: integer + seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 + type: integer + targetEndpoints: + description: A list of target endpoints to scrape metrics from. + items: + description: TargetEndpoint defines single static target endpoint. + properties: + authorization: + description: Authorization with http header Authorization + properties: + credentials: + description: Reference to the secret with value for authorization + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File with value for authorization + type: string + type: + description: Type of authorization, default to bearer + type: string + type: object + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: File to read bearer token for scraping targets. + type: string + bearerTokenSecret: + description: |- + Secret to mount to read bearer token for scraping targets. The secret + needs to be in the same namespace as the scrape object and accessible by + the victoria-metrics operator. + nullable: true + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + follow_redirects: + description: FollowRedirects controls redirects for scraping. + type: boolean + honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. + type: boolean + honorTimestamps: + description: HonorTimestamps controls whether vmagent respects + the timestamps present in scraped data. + type: boolean + interval: + description: Interval at which metrics should be scraped + type: string + labels: + additionalProperties: + type: string + description: Labels static labels for targets. + type: object + max_scrape_size: + description: MaxScrapeSize defines a maximum size of scraped + data for a job + type: string + metricRelabelConfigs: + description: MetricRelabelConfigs to apply to samples after + scrapping. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + oauth2: + description: OAuth2 defines auth configuration + properties: + client_id: + description: The secret or configmap containing the OAuth2 + client id + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + client_secret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + client_secret_file: + description: ClientSecretFile defines path for client secret + file. + type: string + endpoint_params: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + proxy_url: + description: |- + The proxy URL for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + type: string + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tls_config: + description: |- + TLSConfig for token_url connection + ( available from v0.55.0). + Is only supported by Scrape objects family + x-kubernetes-preserve-unknown-fields: true + token_url: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - client_id + - token_url + type: object + params: + additionalProperties: + items: + type: string + type: array + description: Optional HTTP URL parameters + type: object + path: + description: HTTP path to scrape for metrics. + type: string + proxyURL: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. + type: string + relabelConfigs: + description: RelabelConfigs to apply to samples during service + discovery. + items: + description: |- + RelabelConfig allows dynamic rewriting of the label set + More info: https://docs.victoriametrics.com/#relabeling + properties: + action: + description: Action to perform based on regex matching. + Default is 'replace' + type: string + if: + description: 'If represents metricsQL match expression + (or list of expressions): ''{__name__=~"foo_.*"}''' + x-kubernetes-preserve-unknown-fields: true + labels: + additionalProperties: + type: string + description: 'Labels is used together with Match for `action: + graphite`' + type: object + match: + description: 'Match is used together with Labels for `action: + graphite`' + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: |- + Regular expression against which the extracted value is matched. Default is '(.*)' + victoriaMetrics supports multiline regex joined with | + https://docs.victoriametrics.com/vmagent/#relabeling-enhancements + x-kubernetes-preserve-unknown-fields: true + replacement: + description: |- + Replacement value against which a regex replace is performed if the + regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + source_labels: + description: |- + UnderScoreSourceLabels - additional form of source labels source_labels + for compatibility with original relabel config. + if set both sourceLabels and source_labels, sourceLabels has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + items: + type: string + type: array + sourceLabels: + description: |- + The source labels select values from existing labels. Their content is concatenated + using the configured separator and matched against the configured regular expression + for the replace, keep, and drop actions. + items: + type: string + type: array + target_label: + description: |- + UnderScoreTargetLabel - additional form of target label - target_label + for compatibility with original relabel config. + if set both targetLabel and target_label, targetLabel has priority. + for details https://github.com/VictoriaMetrics/operator/issues/131 + type: string + targetLabel: + description: |- + Label to which the resulting value is written in a replace action. + It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + sampleLimit: + description: SampleLimit defines per-scrape limit on number + of scraped samples that will be accepted. + format: int64 + type: integer + scheme: + description: HTTP scheme to use for scraping. + enum: + - http + - https + - HTTPS + - HTTP + type: string + scrape_interval: + description: |- + ScrapeInterval is the same as Interval and has priority over it. + one of scrape_interval or interval can be used + type: string + scrapeTimeout: + description: Timeout after which the scrape is ended + type: string + seriesLimit: + description: |- + SeriesLimit defines per-scrape limit on number of unique time series + a single target can expose during all the scrapes on the time window of 24h. + format: int64 + type: integer + targets: + description: Targets static targets addresses in form of ["192.122.55.55:9100","some-name:9100"]. + items: + type: string + minItems: 1 + type: array + tlsConfig: + description: TLSConfig configuration to use when scraping the + endpoint + properties: + ca: + description: Struct containing the CA cert to use for the + targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use + for the targets. + type: string + cert: + description: Struct containing the client cert file for + the targets. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container + for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container + for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + vm_scrape_params: + description: VMScrapeParams defines VictoriaMetrics specific + scrape parameters + properties: + disable_compression: + description: DisableCompression + type: boolean + disable_keep_alive: + description: |- + disable_keepalive allows disabling HTTP keep-alive when scraping targets. + By default, HTTP keep-alive is enabled, so TCP connections to scrape targets + could be reused. + See https://docs.victoriametrics.com/vmagent#scrape_config-enhancements + type: boolean + headers: + description: |- + Headers allows sending custom headers to scrape targets + must be in of semicolon separated header with it's value + eg: + headerName: headerValue + vmagent supports since 1.79.0 version + items: + type: string + type: array + no_stale_markers: + type: boolean + proxy_client_config: + description: |- + ProxyClientConfig configures proxy auth settings for scraping + See feature description https://docs.victoriametrics.com/vmagent#scraping-targets-via-a-proxy + properties: + basic_auth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication + properties: + password: + description: |- + Password defines reference for secret with password value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + password_file: + description: |- + PasswordFile defines path to password file at disk + must be pre-mounted + type: string + username: + description: |- + Username defines reference for secret with username value + The secret needs to be in the same namespace as scrape object + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearer_token: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + bearer_token_file: + type: string + tls_config: + x-kubernetes-preserve-unknown-fields: true + type: object + scrape_align_interval: + type: string + scrape_offset: + type: string + stream_parse: + type: boolean + type: object + required: + - targets + type: object + type: array required: - targetEndpoints type: object - x-kubernetes-preserve-unknown-fields: true status: + description: ScrapeObjectStatus defines the observed state of ScrapeObjects properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -1958,11 +31152,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object @@ -1975,7 +31174,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.17.2 name: vmusers.operator.victoriametrics.com spec: group: operator.victoriametrics.com @@ -1999,243 +31198,582 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: VMUser is the Schema for the vmusers API properties: apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: + description: VMUserSpec defines the desired state of VMUser + properties: + bearerToken: + description: BearerToken Authorization header value for accessing + protected endpoint. + type: string + default_url: + description: |- + DefaultURLs backend url for non-matching paths filter + usually used for default backend with error message + items: + type: string + type: array + disable_secret_creation: + description: DisableSecretCreation skips related secret creation for + vmuser + type: boolean + discover_backend_ips: + description: DiscoverBackendIPs instructs discovering URLPrefix backend + IPs via DNS. + type: boolean + drop_src_path_prefix_parts: + description: |- + DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend. + See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details. + type: integer + dump_request_on_errors: + description: |- + DumpRequestOnErrors instructs vmauth to return detailed request params to the client + if routing rules don't allow to forward request to the backends. + Useful for debugging `src_hosts` and `src_headers` based routing rules + + available since v1.107.0 vmauth version + type: boolean + generatePassword: + description: |- + GeneratePassword instructs operator to generate password for user + if spec.password if empty. + type: boolean + headers: + description: |- + Headers represent additional http headers, that vmauth uses + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.68.0 version of vmauth + items: + type: string + type: array + ip_filters: + description: |- + IPFilters defines per target src ip filters + supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/vmauth/#ip-filters) + properties: + allow_list: + items: + type: string + type: array + deny_list: + items: + type: string + type: array + type: object + load_balancing_policy: + description: |- + LoadBalancingPolicy defines load balancing policy to use for backend urls. + Supported policies: least_loaded, first_available. + See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded") + enum: + - least_loaded + - first_available + type: string + max_concurrent_requests: + description: |- + MaxConcurrentRequests defines max concurrent requests per user + 300 is default value for vmauth + type: integer + metric_labels: + additionalProperties: + type: string + description: MetricLabels - additional labels for metrics exported + by vmauth for given user. + type: object + name: + description: Name of the VMUser object. + type: string + password: + description: Password basic auth password for accessing protected + endpoint. + type: string + passwordRef: + description: PasswordRef allows fetching password from user-create + secret by its name and key. + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + response_headers: + description: |- + ResponseHeaders represent additional http headers, that vmauth adds for request response + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.93.0 version of vmauth + items: + type: string + type: array + retry_status_codes: + description: |- + RetryStatusCodes defines http status codes in numeric format for request retries + e.g. [429,503] + items: + type: integer + type: array + targetRefs: + description: TargetRefs - reference to endpoints, which user may access. + items: + description: |- + TargetRef describes target for user traffic forwarding. + one of target types can be chosen: + crd or static per targetRef. + user can define multiple targetRefs with different ref Types. + properties: + crd: + description: |- + CRD describes exist operator's CRD object, + operator generates access url based on CRD params. + properties: + kind: + description: |- + Kind one of: + VMAgent,VMAlert, VMSingle, VMCluster/vmselect, VMCluster/vmstorage,VMCluster/vminsert or VMAlertManager + enum: + - VMAgent + - VMAlert + - VMSingle + - VLogs + - VMAlertManager + - VMAlertmanager + - VMCluster/vmselect + - VMCluster/vmstorage + - VMCluster/vminsert + type: string + name: + description: Name target CRD object name + type: string + namespace: + description: Namespace target CRD object namespace. + type: string + required: + - kind + - name + - namespace + type: object + discover_backend_ips: + description: DiscoverBackendIPs instructs discovering URLPrefix + backend IPs via DNS. + type: boolean + drop_src_path_prefix_parts: + description: |- + DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend. + See [here](https://docs.victoriametrics.com/vmauth#dropping-request-path-prefix) for more details. + type: integer + headers: + description: |- + RequestHeaders represent additional http headers, that vmauth uses + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.68.0 version of vmauth + items: + type: string + type: array + hosts: + items: + type: string + type: array + load_balancing_policy: + description: |- + LoadBalancingPolicy defines load balancing policy to use for backend urls. + Supported policies: least_loaded, first_available. + See [here](https://docs.victoriametrics.com/vmauth#load-balancing) for more details (default "least_loaded") + enum: + - least_loaded + - first_available + type: string + paths: + description: Paths - matched path to route. + items: + type: string + type: array + response_headers: + description: |- + ResponseHeaders represent additional http headers, that vmauth adds for request response + in form of ["header_key: header_value"] + multiple values for header key: + ["header_key: value1,value2"] + it's available since 1.93.0 version of vmauth + items: + type: string + type: array + retry_status_codes: + description: |- + RetryStatusCodes defines http status codes in numeric format for request retries + Can be defined per target or at VMUser.spec level + e.g. [429,503] + items: + type: integer + type: array + src_headers: + description: SrcHeaders is an optional list of headers, which + must match request headers. + items: + type: string + type: array + src_query_args: + description: SrcQueryArgs is an optional list of query args, + which must match request URL query args. + items: + type: string + type: array + static: + description: |- + Static - user defined url for traffic forward, + for instance http://vmsingle:8429 + properties: + url: + description: URL http url for given staticRef. + type: string + urls: + description: URLs allows setting multiple urls for load-balancing + at vmauth-side. + items: + type: string + type: array + type: object + target_path_suffix: + description: |- + TargetPathSuffix allows to add some suffix to the target path + It allows to hide tenant configuration from user with crd as ref. + it also may contain any url encoded params. + type: string + targetRefBasicAuth: + description: TargetRefBasicAuth allow an target endpoint to + authenticate over basic authentication + properties: + password: + description: |- + The secret in the service scrape namespace that contains the password + for authentication. + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: |- + The secret in the service scrape namespace that contains the username + for authentication. + It must be at them same namespace as CRD + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + required: + - password + - username + type: object + type: object + type: array + tlsConfig: + description: TLSConfig defines tls configuration for the backend connection + properties: + ca: + description: Struct containing the CA cert to use for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the container to use for the + targets. + type: string + cert: + description: Struct containing the client cert file for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the container for + the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the container for + the targets. + type: string + keySecret: + description: Secret containing the client key file for the targets. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + tokenRef: + description: TokenRef allows fetching token from user-created secrets + by its name and key. + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: |- + UserName basic auth user name for accessing protected endpoint, + will be replaced with metadata.name of VMUser if omitted. + type: string required: - targetRefs type: object - x-kubernetes-preserve-unknown-fields: true - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vtclusters.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VTCluster - listKind: VTClusterList - plural: vtclusters - singular: vtcluster - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: replicas of VTInsert - jsonPath: .spec.insert.replicaCount - name: Insert Count - type: string - - description: replicas of VTStorage - jsonPath: .spec.storage.replicaCount - name: Storage Count - type: string - - description: replicas of VTSelect - jsonPath: .spec.select.replicaCount - name: Select Count - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Current status of cluster - jsonPath: .status.updateStatus - name: Status - type: string - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - status: - properties: - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - lastUpdateTime: - format: date-time - type: string - message: - maxLength: 32768 - type: string - observedGeneration: - format: int64 - minimum: 0 - type: integer - reason: - maxLength: 1024 - minLength: 1 - type: string - status: - enum: - - "True" - - "False" - - Unknown - type: string - type: - maxLength: 316 - type: string - required: - - lastTransitionTime - - lastUpdateTime - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - observedGeneration: - format: int64 - type: integer - reason: - type: string - updateStatus: - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.20.0 - name: vtsingles.operator.victoriametrics.com -spec: - group: operator.victoriametrics.com - names: - kind: VTSingle - listKind: VTSingleList - plural: vtsingles - singular: vtsingle - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: Current status of traces instance update process - jsonPath: .status.status - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - type: object - x-kubernetes-preserve-unknown-fields: true status: + description: VMUserStatus defines the observed state of VMUser properties: conditions: + description: 'Known .status.conditions.type are: "Available", "Progressing", + and "Degraded"' items: + description: Condition defines status condition of the resource properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. format: date-time type: string lastUpdateTime: + description: |- + LastUpdateTime is the last time of given type update. + This value is used for status TTL update and removal format: date-time type: string message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 type: string status: + description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: + description: Type of condition in CamelCase or in name.namespace.resource.victoriametrics.com/CamelCase. maxLength: 316 type: string required: @@ -2250,11 +31788,16 @@ spec: - type x-kubernetes-list-type: map observedGeneration: + description: |- + ObservedGeneration defines current generation picked by operator for the + reconcile format: int64 type: integer reason: + description: Reason defines human readable error reason type: string updateStatus: + description: UpdateStatus defines a status for update rollout type: string type: object type: object diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/NOTES.txt b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/NOTES.txt index 41f39937..7fb3fbd9 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/NOTES.txt +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/NOTES.txt @@ -1,5 +1,5 @@ {{ include "vm.name" . }} has been installed. Check its status by running: - kubectl --namespace {{ include "vm.namespace" . }} get pods -l "app.kubernetes.io/name={{ include "vm.name" . }}" -l "app.kubernetes.io/instance={{ include "vm.release" . }}" + kubectl --namespace {{ include "vm.namespace" . }} get pods -l "app.kubernetes.io/instance={{ $.Release.Name }}" Get more information on https://github.com/VictoriaMetrics/helm-charts/tree/master/charts/victoria-metrics-operator. See "Getting started guide for VM Operator" on https://docs.victoriametrics.com/guides/getting-started-with-vm-operator diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/_helpers.tpl b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/_helpers.tpl index 8abc83f6..d1215342 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/_helpers.tpl +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/_helpers.tpl @@ -34,7 +34,7 @@ caCert: {{ index $secret.data "ca.crt" }} clientCert: {{ index $secret.data "tls.crt" }} clientKey: {{ index $secret.data "tls.key" }} {{- else -}} -{{- $altNames := list -}} +{{- $altNames := default list -}} {{- $namePrefix := (printf "%s.%s" $fullname (include "vm.namespace" .)) -}} {{- $altNames = append $altNames $namePrefix -}} {{- $altNames = append $altNames (printf "%s.svc" $namePrefix) -}} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/cleanup.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/cleanup.yaml index 4776ee99..d6f4c58f 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/cleanup.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/cleanup.yaml @@ -1,7 +1,7 @@ -{{- if .Values.crds.cleanup.enabled }} +{{- if and .Values.crds.enabled .Values.crds.cleanup.enabled }} {{- $app := .Values.crds.cleanup }} {{- if empty ($app.image).tag }} - {{- $tag := regexSplit "[+-]" .Capabilities.KubeVersion.Version -1 | first -}} + {{- $tag := (printf "%s.%s" .Capabilities.KubeVersion.Major .Capabilities.KubeVersion.Minor) | replace "+" "" -}} {{- $_ := set $app.image "tag" $tag }} {{- else if not (kindIs "string" ($app.image).tag) }} {{- fail "`crd.cleanup.image.tag` is not string, most probably you need to enquote provided value" -}} @@ -33,20 +33,9 @@ spec: image: {{ include "vm.image" $ctx }} imagePullPolicy: {{ $app.image.pullPolicy }} resources: {{ toYaml $app.resources | nindent 12 }} - {{- if .Values.securityContext.enabled }} - securityContext: {{ include "vm.securityContext" (dict "securityContext" .Values.securityContext "helm" .) | nindent 12 }} - {{- end }} - {{- $names := list }} - {{- $crds := .Files.Get "crd.yaml" | splitList "---" }} - {{- range $crds }} - {{- $crd := . | fromYaml }} - {{- $names = append $names $crd.spec.names.singular }} - {{- end }} - command: - - kubectl args: - delete - - {{ $names | sortAlpha | join "," }} + - {{ (keys .Values.admissionWebhooks.enabledCRDValidation) | sortAlpha | join "," }} - --all - --ignore-not-found=true restartPolicy: OnFailure diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crb.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crb.yaml index 9bf378ab..78327074 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crb.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crb.yaml @@ -21,7 +21,7 @@ roleRef: name: {{ $fullname }} apiGroup: rbac.authorization.k8s.io {{- end -}} -{{- if .Values.crds.cleanup.enabled }} +{{- if and .Values.crds.enabled .Values.crds.cleanup.enabled }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crd.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crd.yaml index d5cb31b6..d5bf4b77 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crd.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crd.yaml @@ -8,8 +8,9 @@ {{- if and (not .Values.crds.plain) .Values.crds.enabled }} {{- $files := .Files }} {{- $crds := $files.Get "crd.yaml" | splitList "---" }} + {{- $labels := (include "vm.labels" $ctx) | fromYaml -}} {{- $annotations := mergeOverwrite ((include "vm-operator.crds.annotations" .) | fromYaml) .Values.crds.annotations -}} - {{- $extra := dict "metadata" (dict "annotations" $annotations) -}} + {{- $extra := dict "metadata" (dict "annotations" $annotations "labels" $labels) -}} {{- range $crds }} {{- $crd := merge (fromYaml .) $extra }} {{- range $attrKey, $attrValue := $crd }} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/deployment.yaml similarity index 89% rename from packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml rename to packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/deployment.yaml index 9d7fd7ed..b247f393 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/server.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/deployment.yaml @@ -1,10 +1,6 @@ {{- $ctx := dict "helm" . "noEnterprise" true }} {{- $fullname := include "vm.plain.fullname" $ctx }} {{- $ns := include "vm.namespace" $ctx }} -{{- $env := dict -}} -{{- range .Values.env | default list -}} - {{- $_ := set $env .name .value -}} -{{- end -}} --- apiVersion: apps/v1 kind: Deployment @@ -18,12 +14,9 @@ metadata: annotations: {{ toYaml . | nindent 4 }} {{- end }} spec: - replicas: {{ .Values.replicaCount }} + replicas: {{.Values.replicaCount }} selector: matchLabels: {{ include "vm.selectorLabels" $ctx | nindent 6 }} - {{- with .Values.strategy }} - strategy: {{ toYaml . | nindent 4 }} - {{- end }} template: metadata: {{- with .Values.annotations }} @@ -40,9 +33,6 @@ spec: {{- if .Values.hostNetwork }} hostNetwork: true {{- end }} - {{- if .Values.shareProcessNamespace }} - shareProcessNamespace: true - {{- end }} {{- if or (.Values.serviceAccount).name (.Values.serviceAccount).create }} serviceAccountName: {{ (.Values.serviceAccount).name | default $fullname }} {{- end }} @@ -71,15 +61,9 @@ spec: fieldPath: metadata.name - name: OPERATOR_NAME value: {{ .Chart.Name }} - {{- with (((.Values).global).image).registry }} - - name: VM_CONTAINERREGISTRY - value: {{ quote . }} - {{- end -}} - {{- if not (empty (.Values.configReloader).image) }} - - name: VM_CONFIG_RELOADER_IMAGE - {{- $_ := set $ctx "appKey" (list "configReloader") }} - value: {{ include "vm.image" $ctx }} - {{- $_ := unset $ctx "appKey" }} + {{- if .Values.operator.useCustomConfigReloader }} + - name: VM_USECUSTOMCONFIGRELOADER + value: "true" {{- end }} {{- if .Values.operator.disable_prometheus_converter }} - name: VM_ENABLEDPROMETHEUSCONVERTER_PODMONITOR @@ -97,7 +81,7 @@ spec: value: "true" {{- end }} - name: VM_ENABLEDPROMETHEUSCONVERTEROWNERREFERENCES - value: {{ .Values.operator.enable_converter_ownership | quote}} + value: {{.Values.operator.enable_converter_ownership | quote}} args: - --zap-log-level={{ .Values.logLevel }} - --leader-elect diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/pdb.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/pdb.yaml index 9ec3c2c2..8abd9dea 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/pdb.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/pdb.yaml @@ -18,9 +18,6 @@ spec: {{- with $pdb.maxUnavailable }} maxUnavailable: {{ . }} {{- end }} - {{- with $pdb.unhealthyPodEvictionPolicy }} - unhealthyPodEvictionPolicy: {{ . }} - {{- end }} selector: matchLabels: {{ include "vm.selectorLabels" $ctx | nindent 6 }} {{- end }} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/role.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/role.yaml index 703c54e8..cb658970 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/role.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/role.yaml @@ -1,10 +1,10 @@ -{{- $rules := dict }} -{{- $crds := .Files.Get "crd.yaml" | splitList "---" }} +{{- $rules := default dict }} +{{- $fileContentsList := .Files.Get "crd.yaml" | splitList "---" }} {{- $groups := dict }} -{{- range $crds }} - {{- $crd := . | fromYaml }} - {{- $group := $crd.spec.group }} - {{- $plural:= $crd.spec.names.plural }} +{{- range $fileContentsList }} + {{- $fileContents := . | fromYaml }} + {{- $group := $fileContents.spec.group }} + {{- $plural:= $fileContents.spec.names.plural }} {{- $resources := get $groups $group | default (list) }} {{- $resources = concat $resources (list $plural (printf "%s/finalizers" $plural) (printf "%s/status" $plural)) }} {{- $groups = set $groups $group $resources }} @@ -74,7 +74,6 @@ rules: - persistentvolumeclaims - persistentvolumeclaims/finalizers - pods - - pods/eviction - secrets - secrets/finalizers - services @@ -88,6 +87,7 @@ rules: resources: - configmaps/status - nodes + - nodes/proxy - nodes/metrics - namespaces verbs: @@ -160,13 +160,6 @@ rules: - ingresses/finalizers verbs: - "*" -- apiGroups: - - gateway.networking.k8s.io - resources: - - httproutes - - httproutes/finalizers - verbs: - - '*' - apiGroups: - apiextensions.k8s.io resources: @@ -186,7 +179,7 @@ rules: {{ toYaml . }} {{- end }} {{- end }} -{{- if .Values.crds.cleanup.enabled }} +{{- if and .Values.crds.enabled .Values.crds.cleanup.enabled }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service.yaml index 6efc329a..842d444f 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service.yaml @@ -14,9 +14,6 @@ metadata: {{- $_ := unset $ctx "extraLabels" }} name: {{ $fullname }} spec: - {{- with $service.trafficDistribution }} - trafficDistribution: {{ . }} - {{- end }} {{- with $service.clusterIP }} clusterIP: {{ . }} {{- end }} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/serviceaccount.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service_account.yaml similarity index 88% rename from packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/serviceaccount.yaml rename to packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service_account.yaml index 73daf270..59d26fba 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/serviceaccount.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/service_account.yaml @@ -6,7 +6,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ tpl ($sa.name | default $fullname) $ctx }} + name: {{ $sa.name | default $fullname }} namespace: {{ $ns }} {{- $_ := set $ctx "extraLabels" .Values.extraLabels }} labels: {{ include "vm.labels" $ctx | nindent 4 }} @@ -15,7 +15,7 @@ metadata: {{- end }} automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} {{- end }} -{{- if .Values.crds.cleanup.enabled }} +{{- if and .Values.crds.enabled .Values.crds.cleanup.enabled }} --- apiVersion: v1 kind: ServiceAccount diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml index e38f7448..1bead84d 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml @@ -1,52 +1,36 @@ -{{- $webhooks := .Values.admissionWebhooks }} -{{- if $webhooks.enabled }} +{{- if .Values.admissionWebhooks.enabled }} {{- $ctx := dict "helm" . "extraLabels" .Values.extraLabels }} {{- $tls := fromYaml (include "vm-operator.certs" $ctx) }} {{- $fullname := include "vm.plain.fullname" $ctx }} {{- $domain := ((.Values.global).cluster).dnsDomain }} {{- $ns := include "vm.namespace" $ctx }} -{{- $certManager := $webhooks.certManager }} -{{- $files := .Files }} -{{- $crds := $files.Get "crd.yaml" | splitList "---" }} -{{- $disabledFor := $webhooks.disabledFor | default list }} +{{- $certManager := .Values.admissionWebhooks.certManager }} --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: {{ $fullname }}-admission - {{- if or $certManager.enabled $webhooks.annotations }} + {{- if $certManager.enabled }} annotations: - {{- if $certManager.enabled }} certmanager.k8s.io/inject-ca-from: {{ printf "%s/%s-validation" $ns $fullname | quote }} cert-manager.io/inject-ca-from: {{ printf "%s/%s-validation" $ns $fullname | quote }} - {{- end }} - {{- with $certManager.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with $webhooks.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} {{- end }} labels: {{ include "vm.labels" $ctx | nindent 4 }} webhooks: -{{- range $crds }} -{{- $crd := fromYaml . }} -{{- $name := $crd.spec.names.singular }} -{{- if not (has $name $disabledFor) }} -{{- range $version := $crd.spec.versions }} +{{- range $name, $enabled := .Values.admissionWebhooks.enabledCRDValidation }} +{{- if $enabled }} - clientConfig: service: namespace: {{ $ns }} name: {{ $fullname }} - path: /validate-operator-victoriametrics-com-{{ $version.name }}-{{ $crd.spec.names.singular }} + path: /validate-operator-victoriametrics-com-v1beta1-{{ $name }} port: {{ $.Values.service.webhookPort }} {{- if not $certManager.enabled }} caBundle: {{ $tls.caCert }} {{- end }} - failurePolicy: {{ $webhooks.policy }} - name: '{{ $crd.metadata.name }}' - admissionReviewVersions: - - v1 + failurePolicy: {{ $.Values.admissionWebhooks.policy }} + name: {{ $name }}.victoriametrics.com + admissionReviewVersions: ["v1", "v1beta1"] sideEffects: None objectSelector: matchExpressions: @@ -55,15 +39,14 @@ webhooks: values: [{{ include "vm.name" $ }}] rules: - apiGroups: - - {{ $crd.spec.group }} + - operator.victoriametrics.com apiVersions: - - {{ $version.name }} + - v1beta1 operations: - CREATE - UPDATE resources: - - {{ $crd.spec.names.plural }} -{{- end }} + - {{ $name }}{{ ternary "" "s" (hasSuffix "s" $name) }} {{- end }} {{- end }} {{- if $certManager.enabled }} diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml index 3a1027f2..64eddbf2 100644 --- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml +++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/values.yaml @@ -29,12 +29,6 @@ image: # -- Image pull policy pullPolicy: IfNotPresent -configReloader: - image: {} - # registry: "" - # repository: "" - # tag: "" - crds: # -- manages CRD creation. Disables CRD creation only in combination with `crds.plain: false` due to helm dependency conditions limitation enabled: true @@ -49,7 +43,7 @@ crds: enabled: false # -- Image configuration for CRD cleanup Job image: - repository: rancher/kubectl + repository: bitnami/kubectl # use image tag that matches k8s API version by default tag: "" pullPolicy: IfNotPresent @@ -61,109 +55,6 @@ crds: requests: cpu: "100m" memory: "56Mi" - upgrade: - # -- Enables CRD upgrade job - enabled: false - # -- Adds `--force-conflics` argument to kubectl - forceConflicts: false - busybox: - image: - repository: busybox - tag: latest - pullPolicy: IfNotPresent - kubectl: - image: - repository: rancher/kubectl - # use image tag that matches k8s API version by default - tag: "" - pullPolicy: IfNotPresent - - # -- Extra settings for CRD upgrade job - env: [] - - # -- Upgrade job resources. - resources: {} - # limits: - # cpu: 120m - # memory: 320Mi - # requests: - # cpu: 80m - # memory: 120Mi - - # -- Additional upgrade job volumes - extraVolumes: [] - - # -- Additional upgrade job volume mounts - extraVolumeMounts: [] - - # -- Pod's node selector. Details are [here](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) - nodeSelector: {} - - # -- Upgrade job pod affinity - affinity: {} - # nodeAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # nodeSelectorTerms: - # - matchExpressions: - # - key: kubernetes.io/e2e-az-name - # operator: In - # values: - # - e2e-az1 - # - e2e-az2 - - # -- Array of upgrade job tolerations object. Spec is [here](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/) - tolerations: [] - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - - # -- Upgrade job Pod Topology Spread Constraints. Spec is [here](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/) - topologySpreadConstraints: [] - # - maxSkew: 1 - # topologyKey: topology.kubernetes.io/zone - # whenUnsatisfiable: DoNotSchedule - # labelSelector: - # matchLabels: - # app.kubernetes.io/component: alertmanager - - # -- Labels to add to the upgrade job - labels: {} - - # -- Annotations to add to the upgrade job - annotations: {} - - # -- Labels to add to the upgrade job pod - podLabels: {} - - # -- Annotations to add to the upgrade job pod - podAnnotations: {} - - # -- Service account for upgrade CRD job to use. - serviceAccount: - create: true - name: "" - annotations: {} - labels: {} - automountServiceAccountToken: true - - # -- Container-specific security context configuration. Details are [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - - # -- Pod's security context. Details are [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - podSecurityContext: - enabled: true - fsGroup: 65534 - runAsGroup: 65534 - runAsNonRoot: true - runAsUser: 65534 - seccompProfile: - type: RuntimeDefault # -- Number of operator replicas replicaCount: 1 @@ -228,6 +119,9 @@ operator: # -- Enables ownership reference for converted prometheus-operator objects, # it will remove corresponding victoria-metrics objects in case of deletion prometheus one. enable_converter_ownership: false + # -- Enables custom config-reloader, bundled with operator. + # It should reduce vmagent and vmauth config sync-time and make it predictable. + useCustomConfigReloader: false # -- By default, the operator will watch all the namespaces # If you want to override this behavior, specify the namespace. @@ -244,15 +138,13 @@ serviceAccount: automountServiceAccountToken: true service: - # -- Service traffic distribution. Details are [here](https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution) - trafficDistribution: "" # -- Service annotations annotations: {} # -- Service labels labels: {} # -- Service ClusterIP clusterIP: "" - # -- Service external IPs. Check [here](https://kubernetes.io/docs/concepts/services-networking/service/#external-ips) for details + # -- Service external IPs. Check [here](https://kubernetes.io/docs/user-guide/services/#external-ips) for details externalIPs: "" # -- Service load balancer IP loadBalancerIP: "" @@ -276,12 +168,8 @@ service: # -- See `kubectl explain poddisruptionbudget.spec` for more or check [these docs](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) podDisruptionBudget: enabled: false - # -- min number or percentage of pods that can be unavailable - minAvailable: 0 - # -- max number or percentage of pods that can be unavailable - maxUnavailable: 0 - # -- Defines criteria when unhealthy pods should be considered for eviction - unhealthyPodEvictionPolicy: + # minAvailable: 1 + # maxUnavailable: 1 labels: {} # -- Graceful pod termination timeout. See [this article](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#hook-handler-execution) for details. @@ -300,16 +188,9 @@ resources: # cpu: 80m # memory: 120Mi -# -- Pod's node selector. Details are [here](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) +# -- Pod's node selector. Details are [here](https://kubernetes.io/docs/user-guide/node-selection/) nodeSelector: {} -# -- Deployment strategy, set to standard k8s default -strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 25% - maxUnavailable: 25% - # -- Name of Priority Class priorityClassName: "" @@ -325,7 +206,7 @@ topologySpreadConstraints: [] # -- Operator container additional commandline arguments extraArgs: {} -# -- Extra settings for the operator deployment. Full list [here](https://docs.victoriametrics.com/operator/configuration/#environment-variables) +# -- Extra settings for the operator deployment. Full list [here](https://docs.victoriametrics.com/operator/vars) env: [] # - name: VM_VMSINGLEDEFAULT_VERSION @@ -368,20 +249,21 @@ extraContainers: # -- Enable hostNetwork on operator deployment hostNetwork: false -# -- Enable sharing process Namespace between Containers in a Pod. This only makes sense with extraContainers -shareProcessNamespace: false - # -- Configures resource validation admissionWebhooks: # -- Enables validation webhook. enabled: true - # -- Annotations for webhook. Can be used to define Helm or ArgoCD annotations. - annotations: {} - # -- List of CRD names to disable validation for - disabledFor: [] - # - vmagent - # - vmsingle - + enabledCRDValidation: + vmagent: true + vmalert: true + vmsingle: true + vmauth: true + vmrule: true + vmalertmanagerconfig: true + vmalertmanager: true + vmcluster: true + vmuser: true + vlogs: true # -- What to do in case, when operator not available to validate request. policy: Fail # -- Enables custom ca bundle, if you are not using cert-manager. In case of custom ca, you have to create secret - {chart-name}-validation with keys: tls.key, tls.crt, ca.crt diff --git a/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml b/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml index e1397d2d..d5694a2c 100644 --- a/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml +++ b/packages/system/virtualprivatecloud-rd/cozyrds/virtualprivatecloud.yaml @@ -8,7 +8,7 @@ spec: plural: virtualprivateclouds singular: virtualprivatecloud openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"subnets":{"description":"Subnets of a VPC","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"cidr":{"description":"IP address range","type":"string"},"name":{"description":"Subnet name","type":"string"}}}},"peers":{"description":"VPC peering connections (bidirectional declaration required)","type":"array","default":[],"items":{"type":"object","required":["tenantNamespace","vpcName"],"properties":{"tenantNamespace":{"description":"Namespace of the remote tenant","type":"string"},"vpcName":{"description":"Logical name of the remote VPC (without \"virtualprivatecloud-\" prefix)","type":"string"}}}},"routes":{"description":"Static routes for the VPC","type":"array","default":[],"items":{"type":"object","required":["cidr","nextHopIP"],"properties":{"cidr":{"description":"Destination CIDR","type":"string"},"nextHopIP":{"description":"Next hop IP address","type":"string"}}}}}} + {"title":"Chart Values","type":"object","properties":{"subnets":{"description":"Subnets of a VPC","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"cidr":{"description":"IP address range","type":"string"},"name":{"description":"Subnet name","type":"string"}}}}}} release: prefix: "virtualprivatecloud-" labels: @@ -23,7 +23,7 @@ spec: plural: VPCs description: "Isolated networks" icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl8xMDI1XzMpIi8+CjxwYXRoIGQ9Ik0xMDkuNiA4Ni4xSDExNC4zQzExNi44ODUgODYuMSAxMTkgODguMjE1IDExOSA5MC44NDdWMTA0Ljg1M0MxMTkgMTA3LjQ4NSAxMTYuODg1IDEwOS42IDExNC4zIDEwOS42SDk1LjVDOTIuOTE1IDEwOS42IDkwLjggMTA3LjQ4NSA5MC44IDEwNC44NTNWOTAuODQ3QzkwLjggODguMjE1IDkyLjkxNSA4Ni4xIDk1LjUgODYuMUgxMDAuMlY3Ni43SDc2LjdWODYuMUg4MS40QzgzLjk4NSA4Ni4xIDg2LjEgODguMjE1IDg2LjEgOTAuODQ3VjEwNC44NTNDODYuMSAxMDcuNDg1IDgzLjk4NSAxMDkuNiA4MS40IDEwOS42SDYyLjZDNjAuMDE1IDEwOS42IDU3LjkgMTA3LjQ4NSA1Ny45IDEwNC44NTNWOTAuODQ3QzU3LjkgODguMjE1IDYwLjAxNSA4Ni4xIDYyLjYgODYuMUg2Ny4zVjc2LjdINDMuOFY4Ni4xSDQ4LjVDNTEuMDg1IDg2LjEgNTMuMiA4OC4yMTUgNTMuMiA5MC44NDdWMTA0Ljg1M0M1My4yIDEwNy40ODUgNTEuMDg1IDEwOS42IDQ4LjUgMTA5LjZIMjkuN0MyNy4xMTUgMTA5LjYgMjUgMTA3LjQ4NSAyNSAxMDQuODUzVjkwLjg0N0MyNSA4OC4yMTUgMjcuMTE1IDg2LjEgMjkuNyA4Ni4xSDM0LjRWNzYuN0MzNC40IDcxLjUzIDM4LjYzIDY3LjMgNDMuOCA2Ny4zSDY3LjNWNTcuOUg2Mi42QzYwLjAxNSA1Ny45IDU3LjkgNTUuNzg1IDU3LjkgNTMuMTUzVjM5LjE0N0M1Ny45IDM2LjUxNSA2MC4wMTUgMzQuNCA2Mi42IDM0LjRIODEuNEM4My45ODUgMzQuNCA4Ni4xIDM2LjUxNSA4Ni4xIDM5LjE0N1Y1My4xNTNDODYuMSA1NS43ODUgODMuOTg1IDU3LjkgODEuNCA1Ny45SDc2LjdWNjcuM0gxMDAuMkMxMDUuMzcgNjcuMyAxMDkuNiA3MS41MyAxMDkuNiA3Ni43Vjg2LjFaIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzEwMjVfMyIgeDE9IjE0Mi41IiB5MT0iMTQzIiB4Mj0iMy45OTk5OSIgeTI9IjkuNDk5OTkiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzAwMDgyRSIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiMyRTMwNjciLz4KPC9saW5lYXJHcmFkaWVudD4KPC9kZWZzPgo8L3N2Zz4K - keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "subnets"], ["spec", "peers"], ["spec", "routes"]] + keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "subnets"]] secrets: exclude: [] include: [] diff --git a/packages/system/vm-default-images/Chart.yaml b/packages/system/vm-default-images/Chart.yaml deleted file mode 100644 index aac0ccca..00000000 --- a/packages/system/vm-default-images/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -name: vm-default-images -description: Global Golden Image collection for virtual machines -type: application -version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process diff --git a/packages/system/vm-default-images/Makefile b/packages/system/vm-default-images/Makefile deleted file mode 100644 index a3f9fac7..00000000 --- a/packages/system/vm-default-images/Makefile +++ /dev/null @@ -1,4 +0,0 @@ -export NAME=vm-default-images -export NAMESPACE=cozy-system - -include ../../../hack/package.mk diff --git a/packages/system/vm-default-images/templates/dv.yaml b/packages/system/vm-default-images/templates/dv.yaml deleted file mode 100644 index 84b9a758..00000000 --- a/packages/system/vm-default-images/templates/dv.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- range .Values.images }} ---- -apiVersion: cdi.kubevirt.io/v1beta1 -kind: DataVolume -metadata: - annotations: - vm-default-images.cozystack.io/name: {{ .name | quote }} - {{- with .os }} - {{- with .family }} - vm-default-images.cozystack.io/os-family: {{ . | quote }} - {{- end }} - {{- with .name }} - vm-default-images.cozystack.io/os-name: {{ . | quote }} - {{- end }} - {{- with .version }} - vm-default-images.cozystack.io/os-version: {{ . | quote }} - {{- end }} - {{- end }} - {{- with .architecture }} - vm-default-images.cozystack.io/architecture: {{ . | quote }} - {{- end }} - {{- with .description }} - vm-default-images.cozystack.io/description: {{ . | quote }} - {{- end }} - cdi.kubevirt.io/storage.bind.immediate.requested: "true" - cdi.kubevirt.io/storage.usePopulator: "true" - labels: - app.kubernetes.io/managed-by: cozystack - name: vm-default-images-{{ required "A valid .name entry required for each image!" .name }} - namespace: cozy-public -spec: - contentType: kubevirt - source: - http: - url: {{ required (printf "A valid .url entry required for image '%s'!" .name) .url | quote }} - storage: - resources: - requests: - storage: {{ default "5Gi" .storage }} - {{- if .storageClass }} - storageClassName: {{ .storageClass }} - {{- else if $.Values.storageClass }} - storageClassName: {{ $.Values.storageClass }} - {{- end }} -{{- end }} diff --git a/packages/system/vm-default-images/values.yaml b/packages/system/vm-default-images/values.yaml deleted file mode 100644 index 9d777f0b..00000000 --- a/packages/system/vm-default-images/values.yaml +++ /dev/null @@ -1,169 +0,0 @@ -## -## @section Global Golden Image Collection -## - -## @param {string} storageClass - Default StorageClass for all images. If empty, uses the cluster default StorageClass. -## NOTE: The default set of images requires approximately 320Gi of storage (16 images × 20Gi each). -## Adjust the image list or per-image storage sizes to match your cluster capacity. -storageClass: "replicated" - -## @typedef {struct} ImageOS - Operating system metadata for a Golden Image. -## @field {string} [family] - OS family (e.g. "Linux", "Windows"). -## @field {string} [name] - OS distribution name (e.g. "Ubuntu", "Fedora"). -## @field {string} [version] - OS version (e.g. "24.04", "40"). - -## @typedef {struct} GlobalImage - A global Golden Image entry. -## @field {string} name - Unique image name used to reference this image in vm-disk (e.g. "ubuntu"). -## @field {string} url - HTTP(S) URL to download the image from. -## @field {quantity} storage - Storage size to allocate for this image. -## @field {string} storageClass - StorageClass used to store the image (overrides global default). -## @field {ImageOS} [os] - Operating system metadata. -## @field {string} [architecture] - CPU architecture (e.g. "amd64", "arm64"). -## @field {string} [description] - Human-readable description. - -## @param {[]GlobalImage} images - List of global Golden Images to provision in the cozy-public namespace. -images: - - name: ubuntu-22.04 - url: https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img - storage: 20Gi - os: - family: Linux - name: Ubuntu - version: "22.04" - architecture: amd64 - description: "Ubuntu 22.04 LTS (Jammy Jellyfish) cloud image" - - name: ubuntu-24.04 - url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img - storage: 20Gi - os: - family: Linux - name: Ubuntu - version: "24.04" - architecture: amd64 - description: "Ubuntu 24.04 LTS (Noble Numbat) cloud image" - - name: rocky-8 - url: https://dl.rockylinux.org/pub/rocky/8/images/x86_64/Rocky-8-GenericCloud-Base.latest.x86_64.qcow2 - storage: 20Gi - os: - family: Linux - name: Rocky Linux - version: "8" - architecture: amd64 - description: "Rocky Linux 8 GenericCloud image" - - name: rocky-9 - url: https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud-Base.latest.x86_64.qcow2 - storage: 20Gi - os: - family: Linux - name: Rocky Linux - version: "9" - architecture: amd64 - description: "Rocky Linux 9 GenericCloud image" - - name: rocky-10 - url: https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2 - storage: 20Gi - os: - family: Linux - name: Rocky Linux - version: "10" - architecture: amd64 - description: "Rocky Linux 10 GenericCloud image" - - name: almalinux-8 - url: https://repo.almalinux.org/almalinux/8/cloud/x86_64/images/AlmaLinux-8-GenericCloud-latest.x86_64.qcow2 - storage: 20Gi - os: - family: Linux - name: AlmaLinux - version: "8" - architecture: amd64 - description: "AlmaLinux 8 GenericCloud image" - - name: almalinux-9 - url: https://repo.almalinux.org/almalinux/9/cloud/x86_64/images/AlmaLinux-9-GenericCloud-latest.x86_64.qcow2 - storage: 20Gi - os: - family: Linux - name: AlmaLinux - version: "9" - architecture: amd64 - description: "AlmaLinux 9 GenericCloud image" - - name: almalinux-10 - url: https://repo.almalinux.org/almalinux/10/cloud/x86_64/images/AlmaLinux-10-GenericCloud-latest.x86_64.qcow2 - storage: 20Gi - os: - family: Linux - name: AlmaLinux - version: "10" - architecture: amd64 - description: "AlmaLinux 10 GenericCloud image" - - name: debian-12 - url: https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-generic-amd64.qcow2 - storage: 20Gi - os: - family: Linux - name: Debian - version: "12" - architecture: amd64 - description: "Debian 12 (Bookworm) generic cloud image" - - name: debian-13 - url: https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2 - storage: 20Gi - os: - family: Linux - name: Debian - version: "13" - architecture: amd64 - description: "Debian 13 (Trixie) generic cloud image" - - name: centos-stream-9 - url: https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-latest.x86_64.qcow2 - storage: 20Gi - os: - family: Linux - name: CentOS - version: "9" - architecture: amd64 - description: "CentOS Stream 9 GenericCloud image" - - name: centos-stream-10 - url: https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-10-latest.x86_64.qcow2 - storage: 20Gi - os: - family: Linux - name: CentOS - version: "10" - architecture: amd64 - description: "CentOS Stream 10 GenericCloud image" - - name: opensuse-leap-15.6 - url: https://download.opensuse.org/repositories/Cloud:/Images:/Leap_15.6/images/openSUSE-Leap-15.6.x86_64-NoCloud.qcow2 - storage: 20Gi - os: - family: Linux - name: openSUSE - version: "15.6" - architecture: amd64 - description: "openSUSE Leap 15.6 NoCloud image" - - name: opensuse-leap-16.0 - url: https://download.opensuse.org/repositories/openSUSE:/Leap:/16.0:/Images/images/Leap-16.0-Minimal-VM.x86_64-Cloud.qcow2 - storage: 20Gi - os: - family: Linux - name: openSUSE - version: "16.0" - architecture: amd64 - description: "openSUSE Leap 16.0 Minimal VM cloud image" - - name: ubuntu-20.04 - url: https://cloud-images.ubuntu.com/focal/current/focal-server-cloudimg-amd64.img - storage: 20Gi - os: - family: Linux - name: Ubuntu - version: "20.04" - architecture: amd64 - description: "Ubuntu 20.04 LTS (Focal Fossa) cloud image" - - name: alpine-3.21 - url: https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/cloud/nocloud_alpine-3.21.6-x86_64-bios-cloudinit-r0.qcow2 - storage: 20Gi - os: - family: Linux - name: Alpine - version: "3.21" - architecture: amd64 - description: "Alpine Linux 3.21 cloud image (cloud-init)" diff --git a/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml b/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml index 3ce046ed..93f8956f 100644 --- a/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml +++ b/packages/system/vm-disk-rd/cozyrds/vm-disk.yaml @@ -8,7 +8,7 @@ spec: singular: vmdisk plural: vmdisks openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"source":{"description":"The source image location used to create a disk.","type":"object","default":{},"properties":{"disk":{"description":"Clone an existing vm-disk.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the vm-disk to clone.","type":"string"}}},"http":{"description":"Download image from an HTTP source.","type":"object","required":["url"],"properties":{"url":{"description":"URL to download the image.","type":"string"}}},"image":{"description":"Use image by name from default collection.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the image to use.","type":"string"}}},"upload":{"description":"Upload local image.","type":"object"}}},"optical":{"description":"Defines if disk should be considered optical.","type":"boolean","default":false},"storage":{"description":"The size of the disk allocated for the virtual machine.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}} + {"title":"Chart Values","type":"object","properties":{"optical":{"description":"Defines if disk should be considered optical.","type":"boolean","default":false},"source":{"description":"The source image location used to create a disk.","type":"object","default":{},"properties":{"http":{"description":"Download image from an HTTP source.","type":"object","required":["url"],"properties":{"url":{"description":"URL to download the image.","type":"string"}}},"image":{"description":"Use image by name.","type":"object","required":["name"],"properties":{"name":{"description":"Name of the image to use (uploaded as \"golden image\" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).","type":"string"}}},"upload":{"description":"Upload local image."}}},"storage":{"description":"The size of the disk allocated for the virtual machine.","default":"5Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"}}} release: prefix: vm-disk- labels: diff --git a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml index e56bd9dd..ff7c8cfe 100644 --- a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml +++ b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml @@ -8,7 +8,7 @@ spec: singular: vminstance plural: vminstances openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"externalAllowICMP":{"description":"Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.","type":"boolean","default":true},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}} + {"title":"Chart Values","type":"object","properties":{"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"subnets":{"description":"Additional subnets","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Subnet name","type":"string"}}}}}} release: prefix: vm-instance- labels: @@ -26,7 +26,7 @@ spec: tags: - compute icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODdfMzQ1NCkiLz4KPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzY4N18zNDU0KSI+CjxwYXRoIGQ9Ik04OS41MDM5IDExMS43MDdINTQuNDk3QzU0LjE3MjcgMTExLjcwNyA1NC4wMTA4IDExMS4yMjEgNTQuMzM0OSAxMTEuMDU5TDU3LjI1MjIgMTA4Ljk1MkM2MC4zMzE0IDEwNi42ODMgNjEuOTUyMiAxMDIuNjMxIDYwLjk3OTcgOTguNzQxMkg4My4wMjFDODIuMDQ4NSAxMDIuNjMxIDgzLjY2OTMgMTA2LjY4MyA4Ni43NDg1IDEwOC45NTJMODkuNjY1OCAxMTEuMDU5Qzg5Ljk5IDExMS4yMjEgODkuODI3OSAxMTEuNzA3IDg5LjUwMzkgMTExLjcwN1oiIGZpbGw9IiNCMEI2QkIiLz4KPHBhdGggZD0iTTExMy4zMjggOTguNzQxSDMwLjY3MjVDMjcuNTkzMSA5OC43NDEgMjUgOTYuMTQ4IDI1IDkzLjA2ODdWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJWOTMuMDY4N0MxMTkgOTYuMTQ4IDExNi40MDcgOTguNzQxIDExMy4zMjggOTguNzQxWiIgZmlsbD0iI0U4RURFRSIvPgo8cGF0aCBkPSJNMTE5IDg0LjE1NDlIMjVWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJMMTE5IDg0LjE1NDlaIiBmaWxsPSIjMDBCM0ZGIi8+CjxwYXRoIGQ9Ik05MC42Mzc0IDExNi41NjlINTMuMzYxNkM1Mi4wNjUxIDExNi41NjkgNTAuOTMwNyAxMTUuNDM1IDUwLjkzMDcgMTE0LjEzOEM1MC45MzA3IDExMi44NDEgNTIuMDY1MSAxMTEuNzA3IDUzLjM2MTYgMTExLjcwN0g5MC42Mzc0QzkxLjkzMzkgMTExLjcwNyA5My4wNjg0IDExMi44NDEgOTMuMDY4NCAxMTQuMTM4QzkzLjA2ODQgMTE1LjQzNSA5MS45MzM5IDExNi41NjkgOTAuNjM3NCAxMTYuNTY5WiIgZmlsbD0iI0U4RURFRSIvPgo8L2c+CjxwYXRoIGQ9Ik03Mi41Mjc1IDUzLjgzNjdDNzIuNDQzMSA1My44MzUxIDcyLjM2MDUgNTMuODEyMiA3Mi4yODczIDUzLjc3MDFMNTYuNDY5OSA0NC43OTM0QzU2LjM5ODMgNDQuNzUxOSA1Ni4zMzg4IDQ0LjY5MjMgNTYuMjk3MyA0NC42MjA3QzU2LjI1NTkgNDQuNTQ5IDU2LjIzMzggNDQuNDY3OCA1Ni4yMzM0IDQ0LjM4NUM1Ni4yMzM0IDQ0LjIxNjkgNTYuMzI1OCA0NC4wNjE3IDU2LjQ2OTkgNDMuOTc4NUw3Mi4xOTEyIDM1LjA2MDlDNzIuMjYzNyAzNS4wMjEgNzIuMzQ1IDM1IDcyLjQyNzcgMzVDNzIuNTEwNSAzNSA3Mi41OTE4IDM1LjAyMSA3Mi42NjQzIDM1LjA2MDlMODguNDg3MiA0NC4wMzk1Qzg4LjU1OTEgNDQuMDgwMSA4OC42MTg4IDQ0LjEzOTIgODguNjYgNDQuMjEwN0M4OC43MDEzIDQ0LjI4MjIgODguNzIyNyA0NC4zNjM1IDg4LjcyMTkgNDQuNDQ2Qzg4LjcyMjUgNDQuNTI4NSA4OC43MDEgNDQuNjA5NyA4OC42NTk4IDQ0LjY4MTJDODguNjE4NSA0NC43NTI2IDg4LjU1ODkgNDQuODExOCA4OC40ODcyIDQ0Ljg1MjVMNzIuNzcxNCA1My43NjgzQzcyLjY5NzIgNTMuODExNCA3Mi42MTMzIDUzLjgzNDkgNzIuNTI3NSA1My44MzY3IiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBvcGFjaXR5PSIwLjciIGQ9Ik03MC4yNTUzIDc1LjY1MTdDNzAuMTcxIDc1LjY1MzUgNzAuMDg3OCA3NS42MzE3IDcwLjAxNTEgNzUuNTg4OEw1NC4yNDU4IDY2LjY0MTdDNTQuMTcxNSA2Ni42MDI0IDU0LjEwOTUgNjYuNTQzNiA1NC4wNjYxIDY2LjQ3MTZDNTQuMDIyOCA2Ni4zOTk3IDU0IDY2LjMxNzMgNTQgNjYuMjMzM1Y0OC4yNzhDNTQgNDguMTA4IDU0LjA5MjQgNDcuOTU0NiA1NC4yNDM5IDQ3Ljg2OTZDNTQuMzE3MiA0Ny44MjcxIDU0LjQwMDQgNDcuODA0NyA1NC40ODUxIDQ3LjgwNDdDNTQuNTY5NyA0Ny44MDQ3IDU0LjY1MjkgNDcuODI3MSA1NC43MjYyIDQ3Ljg2OTZMNzAuNDkzNyA1Ni44MTMxQzcwLjU2NDIgNTYuODU2NSA3MC42MjI1IDU2LjkxNyA3MC42NjMyIDU2Ljk4OTFDNzAuNzAzOSA1Ny4wNjEyIDcwLjcyNTcgNTcuMTQyNCA3MC43MjY1IDU3LjIyNTFWNzUuMTgwNUM3MC43MjU5IDc1LjI2MjggNzAuNzA0MiA3NS4zNDM2IDcwLjY2MzUgNzUuNDE1MUM3MC42MjI3IDc1LjQ4NjYgNzAuNTY0MiA3NS41NDY0IDcwLjQ5MzcgNzUuNTg4OEM3MC40MjA2IDc1LjYyOTEgNzAuMzM4NyA3NS42NTA3IDcwLjI1NTMgNzUuNjUxNyIgZmlsbD0id2hpdGUiLz4KPHBhdGggb3BhY2l0eT0iMC40IiBkPSJNNzQuNzE5OCA3NS42NTExQzc0LjYzMzMgNzUuNjUxMiA3NC41NDgyIDc1LjYyOTYgNzQuNDcyMiA3NS41ODgzQzc0LjQwMTYgNzUuNTQ2MSA3NC4zNDMyIDc1LjQ4NjIgNzQuMzAyNyA3NS40MTQ3Qzc0LjI2MjMgNzUuMzQzMSA3NC4yNDExIDc1LjI2MjIgNzQuMjQxMiA3NS4xOFY1Ny4zMzczQzc0LjI0MTIgNTcuMTcxIDc0LjMzMzYgNTcuMDE1OCA3NC40NzIyIDU2LjkyOUw5MC4yMzk3IDQ3Ljk4NTVDOTAuMzExOSA0Ny45NDM4IDkwLjM5MzggNDcuOTIxOSA5MC40NzcxIDQ3LjkyMTlDOTAuNTYwNSA0Ny45MjE5IDkwLjY0MjQgNDcuOTQzOCA5MC43MTQ2IDQ3Ljk4NTVDOTAuNzg3NiA0OC4wMjU1IDkwLjg0ODUgNDguMDg0MiA5MC44OTExIDQ4LjE1NTdDOTAuOTMzNyA0OC4yMjcyIDkwLjk1NjMgNDguMzA4OCA5MC45NTY2IDQ4LjM5MlY2Ni4yMzI4QzkwLjk1NyA2Ni4zMTY0IDkwLjkzNDcgNjYuMzk4NSA5MC44OTIxIDY2LjQ3MDRDOTAuODQ5NSA2Ni41NDI0IDkwLjc4ODEgNjYuNjAxNCA5MC43MTQ2IDY2LjY0MTFMNzQuOTUyNiA3NS41ODgzQzc0Ljg4MjUgNzUuNjMwNyA3NC44MDE4IDc1LjY1MjUgNzQuNzE5OCA3NS42NTExIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzY4N18zNDU0IiB4MT0iMTYxIiB5MT0iMTgwIiB4Mj0iMy41OTI4NGUtMDciIHkyPSI0Ljk5OTk4IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjNTk1NjU2Ii8+CjwvbGluZWFyR3JhZGllbnQ+CjxjbGlwUGF0aCBpZD0iY2xpcDBfNjg3XzM0NTQiPgo8cmVjdCB3aWR0aD0iOTQiIGhlaWdodD0iOTQiIGZpbGw9IndoaXRlIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgyNSAyNSkiLz4KPC9jbGlwUGF0aD4KPC9kZWZzPgo8L3N2Zz4K - keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "externalAllowICMP"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "networks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]] + keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]] secrets: exclude: [] include: [] diff --git a/packages/system/vpn-rd/cozyrds/vpn.yaml b/packages/system/vpn-rd/cozyrds/vpn.yaml index d2fb9efa..1d3fe7fb 100644 --- a/packages/system/vpn-rd/cozyrds/vpn.yaml +++ b/packages/system/vpn-rd/cozyrds/vpn.yaml @@ -8,7 +8,7 @@ spec: plural: vpns singular: vpn openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of VPN server replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each VPN server replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"host":{"description":"Host used to substitute into generated URLs.","type":"string","default":""},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (autogenerated if not provided).","type":"string"}}}},"externalIPs":{"description":"List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.","type":"array","default":[],"items":{"type":"string"}}}} + {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalIPs":{"description":"List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.","type":"array","default":[],"items":{"type":"string"}},"host":{"description":"Host used to substitute into generated URLs.","type":"string","default":""},"replicas":{"description":"Number of VPN server replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each VPN server replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"nano","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user (autogenerated if not provided).","type":"string"}}}}}} release: prefix: vpn- labels: diff --git a/pkg/apis/apps/v1alpha1/types.go b/pkg/apis/apps/v1alpha1/types.go index 3332ce55..51247efb 100644 --- a/pkg/apis/apps/v1alpha1/types.go +++ b/pkg/apis/apps/v1alpha1/types.go @@ -52,12 +52,6 @@ type ApplicationStatus struct { ExternalIPsCount int32 `json:"externalIPsCount,omitempty"` } -// SchedulingClass returns the scheduling class requested by this Application. -// TODO: read from a dedicated Application field once the struct is extended. -func (in Application) SchedulingClass() string { - return "" -} - // GetConditions returns the status conditions of the object. func (in Application) GetConditions() []metav1.Condition { return in.Status.Conditions diff --git a/pkg/apis/apps/validation/validation.go b/pkg/apis/apps/validation/validation.go index d62f2f22..273873a4 100644 --- a/pkg/apis/apps/validation/validation.go +++ b/pkg/apis/apps/validation/validation.go @@ -17,39 +17,16 @@ limitations under the License. package validation import ( - "regexp" - k8svalidation "k8s.io/apimachinery/pkg/util/validation" "k8s.io/apimachinery/pkg/util/validation/field" ) -// TenantKind is the Application.Kind string that gates the tenant-specific -// name rules below. It must stay in sync with the `kind` field of the tenant -// ApplicationDefinition (packages/system/tenant-rd/cozyrds/tenant.yaml) which -// is the upstream source the aggregated API reads at startup via -// config.Application.Kind. -const TenantKind = "Tenant" - -// tenantNameRegex enforces alphanumeric-only tenant names that begin with a -// lowercase letter. This is stricter than DNS-1035 because the tenant Helm -// chart's tenant.name helper (packages/apps/tenant/templates/_helpers.tpl) -// splits Release.Name on "-" and fails unless the result is exactly -// ["tenant", ""]. Any dash inside would break that invariant at -// Helm template time, so the aggregated API must reject such names up-front -// with a specific error. Requiring a leading letter (rather than letting -// leading-digit names fall through to DNS-1035) keeps the error message -// tenant-specific for all invalid inputs. -var tenantNameRegex = regexp.MustCompile(`^[a-z][a-z0-9]*$`) - -// ValidateApplicationName validates that an Application name is acceptable for -// the given kind. All applications must conform to DNS-1035 because their -// names are used to create Kubernetes resources (Services, Namespaces, etc.) -// that require DNS-1035 compliance. Tenant applications additionally must be -// alphanumeric and begin with a lowercase letter because of the Helm chart -// constraint described on tenantNameRegex. -// Note: length validation is handled separately by validateNameLength in the -// REST handler, which computes dynamic limits based on Helm release prefix. -func ValidateApplicationName(name, kindName string, fldPath *field.Path) field.ErrorList { +// ValidateApplicationName validates that an Application name conforms to DNS-1035. +// This is required because Application names are used to create Kubernetes resources +// (Services, Namespaces, etc.) that must have DNS-1035 compliant names. +// Note: length validation is handled separately by validateNameLength in the REST +// handler, which computes dynamic limits based on Helm release prefix. +func ValidateApplicationName(name string, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} if len(name) == 0 { @@ -57,16 +34,6 @@ func ValidateApplicationName(name, kindName string, fldPath *field.Path) field.E return allErrs } - // Tenant names must be alphanumeric starting with a letter — see - // tenantNameRegex comment for the reason. Check before DNS-1035 so the - // error message is specific to the tenant contract, not the generic DNS - // label rules. - if kindName == TenantKind && !tenantNameRegex.MatchString(name) { - allErrs = append(allErrs, field.Invalid(fldPath, name, - "tenant names must start with a lowercase letter and contain only lowercase letters and digits; dashes are not allowed")) - return allErrs - } - for _, msg := range k8svalidation.IsDNS1035Label(name) { allErrs = append(allErrs, field.Invalid(fldPath, name, msg)) } diff --git a/pkg/apis/apps/validation/validation_test.go b/pkg/apis/apps/validation/validation_test.go index 7930f8ae..7bf194d5 100644 --- a/pkg/apis/apps/validation/validation_test.go +++ b/pkg/apis/apps/validation/validation_test.go @@ -27,148 +27,55 @@ func TestValidateApplicationName(t *testing.T) { tests := []struct { name string appName string - kindName string wantError bool }{ - // Valid names (non-tenant kinds permit DNS-1035 including hyphens) - {"valid simple name", "tenant-one", "MySQL", false}, - {"valid single letter", "a", "MySQL", false}, - {"valid with numbers", "abc-123", "MySQL", false}, - {"valid lowercase", "my-tenant", "MySQL", false}, - {"valid long name", "my-very-long-tenant-name", "MySQL", false}, - {"valid double hyphen", "my--tenant", "MySQL", false}, - {"valid at DNS-1035 max (63 chars)", strings.Repeat("a", 63), "MySQL", false}, - {"valid with empty kind", "my-db", "", false}, + // Valid names + {"valid simple name", "tenant-one", false}, + {"valid single letter", "a", false}, + {"valid with numbers", "abc-123", false}, + {"valid lowercase", "my-tenant", false}, + {"valid long name", "my-very-long-tenant-name", false}, + {"valid double hyphen", "my--tenant", false}, + {"valid at DNS-1035 max (63 chars)", strings.Repeat("a", 63), false}, // Invalid: starts with wrong character - {"starts with digit", "1john", "MySQL", true}, - {"only digits", "123", "MySQL", true}, - {"starts with hyphen", "-tenant", "MySQL", true}, + {"starts with digit", "1john", true}, + {"only digits", "123", true}, + {"starts with hyphen", "-tenant", true}, // Invalid: ends with wrong character - {"ends with hyphen", "tenant-", "MySQL", true}, + {"ends with hyphen", "tenant-", true}, // Invalid: wrong characters - {"uppercase letters", "Tenant", "MySQL", true}, - {"mixed case", "myTenant", "MySQL", true}, - {"underscore", "my_tenant", "MySQL", true}, - {"dot", "my.tenant", "MySQL", true}, - {"space", "my tenant", "MySQL", true}, - {"unicode cyrillic", "тенант", "MySQL", true}, - {"unicode emoji", "tenant🚀", "MySQL", true}, - {"special chars", "tenant@home", "MySQL", true}, - {"colon", "tenant:one", "MySQL", true}, - {"slash", "tenant/one", "MySQL", true}, + {"uppercase letters", "Tenant", true}, + {"mixed case", "myTenant", true}, + {"underscore", "my_tenant", true}, + {"dot", "my.tenant", true}, + {"space", "my tenant", true}, + {"unicode cyrillic", "тенант", true}, + {"unicode emoji", "tenant🚀", true}, + {"special chars", "tenant@home", true}, + {"colon", "tenant:one", true}, + {"slash", "tenant/one", true}, // Invalid: empty or whitespace - {"empty string", "", "MySQL", true}, - {"only spaces", " ", "MySQL", true}, - {"leading space", " tenant", "MySQL", true}, - {"trailing space", "tenant ", "MySQL", true}, + {"empty string", "", true}, + {"only spaces", " ", true}, + {"leading space", " tenant", true}, + {"trailing space", "tenant ", true}, // Invalid: exceeds DNS-1035 max length (63) - {"too long (64 chars)", strings.Repeat("a", 64), "MySQL", true}, - {"way too long (100 chars)", strings.Repeat("a", 100), "MySQL", true}, - - // Tenant kind: stricter alphanumeric-only rule. - // The tenant Helm chart's tenant.name helper (packages/apps/tenant/templates/_helpers.tpl) - // splits Release.Name on "-" and fails unless the result is exactly - // ["tenant", ""]. Any dash inside breaks that invariant, so - // the aggregated API must reject tenant names containing dashes up-front - // with a specific error — instead of letting Flux reconciliation fail later. - {"tenant alphanumeric simple", "foo", "Tenant", false}, - {"tenant alphanumeric with digits", "foo123", "Tenant", false}, - {"tenant single char", "a", "Tenant", false}, - {"tenant single hyphen", "foo-bar", "Tenant", true}, - {"tenant leading hyphen", "-foo", "Tenant", true}, - {"tenant trailing hyphen", "foo-", "Tenant", true}, - {"tenant double hyphen", "foo--bar", "Tenant", true}, - {"tenant uppercase", "Foo", "Tenant", true}, - {"tenant underscore", "foo_bar", "Tenant", true}, - {"tenant empty", "", "Tenant", true}, - // Leading digit must be caught by the tenant-specific regex (not by - // falling through to DNS-1035) so the error message reflects the - // tenant contract — see TestValidateApplicationName_TenantErrorMessage. - {"tenant leading digit", "123foo", "Tenant", true}, + {"too long (64 chars)", strings.Repeat("a", 64), true}, + {"way too long (100 chars)", strings.Repeat("a", 100), true}, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - errs := ValidateApplicationName(tt.appName, tt.kindName, field.NewPath("metadata").Child("name")) + errs := ValidateApplicationName(tt.appName, field.NewPath("metadata").Child("name")) if (len(errs) > 0) != tt.wantError { - t.Errorf("ValidateApplicationName(%q, kind=%q) returned %d errors, wantError = %v, errors = %v", - tt.appName, tt.kindName, len(errs), tt.wantError, errs) + t.Errorf("ValidateApplicationName(%q) returned %d errors, wantError = %v, errors = %v", + tt.appName, len(errs), tt.wantError, errs) } }) } } - -// TestValidateApplicationName_TenantErrorMessage pins the contract that when -// a tenant name is invalid, the returned error message is specific to the -// tenant naming rule — not the generic DNS-1035 message. Otherwise users get -// back "must start with an alphabetic character" or similar and have no way -// to know the constraint is tied to the tenant Helm chart. -func TestValidateApplicationName_TenantErrorMessage(t *testing.T) { - // Every tenant-invalid name below must surface a tenant-specific error - // message. In particular, "123foo" starts with a digit — the original - // implementation let that fall through to DNS-1035 with a generic error; - // the regex is tightened specifically so this case fails up-front. - invalidTenantNames := []string{ - "foo-bar", // dash - "-foo", // leading dash - "foo-", // trailing dash - "foo--bar", // double dash - "Foo", // uppercase - "foo_bar", // underscore - "foo.bar", // dot - "foo bar", // space - "123foo", // leading digit — must not fall through to DNS-1035 - } - - const wantSubstring = "tenant names must" - - for _, name := range invalidTenantNames { - t.Run(name, func(t *testing.T) { - errs := ValidateApplicationName(name, "Tenant", field.NewPath("metadata").Child("name")) - if len(errs) == 0 { - t.Fatalf("expected error for tenant name %q, got none", name) - } - if !strings.Contains(errs[0].Detail, wantSubstring) { - t.Errorf("tenant name %q: error detail = %q, want substring %q (generic DNS-1035 message is not tenant-specific)", - name, errs[0].Detail, wantSubstring) - } - }) - } -} - -// TestValidateApplicationName_TenantLengthFallthrough documents the one -// invalid-tenant case where the error message is intentionally NOT tenant- -// specific: when a name contains only valid tenant characters but exceeds -// the DNS-1035 63-char label limit, the length error comes from DNS-1035 -// because length is not a tenant-specific constraint (every application -// kind is subject to the same Kubernetes label limit). REST.validateNameLength -// further tightens the limit using the Helm release prefix, so tenants cannot -// actually reach 64 characters end-to-end — this test only pins the package- -// level fallthrough so a future refactor does not accidentally promote the -// length error into tenant-specific wording. -// -// NOTE: this is an architectural decision, not a user-facing requirement. -// If tenant length is ever promoted into a tenant-specific rule (e.g. to -// include the Helm release prefix budget in this package's error message), -// this test should be updated or deleted — it is not a backwards-compat -// guarantee, just a checkpoint on the current layering. -func TestValidateApplicationName_TenantLengthFallthrough(t *testing.T) { - name := strings.Repeat("a", 64) // valid tenant pattern, too long for DNS-1035 - - errs := ValidateApplicationName(name, "Tenant", field.NewPath("metadata").Child("name")) - if len(errs) == 0 { - t.Fatalf("expected DNS-1035 length error for 64-char tenant name, got none") - } - // This error is the generic DNS-1035 one, NOT the tenant-specific message. - // We deliberately do not assert against the exact upstream DNS-1035 text - // (that would tie this test to a k8s.io/apimachinery internal string and - // break on unrelated upstream wording changes). - if strings.Contains(errs[0].Detail, "tenant names must") { - t.Errorf("64-char tenant name should surface the generic DNS-1035 error, got tenant-specific: %q", errs[0].Detail) - } -} diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go index 005fc640..bc2b4857 100644 --- a/pkg/apiserver/apiserver.go +++ b/pkg/apiserver/apiserver.go @@ -21,7 +21,6 @@ import ( "fmt" "time" - cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" helmv2 "github.com/fluxcd/helm-controller/api/v2" corev1 "k8s.io/api/core/v1" rbacv1 "k8s.io/api/rbac/v1" @@ -80,11 +79,6 @@ func init() { if err := rbacv1.AddToScheme(mgrScheme); err != nil { panic(fmt.Errorf("Failed to add RBAC types to scheme: %w", err)) } - - // Register Cozystack types for WorkloadMonitor queries. - if err := cozyv1alpha1.AddToScheme(mgrScheme); err != nil { - panic(fmt.Errorf("failed to add Cozystack types to scheme: %w", err)) - } // Add unversioned types. metav1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"}) @@ -174,7 +168,6 @@ func (c completedConfig) New() (*CozyServer, error) { &corev1.Namespace{}, &corev1.Service{}, &rbacv1.RoleBinding{}, - &cozyv1alpha1.WorkloadMonitor{}, ); err != nil { return nil, fmt.Errorf("failed to get informers: %w", err) } @@ -218,21 +211,15 @@ func (c completedConfig) New() (*CozyServer, error) { storage := applicationstorage.NewREST(cli, watchCli, &resConfig) appsV1alpha1Storage[resConfig.Application.Plural] = cozyregistry.RESTInPeace(storage) } - if err := InstallAppsAPIGroup(s.GenericAPIServer, appsV1alpha1Storage); err != nil { + appsApiGroupInfo := genericapiserver.NewDefaultAPIGroupInfo(apps.GroupName, Scheme, metav1.ParameterCodec, Codecs) + appsApiGroupInfo.VersionedResourcesStorageMap["v1alpha1"] = appsV1alpha1Storage + if err := s.GenericAPIServer.InstallAPIGroup(&appsApiGroupInfo); err != nil { return nil, err } return s, nil } -// InstallAppsAPIGroup registers the apps.cozystack.io API group on the given -// server using the provided storage map (plural name → rest.Storage). -func InstallAppsAPIGroup(server *genericapiserver.GenericAPIServer, storage map[string]rest.Storage) error { - info := genericapiserver.NewDefaultAPIGroupInfo(apps.GroupName, Scheme, metav1.ParameterCodec, Codecs) - info.VersionedResourcesStorageMap["v1alpha1"] = storage - return server.InstallAPIGroup(&info) -} - func mustGetInformers(ctx context.Context, mgr ctrl.Manager, types ...client.Object) error { for i := range types { if _, err := mgr.GetCache().GetInformer(ctx, types[i]); err != nil { diff --git a/pkg/cmd/server/openapi.go b/pkg/cmd/server/openapi.go index a75fc1a5..5d1b35db 100644 --- a/pkg/cmd/server/openapi.go +++ b/pkg/cmd/server/openapi.go @@ -5,11 +5,6 @@ import ( "fmt" "strings" - "github.com/cozystack/cozystack/pkg/apiserver" - "github.com/cozystack/cozystack/pkg/config" - sampleopenapi "github.com/cozystack/cozystack/pkg/generated/openapi" - "k8s.io/apiserver/pkg/endpoints/openapi" - genericapiserver "k8s.io/apiserver/pkg/server" "k8s.io/kube-openapi/pkg/spec3" "k8s.io/kube-openapi/pkg/validation/spec" ) @@ -215,9 +210,7 @@ func rewriteRefForKind(old, kind string) string { // ----------------------------------------------------------------------------- // OpenAPI **v3** post-processor // ----------------------------------------------------------------------------- -// BuildPostProcessV3 returns an OpenAPI v3 post-processor that clones base -// Application schemas into per-kind schemas and rewrites $ref pointers. -func BuildPostProcessV3(kindSchemas map[string]string) func(*spec3.OpenAPI) (*spec3.OpenAPI, error) { +func buildPostProcessV3(kindSchemas map[string]string) func(*spec3.OpenAPI) (*spec3.OpenAPI, error) { return func(doc *spec3.OpenAPI) (*spec3.OpenAPI, error) { if doc.Components == nil { @@ -337,39 +330,10 @@ func sanitizeForV2(s *spec.Schema) { } } -// KindSchemasFromConfig extracts the kind→OpenAPISchema mapping from a ResourceConfig. -func KindSchemasFromConfig(rc *config.ResourceConfig) map[string]string { - m := make(map[string]string, len(rc.Resources)) - for _, r := range rc.Resources { - m[r.Application.Kind] = r.Application.OpenAPISchema - } - return m -} - -// ConfigureOpenAPI sets up OpenAPI v2 and v3 on a GenericAPIServer Config, -// including the post-processors that clone Application schemas to per-kind schemas. -func ConfigureOpenAPI(cfg *genericapiserver.Config, kindSchemas map[string]string, title, version string) { - cfg.OpenAPIConfig = genericapiserver.DefaultOpenAPIConfig( - sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme), - ) - cfg.OpenAPIConfig.Info.Title = title - cfg.OpenAPIConfig.Info.Version = version - cfg.OpenAPIConfig.PostProcessSpec = BuildPostProcessV2(kindSchemas) - - cfg.OpenAPIV3Config = genericapiserver.DefaultOpenAPIV3Config( - sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme), - ) - cfg.OpenAPIV3Config.Info.Title = title - cfg.OpenAPIV3Config.Info.Version = version - cfg.OpenAPIV3Config.PostProcessSpec = BuildPostProcessV3(kindSchemas) -} - // ----------------------------------------------------------------------------- // OpenAPI **v2** (swagger) post-processor // ----------------------------------------------------------------------------- -// BuildPostProcessV2 returns a Swagger post-processor that clones base -// Application schemas into per-kind schemas and rewrites $ref pointers. -func BuildPostProcessV2(kindSchemas map[string]string) func(*spec.Swagger) (*spec.Swagger, error) { +func buildPostProcessV2(kindSchemas map[string]string) func(*spec.Swagger) (*spec.Swagger, error) { return func(sw *spec.Swagger) (*spec.Swagger, error) { defs := sw.Definitions base, ok1 := defs[baseRef] diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go index 7ebbbc89..9a688700 100644 --- a/pkg/cmd/server/start.go +++ b/pkg/cmd/server/start.go @@ -31,10 +31,12 @@ import ( corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1" "github.com/cozystack/cozystack/pkg/apiserver" "github.com/cozystack/cozystack/pkg/config" + sampleopenapi "github.com/cozystack/cozystack/pkg/generated/openapi" "github.com/spf13/cobra" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/runtime" utilerrors "k8s.io/apimachinery/pkg/util/errors" + "k8s.io/apiserver/pkg/endpoints/openapi" genericapiserver "k8s.io/apiserver/pkg/server" genericoptions "k8s.io/apiserver/pkg/server/options" utilfeature "k8s.io/apiserver/pkg/util/feature" @@ -160,34 +162,6 @@ func (o *CozyServerOptions) Complete() error { // Convert to ResourceConfig o.ResourceConfig = &config.ResourceConfig{} for _, crd := range crdList.Items { - release := config.ReleaseConfig{ - Prefix: crd.Spec.Release.Prefix, - Labels: crd.Spec.Release.Labels, - ChartRef: config.ChartRefConfig{ - Kind: crd.Spec.Release.ChartRef.Kind, - Name: crd.Spec.Release.ChartRef.Name, - Namespace: crd.Spec.Release.ChartRef.Namespace, - }, - } - // Per-Application HelmRelease Install/Upgrade timeout. Applications - // whose parent chart contains asynchronously-provisioned resources - // the chart itself depends on (for example, the Kamaji-provisioned - // admin-kubeconfig Secret for Kubernetes tenants) need a longer - // wait budget than the Flux default. Consumed by the REST storage - // layer when building the HelmRelease Spec. The parser rejects - // units Flux would reject at webhook time, so a bad annotation - // surfaces as a loud startup failure instead of a silent drop to - // defaults. - d, err := config.ParseHelmInstallTimeoutAnnotation( - crd.Annotations[config.HelmInstallTimeoutAnnotation], - ) - if err != nil { - return fmt.Errorf( - "ApplicationDefinition %q has invalid %s annotation: %w", - crd.Name, config.HelmInstallTimeoutAnnotation, err, - ) - } - release.HelmInstallTimeout = d resource := config.Resource{ Application: config.ApplicationConfig{ Kind: crd.Spec.Application.Kind, @@ -196,7 +170,15 @@ func (o *CozyServerOptions) Complete() error { ShortNames: []string{}, // TODO: implement shortnames OpenAPISchema: crd.Spec.Application.OpenAPISchema, }, - Release: release, + Release: config.ReleaseConfig{ + Prefix: crd.Spec.Release.Prefix, + Labels: crd.Spec.Release.Labels, + ChartRef: config.ChartRefConfig{ + Kind: crd.Spec.Release.ChartRef.Kind, + Name: crd.Spec.Release.ChartRef.Name, + Namespace: crd.Spec.Release.ChartRef.Namespace, + }, + }, } o.ResourceConfig.Resources = append(o.ResourceConfig.Resources, resource) } @@ -231,6 +213,10 @@ func (o *CozyServerOptions) Config() (*apiserver.Config, error) { serverConfig := genericapiserver.NewRecommendedConfig(apiserver.Codecs) + serverConfig.OpenAPIConfig = genericapiserver.DefaultOpenAPIConfig( + sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme), + ) + apiVersion := "0.1" if o.ResourceConfig != nil { raw, err := json.Marshal(o.ResourceConfig) @@ -241,8 +227,23 @@ func (o *CozyServerOptions) Config() (*apiserver.Config, error) { apiVersion = "0.1-" + hex.EncodeToString(sum[:8]) } - kindSchemas := KindSchemasFromConfig(o.ResourceConfig) - ConfigureOpenAPI(&serverConfig.Config, kindSchemas, "Cozy", apiVersion) + // capture schemas from config once for fast lookup inside the closure + kindSchemas := map[string]string{} + for _, r := range o.ResourceConfig.Resources { + kindSchemas[r.Application.Kind] = r.Application.OpenAPISchema + } + + serverConfig.OpenAPIConfig.Info.Title = "Cozy" + serverConfig.OpenAPIConfig.Info.Version = apiVersion + serverConfig.OpenAPIConfig.PostProcessSpec = buildPostProcessV2(kindSchemas) + + serverConfig.OpenAPIV3Config = genericapiserver.DefaultOpenAPIV3Config( + sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme), + ) + serverConfig.OpenAPIV3Config.Info.Title = "Cozy" + serverConfig.OpenAPIV3Config.Info.Version = apiVersion + + serverConfig.OpenAPIV3Config.PostProcessSpec = buildPostProcessV3(kindSchemas) // Set FeatureGate and EffectiveVersion - required for Complete() in Kubernetes v0.34.1 // Following the pattern from sample-apiserver, but creating EffectiveVersion directly diff --git a/pkg/config/config.go b/pkg/config/config.go index 21de27b2..1e123e2c 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -16,48 +16,6 @@ limitations under the License. package config -import ( - "fmt" - "regexp" - "time" -) - -// HelmInstallTimeoutAnnotation is the ApplicationDefinition metadata -// annotation key that overrides the Flux HelmRelease Install.Timeout and -// Upgrade.Timeout for a given Application kind. -const HelmInstallTimeoutAnnotation = "release.cozystack.io/helm-install-timeout" - -// helmTimeoutPattern mirrors the CRD validation pattern used by Flux -// helm-controller on HelmReleaseSpec.Install.Timeout (ms/s/m/h units only). -// time.ParseDuration accepts ns/us/µs, but Flux rejects them - parsing here -// with the same shape avoids feeding the controller a value it will later -// reject at webhook time. See -// github.com/fluxcd/helm-controller/api/v2 HelmReleaseSpec.Install.Timeout -// in the go module cache. -var helmTimeoutPattern = regexp.MustCompile(`^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$`) - -// ParseHelmInstallTimeoutAnnotation parses the value of the -// release.cozystack.io/helm-install-timeout annotation. The empty string is -// treated as "unset" and returns (0, nil) so callers can leave -// HelmInstallTimeout zeroed and let flux defaults apply. Values accepted by -// time.ParseDuration but rejected by Flux (ns/us/µs) return a helpful -// error instead of silently parsing and failing later at HelmRelease -// admission. -func ParseHelmInstallTimeoutAnnotation(raw string) (time.Duration, error) { - if raw == "" { - return 0, nil - } - if !helmTimeoutPattern.MatchString(raw) { - return 0, fmt.Errorf("must match %s (Flux accepts ms/s/m/h units only), got %q", - helmTimeoutPattern, raw) - } - d, err := time.ParseDuration(raw) - if err != nil { - return 0, fmt.Errorf("time.ParseDuration(%q): %w", raw, err) - } - return d, nil -} - // ResourceConfig represents the structure of the configuration file. type ResourceConfig struct { Resources []Resource `yaml:"resources"` @@ -83,12 +41,6 @@ type ReleaseConfig struct { Prefix string `yaml:"prefix"` Labels map[string]string `yaml:"labels"` ChartRef ChartRefConfig `yaml:"chartRef"` - // HelmInstallTimeout overrides the Flux HelmRelease Install.Timeout and - // Upgrade.Timeout for this Application kind. When zero, flux defaults - // apply. Populated from the - // release.cozystack.io/helm-install-timeout annotation on the - // ApplicationDefinition at start-up. - HelmInstallTimeout time.Duration `yaml:"helmInstallTimeout,omitempty"` } // ChartRefConfig references a Flux source artifact for the Helm chart. diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go deleted file mode 100644 index eb6990af..00000000 --- a/pkg/config/config_test.go +++ /dev/null @@ -1,119 +0,0 @@ -package config - -import ( - "strings" - "testing" - "time" -) - -// Cover the annotation parser used by cozystack-api at startup. The parser -// is consumed by pkg/cmd/server/start.go on every ApplicationDefinition; a -// typo here silently drops back to flux defaults and the Kubernetes tenant -// race described in cozystack#2412 reappears, so the table must exercise: -// - the unset path (empty string treated as "no override"), -// - every unit Flux accepts (ms, s, m, h), -// - compound forms (the CRD pattern accepts repeats), -// - units time.ParseDuration accepts but Flux rejects (ns, us, µs), -// - outright garbage. -func TestParseHelmInstallTimeoutAnnotation(t *testing.T) { - cases := []struct { - name string - input string - want time.Duration - wantErr bool - errMatch string - }{ - { - name: "empty string leaves flux defaults in place", - input: "", - want: 0, - }, - { - name: "minutes", - input: "15m", - want: 15 * time.Minute, - }, - { - name: "hours", - input: "1h", - want: time.Hour, - }, - { - name: "seconds", - input: "45s", - want: 45 * time.Second, - }, - { - name: "milliseconds", - input: "500ms", - want: 500 * time.Millisecond, - }, - { - name: "compound hour and minutes", - input: "2h30m", - want: 2*time.Hour + 30*time.Minute, - }, - { - name: "decimal minutes", - input: "1.5m", - want: 90 * time.Second, - }, - { - name: "nanoseconds rejected - Flux CRD pattern excludes ns", - input: "500ns", - wantErr: true, - errMatch: "Flux accepts ms/s/m/h units only", - }, - { - name: "microseconds rejected - Flux CRD pattern excludes us", - input: "500us", - wantErr: true, - errMatch: "Flux accepts ms/s/m/h units only", - }, - { - name: "microseconds unicode rejected", - input: "500µs", - wantErr: true, - errMatch: "Flux accepts ms/s/m/h units only", - }, - { - name: "bare digits rejected", - input: "15", - wantErr: true, - errMatch: "Flux accepts ms/s/m/h units only", - }, - { - name: "garbage rejected", - input: "abc", - wantErr: true, - errMatch: "Flux accepts ms/s/m/h units only", - }, - { - name: "negative rejected", - input: "-15m", - wantErr: true, - errMatch: "Flux accepts ms/s/m/h units only", - }, - } - - for _, tc := range cases { - t.Run(tc.name, func(t *testing.T) { - got, err := ParseHelmInstallTimeoutAnnotation(tc.input) - if tc.wantErr { - if err == nil { - t.Fatalf("expected error, got duration=%v", got) - } - if tc.errMatch != "" && !strings.Contains(err.Error(), tc.errMatch) { - t.Errorf("error %q does not contain %q", err.Error(), tc.errMatch) - } - return - } - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if got != tc.want { - t.Errorf("got %v, want %v", got, tc.want) - } - }) - } -} diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go index d233ecc3..7871bbe7 100644 --- a/pkg/registry/apps/application/rest.go +++ b/pkg/registry/apps/application/rest.go @@ -26,7 +26,6 @@ import ( "sync" "time" - cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" helmv2 "github.com/fluxcd/helm-controller/api/v2" corev1 "k8s.io/api/core/v1" metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion" @@ -155,8 +154,8 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation return nil, fmt.Errorf("expected *appsv1alpha1.Application object, got %T", obj) } - // Validate Application name format (DNS-1035 plus any kind-specific rules) - if errs := r.validateNameFormat(app.Name); len(errs) > 0 { + // Validate Application name conforms to DNS-1035 + if errs := validation.ValidateApplicationName(app.Name, field.NewPath("metadata").Child("name")); len(errs) > 0 { return nil, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, errs) } @@ -165,17 +164,6 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation return nil, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, nameLenErrs) } - // For Tenant applications, also validate that the computed workload - // namespace fits within the DNS-1123 label limit. A deeply-nested tenant - // can exceed the limit even when its own name passes the per-name Helm - // release length check, because the namespace is formed from the full - // ancestor chain. - if r.kindName == "Tenant" { - if nsErrs := r.validateTenantNamespaceLength(app.Namespace, app.Name); len(nsErrs) > 0 { - return nil, apierrors.NewInvalid(r.gvk.GroupKind(), app.Name, nsErrs) - } - } - // Validate that values don't contain reserved keys (starting with "_") if err := validateNoInternalKeys(app.Spec); err != nil { return nil, apierrors.NewBadRequest(err.Error()) @@ -704,49 +692,14 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio } customW.underlying = helmWatcher - // Start watch on WorkloadMonitor to detect pod readiness changes. - // For Tenant applications the WorkloadMonitor lives in a computed child - // namespace (see computeTenantNamespace), not in the HelmRelease namespace, - // so scoping the watch to `namespace` would miss all events. Use a - // cluster-wide watch in that case — label selectors still restrict the - // stream to the relevant kind/group. - wmLabelSelector := labels.NewSelector().Add(*appKindReq, *appGroupReq) - wmList := &cozyv1alpha1.WorkloadMonitorList{} - wmListOpts := &client.ListOptions{LabelSelector: wmLabelSelector} - if r.kindName != "Tenant" { - wmListOpts.Namespace = namespace - } - wmWatcher, err := r.w.Watch(ctx, wmList, wmListOpts) - if err != nil { - klog.Warningf("Failed to set up WorkloadMonitor watch, workload status changes won't trigger events: %v", err) - // Non-fatal: proceed without WorkloadMonitor watch - wmWatcher = nil - } - go func() { - // Capture wmWatcher for cleanup; the variable may be set to nil - // inside the loop when the channel closes, so defer must use this copy. - wmWatcherForCleanup := wmWatcher defer close(customW.resultChan) defer customW.underlying.Stop() - if wmWatcherForCleanup != nil { - defer wmWatcherForCleanup.Stop() - } // Track whether we've sent the initial-events-end bookmark initialEventsEndSent := !sendInitialEvents // If not sendInitialEvents, consider it already sent var lastResourceVersion string - // Buffer of WorkloadMonitor events that arrived before the initial - // snapshot finished. The watch-list contract requires the stream to - // deliver all ADDED events followed by the initial-events-end bookmark - // before any live updates, so we hold WM-triggered Modified events and - // replay them once the bookmark has been emitted. Without this, a - // workload whose status flips during the snapshot window (after the - // Application ADDED but before the bookmark) and then stops changing - // would leave the client with a stale WorkloadsReady forever. - var pendingWMEvents []watch.Event - // Get the starting resourceVersion from options // If client provides resourceVersion (e.g., from a previous List), we should skip // objects with resourceVersion <= startingRV (client already has them) @@ -757,19 +710,6 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio } } - drainPendingWMEvents := func() { - for _, ev := range pendingWMEvents { - select { - case customW.resultChan <- ev: - case <-customW.stopChan: - return - case <-ctx.Done(): - return - } - } - pendingWMEvents = nil - } - // Helper function to send initial-events-end bookmark sendInitialEventsEndBookmark := func() { if initialEventsEndSent { @@ -794,11 +734,8 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio select { case customW.resultChan <- bookmarkEvent: case <-customW.stopChan: - return case <-ctx.Done(): - return } - drainPendingWMEvents() } // Process watch events @@ -826,10 +763,8 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio APIVersion: appsv1alpha1.SchemeGroupVersion.String(), Kind: r.kindName, } - justFlipped := false if !initialEventsEndSent { initialEventsEndSent = true - justFlipped = true bookmarkApp.SetAnnotations(map[string]string{ "k8s.io/initial-events-end": "true", }) @@ -846,9 +781,6 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio case <-ctx.Done(): return } - if justFlipped { - drainPendingWMEvents() - } } continue } @@ -936,104 +868,6 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio return } - case wmEvent, ok := <-wmResultChan(wmWatcher): - if !ok { - klog.V(4).Info("WorkloadMonitor watcher closed") - wmWatcher = nil - continue - } - if wmEvent.Type == watch.Bookmark || wmEvent.Type == watch.Error { - if wmEvent.Type == watch.Error { - klog.V(4).Infof("WorkloadMonitor watch error event: %v", wmEvent.Object) - } - continue - } - wm, ok := wmEvent.Object.(*cozyv1alpha1.WorkloadMonitor) - if !ok { - continue - } - // All WM event types (Added/Modified/Deleted) produce a Modified - // Application event because the Application itself is what changed - // from the client's perspective. - wmAppName, hasLabel := wm.Labels[ApplicationNameLabel] - if !hasLabel { - continue - } - // Filter: skip WorkloadMonitor events for applications not matching - // the watch scope (single-resource or field-selector filtered watches) - hrName := r.releaseConfig.Prefix + wmAppName - if filterByName != "" && hrName != filterByName { - continue - } - if resourceName != "" && wmAppName != resourceName { - continue - } - - // Locate the owning HelmRelease. For most application kinds the - // WorkloadMonitor and its HelmRelease live in the same namespace, - // but Tenant workloads live in a child namespace (see - // computeTenantNamespace) while the HelmRelease remains in the - // parent/requested namespace — so the WM-to-HR namespace mapping - // differs. - hrNS := wm.Namespace - if r.kindName == "Tenant" { - hrNS = namespace - // Filter out WM events whose child namespace does not - // correspond to the Tenant in our watched namespace, since - // the cluster-wide WM watch delivers events for all tenants. - if r.computeTenantNamespace(namespace, wmAppName) != wm.Namespace { - continue - } - if !fieldFilter.MatchesNamespace(hrNS) { - continue - } - } else if !fieldFilter.MatchesNamespace(hrNS) { - continue - } - hr := &helmv2.HelmRelease{} - if err := r.c.Get(ctx, client.ObjectKey{Namespace: hrNS, Name: hrName}, hr); err != nil { - klog.V(4).Infof("Cannot find HelmRelease %s/%s for WorkloadMonitor event: %v", hrNS, hrName, err) - continue - } - // Pass the fresh WorkloadMonitor so conversion uses the latest - // operational status even if the cache (r.c) has not yet - // observed this watch event. - app, err := r.ConvertHelmReleaseToApplicationWithMonitor(ctx, hr, wm) - if err != nil { - klog.V(4).Infof("Error converting HelmRelease for WorkloadMonitor event: %v", err) - continue - } - // Apply label selector filtering (same as HelmRelease event path) - if options.LabelSelector != nil { - sel, err := labels.Parse(options.LabelSelector.String()) - if err != nil { - klog.Errorf("Invalid label selector: %v", err) - continue - } - if !sel.Matches(labels.Set(app.Labels)) { - continue - } - } - // Use the WorkloadMonitor's ResourceVersion for the emitted event - // so clients see a monotonically increasing RV and don't skip this update. - app.SetResourceVersion(wm.GetResourceVersion()) - outEvent := watch.Event{Type: watch.Modified, Object: &app} - // Buffer WM-triggered events that arrive before the - // initial-events-end bookmark. They will be replayed in order - // immediately after the bookmark is emitted. - if !initialEventsEndSent { - pendingWMEvents = append(pendingWMEvents, outEvent) - continue - } - lastResourceVersion = wm.GetResourceVersion() - select { - case customW.resultChan <- outEvent: - case <-customW.stopChan: - return - case <-ctx.Done(): - return - } - case <-customW.stopChan: return case <-ctx.Done(): @@ -1046,15 +880,6 @@ func (r *REST) Watch(ctx context.Context, options *metainternalversion.ListOptio return customW, nil } -// wmResultChan returns the result channel of a WorkloadMonitor watcher, or a nil -// channel (which blocks forever in select) if the watcher is nil. -func wmResultChan(w watch.Interface) <-chan watch.Event { - if w == nil { - return nil - } - return w.ResultChan() -} - // customWatcher wraps the original watcher and filters/converts events type customWatcher struct { resultChan chan watch.Event @@ -1158,21 +983,12 @@ func filterPrefixedMap(original map[string]string, prefix string) map[string]str return processed } -// ConvertHelmReleaseToApplication converts a HelmRelease to an Application. +// ConvertHelmReleaseToApplication converts a HelmRelease to an Application func (r *REST) ConvertHelmReleaseToApplication(ctx context.Context, hr *helmv2.HelmRelease) (appsv1alpha1.Application, error) { - return r.ConvertHelmReleaseToApplicationWithMonitor(ctx, hr, nil) -} - -// ConvertHelmReleaseToApplicationWithMonitor converts a HelmRelease to an -// Application, optionally overriding the cached copy of a WorkloadMonitor with -// a fresher version received from the watch client. This prevents the emitted -// Application object from carrying stale WorkloadsReady data when r.c (cache) -// lags behind r.w (watch). -func (r *REST) ConvertHelmReleaseToApplicationWithMonitor(ctx context.Context, hr *helmv2.HelmRelease, freshMonitor *cozyv1alpha1.WorkloadMonitor) (appsv1alpha1.Application, error) { klog.V(6).Infof("Converting HelmRelease to Application for resource %s", hr.GetName()) // Convert HelmRelease struct to Application struct - app, err := r.convertHelmReleaseToApplication(ctx, hr, freshMonitor) + app, err := r.convertHelmReleaseToApplication(ctx, hr) if err != nil { klog.Errorf("Error converting from HelmRelease to Application: %v", err) return appsv1alpha1.Application{}, err @@ -1233,19 +1049,6 @@ func validateNoInternalKeys(values *apiextv1.JSON) error { // chart-generated resource suffixes within the 63-char DNS-1035 label limit. const maxHelmReleaseName = 53 -// maxNamespaceName is the DNS-1123 label limit for Kubernetes namespace names. -// The tenant Helm chart creates a Namespace whose name is the computed -// workload namespace (parent namespace + "-" + tenant name), so the total -// must fit inside a single 63-char DNS-1123 label. -const maxNamespaceName = 63 - -// validateNameFormat checks an Application name against DNS-1035 and any -// kind-specific format rules (e.g. Tenant names must be alphanumeric — see -// validation.ValidateApplicationName for the reasoning). -func (r *REST) validateNameFormat(name string) field.ErrorList { - return validation.ValidateApplicationName(name, r.kindName, field.NewPath("metadata").Child("name")) -} - // validateNameLength checks that the application name won't exceed Kubernetes limits. // prefix + name must fit within the Helm release name limit (53 chars). func (r *REST) validateNameLength(name string) field.ErrorList { @@ -1267,29 +1070,8 @@ func (r *REST) validateNameLength(name string) field.ErrorList { return allErrs } -// validateTenantNamespaceLength checks that the computed workload namespace -// for a Tenant application fits within the DNS-1123 label limit. The namespace -// is formed by dash-joining the parent namespace with the tenant name, so -// deep nesting can exceed the limit even when each individual name passes the -// per-name Helm release length check. -func (r *REST) validateTenantNamespaceLength(currentNamespace, tenantName string) field.ErrorList { - fldPath := field.NewPath("metadata").Child("name") - allErrs := field.ErrorList{} - - computed := r.computeTenantNamespace(currentNamespace, tenantName) - if len(computed) > maxNamespaceName { - allErrs = append(allErrs, field.Invalid(fldPath, tenantName, - fmt.Sprintf("computed tenant namespace %q would be %d characters, which exceeds the %d-character Kubernetes namespace limit; shorten the tenant name or reduce ancestor nesting depth", - computed, len(computed), maxNamespaceName))) - } - return allErrs -} - -// convertHelmReleaseToApplication implements the actual conversion logic. -// The optional freshMonitor is used to override the cache copy of a -// WorkloadMonitor when a newer version was delivered via the watch client — -// see ConvertHelmReleaseToApplicationWithMonitor for the rationale. -func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.HelmRelease, freshMonitor *cozyv1alpha1.WorkloadMonitor) (appsv1alpha1.Application, error) { +// convertHelmReleaseToApplication implements the actual conversion logic +func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.HelmRelease) (appsv1alpha1.Application, error) { // Filter out internal keys (starting with "_") from spec filteredSpec := filterInternalKeys(hr.Spec.Values) @@ -1326,81 +1108,10 @@ func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.H }) } } - // Enrich conditions with WorkloadMonitor operational status. - // Tenant workloads live in a child namespace (computed from the Tenant name), - // not in the same namespace as the owning HelmRelease — look there instead. - workloadsNS := hr.Namespace - if r.kindName == "Tenant" { - workloadsNS = r.computeTenantNamespace(hr.Namespace, app.Name) - } - ws, wsErr := r.getWorkloadsOperational(ctx, workloadsNS, app.Name, freshMonitor) - // Derive a stable LastTransitionTime: use the owning HelmRelease's own - // condition update time (or CreationTimestamp as a floor) so that repeated - // conversions of the same underlying state produce identical timestamps. - wrTransition := hr.CreationTimestamp - for _, c := range hr.GetConditions() { - if c.LastTransitionTime.After(wrTransition.Time) { - wrTransition = c.LastTransitionTime - } - } - if ws.transitionTime.After(wrTransition.Time) { - wrTransition = ws.transitionTime - } - if wrTransition.IsZero() { - // Fallback for objects that somehow have no timestamps at all - // (e.g. hand-crafted test fixtures). In production HelmReleases - // always carry a CreationTimestamp, so the stable branch above - // is used. - wrTransition = metav1.Now() - } - if wsErr != nil { - // Fail-open: if we can't query WorkloadMonitors (e.g., informer cache not ready), - // don't override Ready. Prefer operational availability over safety. - // The WorkloadsReady=Unknown condition still signals the issue to the user. - klog.Warningf("Failed to check workload monitors for %s/%s: %v", workloadsNS, app.Name, wsErr) - conditions = append(conditions, metav1.Condition{ - Type: "WorkloadsReady", - Status: metav1.ConditionUnknown, - LastTransitionTime: wrTransition, - Reason: "Error", - Message: fmt.Sprintf("Failed to check workload status: %v", wsErr), - }) - } else if ws.found { - workloadsCondition := metav1.Condition{ - Type: "WorkloadsReady", - LastTransitionTime: wrTransition, - Reason: "WorkloadMonitorCheck", - } - switch { - case !ws.operational: - // Concrete failure takes priority over unknown/pending state - workloadsCondition.Status = metav1.ConditionFalse - workloadsCondition.Message = "One or more workloads are not operational" - case ws.unknown: - workloadsCondition.Status = metav1.ConditionUnknown - workloadsCondition.Reason = "Pending" - workloadsCondition.Message = "One or more workloads have not been reconciled yet" - default: - workloadsCondition.Status = metav1.ConditionTrue - workloadsCondition.Message = "All workloads are operational" - } - conditions = append(conditions, workloadsCondition) - - // Intentionally do NOT override the Ready condition based on WorkloadsReady. - // Ready continues to reflect HelmRelease state only, which: - // - preserves backward compatibility with existing tooling (kubectl wait, - // GitOps health checks) that expect Ready to match HelmRelease - // - avoids false-negative Ready=False during normal startup windows where - // pods are still coming up but WorkloadMonitor has already reported - // Operational=false due to availableReplicas < MinReplicas - // WorkloadsReady is a separate condition that surfaces workload health - // independently — users and dashboards can observe it for operational visibility. - } - app.SetConditions(conditions) // Add namespace field for Tenant applications - if r.kindName == validation.TenantKind { + if r.kindName == "Tenant" { app.Status.Namespace = r.computeTenantNamespace(hr.Namespace, app.Name) externalIPsCount, err := r.countTenantExternalIPs(ctx, app.Status.Namespace) if err != nil { @@ -1413,79 +1124,6 @@ func (r *REST) convertHelmReleaseToApplication(ctx context.Context, hr *helmv2.H return app, nil } -// workloadsStatus holds the aggregated operational status of WorkloadMonitors. -type workloadsStatus struct { - operational bool - found bool - unknown bool // true when at least one monitor has nil Operational (not yet reconciled) - // transitionTime is the most recent metadata update time across the - // matching monitors. Used as WorkloadsReady.LastTransitionTime so that - // repeated conversions for the same underlying state produce stable - // timestamps (preserving the Kubernetes contract that identical - // resource versions represent identical content). - transitionTime metav1.Time -} - -// getWorkloadsOperational checks WorkloadMonitor resources for an application and returns -// aggregated operational status. If no monitors exist, returns found=false. -// When freshOverride is non-nil, its status replaces the cached copy for the -// corresponding monitor — this keeps the result consistent with watch events -// when the cache (r.c) lags behind the watch client (r.w). -func (r *REST) getWorkloadsOperational(ctx context.Context, namespace, appName string, freshOverride *cozyv1alpha1.WorkloadMonitor) (workloadsStatus, error) { - monitors := &cozyv1alpha1.WorkloadMonitorList{} - if err := r.c.List(ctx, monitors, - client.InNamespace(namespace), - client.MatchingLabels{ - appsv1alpha1.ApplicationKindLabel: r.kindName, - appsv1alpha1.ApplicationGroupLabel: r.gvk.Group, - appsv1alpha1.ApplicationNameLabel: appName, - }, - ); err != nil { - return workloadsStatus{}, err - } - // Ensure the freshOverride is represented in the aggregation even when - // the cache has not yet observed it (brand-new resource) or is behind. - replaced := false - if freshOverride != nil { - for i := range monitors.Items { - if monitors.Items[i].UID == freshOverride.UID || - (monitors.Items[i].Name == freshOverride.Name && monitors.Items[i].Namespace == freshOverride.Namespace) { - monitors.Items[i] = *freshOverride - replaced = true - break - } - } - if !replaced { - monitors.Items = append(monitors.Items, *freshOverride) - } - } - if len(monitors.Items) == 0 { - return workloadsStatus{operational: true, found: false}, nil - } - operational := true - unknown := false - var latest metav1.Time - for _, m := range monitors.Items { - if m.Status.Operational == nil { - unknown = true - } else if !*m.Status.Operational { - operational = false - } - // Pick the most recent monitor mtime as a stable transition time. - if t := latestMonitorTime(&m); t.After(latest.Time) { - latest = t - } - } - return workloadsStatus{operational: operational, found: true, unknown: unknown, transitionTime: latest}, nil -} - -// latestMonitorTime returns the most recent timestamp associated with a -// WorkloadMonitor — currently only the object creation time is guaranteed. -// Status does not carry a transition time, so we fall back to CreationTimestamp. -func latestMonitorTime(m *cozyv1alpha1.WorkloadMonitor) metav1.Time { - return m.CreationTimestamp -} - // convertApplicationToHelmRelease implements the actual conversion logic func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (*helmv2.HelmRelease, error) { helmRelease := &helmv2.HelmRelease{ @@ -1528,24 +1166,6 @@ func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (* }, } - // Per-Application HelmRelease wait budget. The mechanism is generic: - // an ApplicationDefinition that sets - // release.cozystack.io/helm-install-timeout gets Install.Timeout and - // Upgrade.Timeout populated from ReleaseConfig.HelmInstallTimeout - // (parsed at startup). Applications that leave it unset keep flux - // defaults so their failed installs remediate on the normal cadence. - // Today only kubernetes-rd carries the annotation because the - // Kubernetes Application's parent chart contains CAPI/Kamaji - // resources whose admin-kubeconfig Secret is provisioned - // asynchronously and Kamaji cold-start routinely exceeds flux's - // default wait budget; any future kind with the same shape can opt - // in by setting the same annotation. - if r.releaseConfig.HelmInstallTimeout > 0 { - timeout := metav1.Duration{Duration: r.releaseConfig.HelmInstallTimeout} - helmRelease.Spec.Install.Timeout = &timeout - helmRelease.Spec.Upgrade.Timeout = &timeout - } - return helmRelease, nil } diff --git a/pkg/registry/apps/application/rest_conditions_test.go b/pkg/registry/apps/application/rest_conditions_test.go deleted file mode 100644 index 185f59b2..00000000 --- a/pkg/registry/apps/application/rest_conditions_test.go +++ /dev/null @@ -1,331 +0,0 @@ -package application - -import ( - "context" - "testing" - - cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" - helmv2 "github.com/fluxcd/helm-controller/api/v2" - appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1" - "github.com/cozystack/cozystack/pkg/config" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/utils/ptr" - "sigs.k8s.io/controller-runtime/pkg/client/fake" -) - -func findCondition(conditions []metav1.Condition, condType string) *metav1.Condition { - for i := range conditions { - if conditions[i].Type == condType { - return &conditions[i] - } - } - return nil -} - -func makeHelmRelease(name, namespace string) *helmv2.HelmRelease { - hr := &helmv2.HelmRelease{ - ObjectMeta: metav1.ObjectMeta{ - Name: name, - Namespace: namespace, - Labels: map[string]string{ - ApplicationKindLabel: "PostgreSQL", - ApplicationGroupLabel: "apps.cozystack.io", - ApplicationNameLabel: "mydb", - }, - }, - } - return hr -} - -func TestConvertConditions_WorkloadsReadyAdded(t *testing.T) { - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(true), - }, - } - - r := newTestRESTWithSchemes(monitor) - hr := makeHelmRelease("postgresql-mydb", "default") - hr.Status.Conditions = []metav1.Condition{ - {Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"}, - {Type: "Released", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Released"}, - } - - app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - - wc := findCondition(app.GetConditions(), "WorkloadsReady") - if wc == nil { - t.Fatal("expected WorkloadsReady condition to be present") - } - if wc.Status != metav1.ConditionTrue { - t.Errorf("expected WorkloadsReady=True, got %s", wc.Status) - } - - rc := findCondition(app.GetConditions(), "Ready") - if rc == nil { - t.Fatal("expected Ready condition to be present") - } - if rc.Status != metav1.ConditionTrue { - t.Errorf("expected Ready=True, got %s", rc.Status) - } -} - -func TestConvertConditions_ReadyNotOverriddenWhenWorkloadsNotReady(t *testing.T) { - // Ready must reflect HelmRelease state only. WorkloadsReady is a separate - // signal that users/dashboards can observe independently. - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(false), - }, - } - - r := newTestRESTWithSchemes(monitor) - hr := makeHelmRelease("postgresql-mydb", "default") - hr.Status.Conditions = []metav1.Condition{ - {Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"}, - } - - app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - - wc := findCondition(app.GetConditions(), "WorkloadsReady") - if wc == nil { - t.Fatal("expected WorkloadsReady condition to be present") - } - if wc.Status != metav1.ConditionFalse { - t.Errorf("expected WorkloadsReady=False, got %s", wc.Status) - } - - rc := findCondition(app.GetConditions(), "Ready") - if rc == nil { - t.Fatal("expected Ready condition to be present") - } - if rc.Status != metav1.ConditionTrue { - t.Errorf("expected Ready=True (reflects HelmRelease only), got %s", rc.Status) - } - if rc.Reason != "Succeeded" { - t.Errorf("expected Ready.Reason=Succeeded (unchanged), got %s", rc.Reason) - } -} - -func TestConvertConditions_NoOverrideWhenNoMonitors(t *testing.T) { - r := newTestRESTWithSchemes() - hr := makeHelmRelease("postgresql-mydb", "default") - hr.Status.Conditions = []metav1.Condition{ - {Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"}, - } - - app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - - wc := findCondition(app.GetConditions(), "WorkloadsReady") - if wc != nil { - t.Error("expected no WorkloadsReady condition when no monitors exist") - } - - rc := findCondition(app.GetConditions(), "Ready") - if rc == nil { - t.Fatal("expected Ready condition to be present") - } - if rc.Status != metav1.ConditionTrue { - t.Errorf("expected Ready=True unchanged, got %s", rc.Status) - } -} - -func TestConvertConditions_ReadyStaysTrue_WhenAllOperational(t *testing.T) { - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(true), - }, - } - - r := newTestRESTWithSchemes(monitor) - hr := makeHelmRelease("postgresql-mydb", "default") - hr.Status.Conditions = []metav1.Condition{ - {Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Release applied"}, - {Type: "Released", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "Released"}, - } - - app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - - rc := findCondition(app.GetConditions(), "Ready") - if rc == nil { - t.Fatal("expected Ready condition") - } - if rc.Status != metav1.ConditionTrue { - t.Errorf("expected Ready=True when all workloads operational, got %s", rc.Status) - } - if rc.Reason != "Succeeded" { - t.Errorf("expected Ready.Reason=Succeeded (unchanged), got %s", rc.Reason) - } -} - -func TestConvertConditions_WorkloadsReadyTimestampIsNonZero(t *testing.T) { - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(true), - }, - } - - r := newTestRESTWithSchemes(monitor) - hr := makeHelmRelease("postgresql-mydb", "default") - // No Ready condition — HR still being reconciled - hr.Status.Conditions = []metav1.Condition{} - - app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - - wc := findCondition(app.GetConditions(), "WorkloadsReady") - if wc == nil { - t.Fatal("expected WorkloadsReady condition") - } - if wc.LastTransitionTime.IsZero() { - t.Error("expected non-zero LastTransitionTime") - } -} - -func TestConvertConditions_WorkloadsReadyUnknownWhenNilOperational(t *testing.T) { - monitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: nil, // Not yet reconciled - }, - } - - r := newTestRESTWithSchemes(monitor) - hr := makeHelmRelease("postgresql-mydb", "default") - hr.Status.Conditions = []metav1.Condition{ - {Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"}, - } - - app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - - wc := findCondition(app.GetConditions(), "WorkloadsReady") - if wc == nil { - t.Fatal("expected WorkloadsReady condition") - } - if wc.Status != metav1.ConditionUnknown { - t.Errorf("expected WorkloadsReady=Unknown for nil Operational, got %s", wc.Status) - } - - // Ready should NOT be overridden for unknown — prefer availability during startup - rc := findCondition(app.GetConditions(), "Ready") - if rc == nil { - t.Fatal("expected Ready condition") - } - if rc.Status != metav1.ConditionTrue { - t.Errorf("expected Ready=True when workloads unknown (pending), got %s", rc.Status) - } -} - -func TestConvertConditions_WorkloadsReadyUnknownOnError(t *testing.T) { - // Create a client with only HelmRelease scheme — WorkloadMonitor List will fail - scheme := runtime.NewScheme() - _ = helmv2.AddToScheme(scheme) - // Deliberately NOT registering cozyv1alpha1 so that List returns an error - - c := fake.NewClientBuilder().WithScheme(scheme).Build() - r := NewREST(c, nil, &config.Resource{ - Application: config.ApplicationConfig{ - Kind: "PostgreSQL", - Plural: "postgresqls", - Singular: "postgresql", - }, - Release: config.ReleaseConfig{ - Prefix: "postgresql-", - }, - }) - - hr := makeHelmRelease("postgresql-mydb", "default") - hr.CreationTimestamp = metav1.Now() - hr.Status.Conditions = []metav1.Condition{ - {Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"}, - } - - app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - - wc := findCondition(app.GetConditions(), "WorkloadsReady") - if wc == nil { - t.Fatal("expected WorkloadsReady condition with Unknown status on error") - } - if wc.Status != metav1.ConditionUnknown { - t.Errorf("expected WorkloadsReady=Unknown, got %s", wc.Status) - } - if wc.Reason != "Error" { - t.Errorf("expected reason=Error, got %s", wc.Reason) - } - - // Ready should NOT be overridden on error (fail-open: prefer availability) - rc := findCondition(app.GetConditions(), "Ready") - if rc == nil { - t.Fatal("expected Ready condition") - } - if rc.Status != metav1.ConditionTrue { - t.Errorf("expected Ready=True (fail-open on error), got %s", rc.Status) - } -} - - diff --git a/pkg/registry/apps/application/rest_timeout_test.go b/pkg/registry/apps/application/rest_timeout_test.go deleted file mode 100644 index 85ac0b97..00000000 --- a/pkg/registry/apps/application/rest_timeout_test.go +++ /dev/null @@ -1,116 +0,0 @@ -package application - -import ( - "testing" - "time" - - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - - appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1" - "github.com/cozystack/cozystack/pkg/config" -) - -func newRESTForTimeout(kind, prefix string, helmInstallTimeout time.Duration) *REST { - return &REST{ - kindName: kind, - releaseConfig: config.ReleaseConfig{ - Prefix: prefix, - ChartRef: config.ChartRefConfig{ - Kind: "HelmChart", - Name: "x", - Namespace: "cozy-system", - }, - HelmInstallTimeout: helmInstallTimeout, - }, - } -} - -// Table-driven: every Application kind carries a per-CRD HelmRelease wait -// budget. The Kubernetes kind's parent chart contains CAPI/Kamaji resources -// whose admin-kubeconfig Secret is provisioned asynchronously, so its -// ApplicationDefinition sets release.cozystack.io/helm-install-timeout=15m -// (or longer). Other kinds leave the annotation unset and keep flux defaults -// so their failed installs remediate on the normal cadence. The test must -// cover both paths: a kind with the timeout set and one without. -func TestConvertApplicationToHelmRelease_AppliesReleaseConfigTimeout(t *testing.T) { - cases := []struct { - name string - kind string - prefix string - configured time.Duration - wantSet bool - }{ - { - name: "Kubernetes kind with 15m configured gets Install and Upgrade Timeout", - kind: "Kubernetes", - prefix: "kubernetes-", - configured: 15 * time.Minute, - wantSet: true, - }, - { - // Fictional kind on purpose: the test is about the unset path - // regardless of which real Application kind ends up needing a - // timeout override. Using a real kind name would create false - // coupling to that Application's ApplicationDefinition. - name: "unrelated kind without configured timeout keeps flux defaults", - kind: "PlaceholderKindForDefaults", - prefix: "placeholder-", - configured: 0, - wantSet: false, - }, - { - name: "arbitrary future kind with 20m configured gets 20m", - kind: "TalosCluster", - prefix: "talos-", - configured: 20 * time.Minute, - wantSet: true, - }, - } - - for _, tc := range cases { - t.Run(tc.name, func(t *testing.T) { - r := newRESTForTimeout(tc.kind, tc.prefix, tc.configured) - app := &appsv1alpha1.Application{ - ObjectMeta: metav1.ObjectMeta{Name: "example", Namespace: "tenant-root"}, - } - - hr, err := r.convertApplicationToHelmRelease(app) - if err != nil { - t.Fatalf("convertApplicationToHelmRelease returned error: %v", err) - } - - if hr.Spec.Install == nil || hr.Spec.Upgrade == nil { - t.Fatalf("Spec.Install/Upgrade must be non-nil") - } - - if tc.wantSet { - if hr.Spec.Install.Timeout == nil { - t.Fatalf("Spec.Install.Timeout must be set when HelmInstallTimeout=%v", tc.configured) - } - if hr.Spec.Install.Timeout.Duration != tc.configured { - t.Errorf("Spec.Install.Timeout = %v, want %v", hr.Spec.Install.Timeout.Duration, tc.configured) - } - if hr.Spec.Upgrade.Timeout == nil { - t.Fatalf("Spec.Upgrade.Timeout must be set when HelmInstallTimeout=%v", tc.configured) - } - if hr.Spec.Upgrade.Timeout.Duration != tc.configured { - t.Errorf("Spec.Upgrade.Timeout = %v, want %v", hr.Spec.Upgrade.Timeout.Duration, tc.configured) - } - } else { - if hr.Spec.Install.Timeout != nil { - t.Errorf("Spec.Install.Timeout must be nil when HelmInstallTimeout=0, got %v", hr.Spec.Install.Timeout.Duration) - } - if hr.Spec.Upgrade.Timeout != nil { - t.Errorf("Spec.Upgrade.Timeout must be nil when HelmInstallTimeout=0, got %v", hr.Spec.Upgrade.Timeout.Duration) - } - } - - if hr.Spec.Install.Remediation == nil || hr.Spec.Install.Remediation.Retries != -1 { - t.Errorf("Spec.Install.Remediation.Retries must remain -1, got %+v", hr.Spec.Install.Remediation) - } - if hr.Spec.Upgrade.Remediation == nil || hr.Spec.Upgrade.Remediation.Retries != -1 { - t.Errorf("Spec.Upgrade.Remediation.Retries must remain -1, got %+v", hr.Spec.Upgrade.Remediation) - } - }) - } -} diff --git a/pkg/registry/apps/application/rest_validation_test.go b/pkg/registry/apps/application/rest_validation_test.go index b806161c..c5d331b2 100644 --- a/pkg/registry/apps/application/rest_validation_test.go +++ b/pkg/registry/apps/application/rest_validation_test.go @@ -17,207 +17,12 @@ limitations under the License. package application import ( - "context" - "fmt" "strings" "testing" - helmv2 "github.com/fluxcd/helm-controller/api/v2" - corev1 "k8s.io/api/core/v1" - apierrors "k8s.io/apimachinery/pkg/api/errors" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/runtime/schema" - "k8s.io/apiserver/pkg/endpoints/request" - "k8s.io/apiserver/pkg/registry/rest" - "sigs.k8s.io/controller-runtime/pkg/client/fake" - - appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1" - "github.com/cozystack/cozystack/pkg/apis/apps/validation" "github.com/cozystack/cozystack/pkg/config" ) -func TestValidateNameFormat(t *testing.T) { - tests := []struct { - name string - kindName string - appName string - wantError bool - }{ - // Non-tenant kinds follow DNS-1035 only — hyphens are allowed. - {"non-tenant accepts hyphen", "MySQL", "my-db", false}, - {"non-tenant accepts double hyphen", "MySQL", "my--db", false}, - {"non-tenant rejects uppercase", "MySQL", "MyDB", true}, - - // Tenant kind enforces alphanumeric-only — see - // packages/apps/tenant/templates/_helpers.tpl for the reason. - {"tenant accepts alphanumeric", validation.TenantKind, "foo", false}, - {"tenant accepts digits", validation.TenantKind, "foo123", false}, - {"tenant rejects single hyphen", validation.TenantKind, "foo-bar", true}, - {"tenant rejects leading hyphen", validation.TenantKind, "-foo", true}, - {"tenant rejects trailing hyphen", validation.TenantKind, "foo-", true}, - {"tenant rejects uppercase", validation.TenantKind, "Foo", true}, - {"tenant rejects underscore", validation.TenantKind, "foo_bar", true}, - {"tenant rejects empty", validation.TenantKind, "", true}, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - r := &REST{kindName: tt.kindName} - - errs := r.validateNameFormat(tt.appName) - - if tt.wantError && len(errs) == 0 { - t.Errorf("expected error for name %q (kind=%q), got none", tt.appName, tt.kindName) - } - if !tt.wantError && len(errs) > 0 { - t.Errorf("unexpected error for name %q (kind=%q): %v", tt.appName, tt.kindName, errs) - } - }) - } -} - -// TestUpdate_ForceAllowCreate_RejectsTenantDashName pins the wiring from the -// Update → Create fall-through path. When a user runs `kubectl apply` and -// the object does not yet exist, Kubernetes routes the request through -// REST.Update with forceAllowCreate=true, which delegates to REST.Create -// (rest.go:452). Without this test, a future refactor could quietly reroute -// that delegation and bypass the tenant name check — unit tests of the -// pure r.validateNameFormat method would still pass while upsert-style -// kubectl apply regressed back to accepting tenant names with dashes. -func TestUpdate_ForceAllowCreate_RejectsTenantDashName(t *testing.T) { - scheme := runtime.NewScheme() - if err := helmv2.AddToScheme(scheme); err != nil { - t.Fatalf("register helmv2 scheme: %v", err) - } - // Register the dynamic Tenant kind so the Application type round-trips - // through the scheme the same way the real aggregated API server wires - // it at startup. - resourceCfg := &config.ResourceConfig{ - Resources: []config.Resource{ - { - Application: config.ApplicationConfig{Kind: validation.TenantKind}, - }, - }, - } - if err := appsv1alpha1.RegisterDynamicTypes(scheme, resourceCfg); err != nil { - t.Fatalf("register dynamic Tenant type: %v", err) - } - - fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build() - - r := &REST{ - c: fakeClient, - gvr: schema.GroupVersionResource{ - Group: appsv1alpha1.GroupName, - Version: "v1alpha1", - Resource: "tenants", - }, - gvk: schema.GroupVersionKind{ - Group: appsv1alpha1.GroupName, - Version: "v1alpha1", - Kind: validation.TenantKind, - }, - kindName: validation.TenantKind, - releaseConfig: config.ReleaseConfig{ - Prefix: "tenant-", - }, - } - - newApp := &appsv1alpha1.Application{ - TypeMeta: metav1.TypeMeta{ - APIVersion: "apps.cozystack.io/v1alpha1", - Kind: validation.TenantKind, - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "foo-bar", - Namespace: "tenant-root", - }, - } - - ctx := request.WithNamespace(context.Background(), "tenant-root") - - _, _, err := r.Update( - ctx, - "foo-bar", - rest.DefaultUpdatedObjectInfo(newApp), - nil, // createValidation - nil, // updateValidation - true, // forceAllowCreate → routes through Create on NotFound - &metav1.UpdateOptions{}, - ) - if err == nil { - t.Fatalf("expected Update to reject tenant name with dashes, got no error") - } - if !apierrors.IsInvalid(err) { - t.Errorf("expected Invalid status error, got %T: %v", err, err) - } - if !strings.Contains(err.Error(), "tenant names must") { - t.Errorf("expected tenant-specific error in %q", err.Error()) - } -} - -// TestConvertHelmReleaseToApplication_TenantNamespaceKindGate pins the -// behavior that convertHelmReleaseToApplication fills Status.Namespace only -// when the kind is Tenant. This path is gated on r.kindName matching a -// specific literal — the test uses the validation.TenantKind constant so -// that if the source of truth for the tenant kind string is ever renamed, -// the gate and the constant drift together (or the test fails). -func TestConvertHelmReleaseToApplication_TenantNamespaceKindGate(t *testing.T) { - scheme := runtime.NewScheme() - if err := helmv2.AddToScheme(scheme); err != nil { - t.Fatalf("register helmv2 scheme: %v", err) - } - if err := corev1.AddToScheme(scheme); err != nil { - t.Fatalf("register corev1 scheme: %v", err) - } - - fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build() - - hr := &helmv2.HelmRelease{ - ObjectMeta: metav1.ObjectMeta{ - Name: "tenant-foo", - Namespace: "tenant-root", - }, - } - - t.Run("tenant kind fills Status.Namespace", func(t *testing.T) { - r := &REST{ - c: fakeClient, - kindName: validation.TenantKind, - releaseConfig: config.ReleaseConfig{ - Prefix: "tenant-", - }, - } - - app, err := r.convertHelmReleaseToApplication(context.Background(), hr, nil) - if err != nil { - t.Fatalf("convertHelmReleaseToApplication: %v", err) - } - if app.Status.Namespace == "" { - t.Errorf("expected Status.Namespace to be populated for tenant kind, got empty") - } - }) - - t.Run("non-tenant kind leaves Status.Namespace empty", func(t *testing.T) { - r := &REST{ - c: fakeClient, - kindName: "MySQL", - releaseConfig: config.ReleaseConfig{ - Prefix: "mysql-", - }, - } - - app, err := r.convertHelmReleaseToApplication(context.Background(), hr, nil) - if err != nil { - t.Fatalf("convertHelmReleaseToApplication: %v", err) - } - if app.Status.Namespace != "" { - t.Errorf("expected Status.Namespace to be empty for non-tenant kind, got %q", app.Status.Namespace) - } - }) -} - func TestValidateNameLength(t *testing.T) { tests := []struct { name string @@ -297,101 +102,3 @@ func TestValidateNameLength(t *testing.T) { }) } } - -// TestValidateTenantNamespaceLength covers the check that the computed -// workload namespace for a Tenant application fits inside the 63-char -// DNS-1123 label limit. The namespace is formed by dash-joining the -// parent namespace with the tenant name, so deep nesting can exceed the -// limit even when each individual name passes the per-name Helm release -// length check. -// -// The "tenant-root" branches of computeTenantNamespace do not get a -// dedicated overflow case: that branch produces "tenant-" (7 + -// len(name)), so for the computed result to exceed 63 chars the name -// would need to exceed 56 chars, which is already blocked by -// validateNameLength (max 46 for the "tenant-" prefix). The invariant -// holds by arithmetic. -func TestValidateTenantNamespaceLength(t *testing.T) { - tests := []struct { - name string - currentNamespace string - tenantName string - wantError bool - }{ - { - name: "tenant-root with short name passes", - currentNamespace: "tenant-root", - tenantName: "alpha", - wantError: false, - }, - { - name: "root tenant inside root namespace passes", - currentNamespace: "tenant-root", - tenantName: "root", - wantError: false, - }, - { - name: "short parent and short name passes", - currentNamespace: "tenant-foo", - tenantName: "bar", - wantError: false, - }, - { - name: "exactly at 63-char limit passes", - currentNamespace: "tenant-" + strings.Repeat("a", 45), // 52 chars - tenantName: strings.Repeat("b", 10), // 10 chars -> 52+1+10 = 63 - wantError: false, - }, - { - name: "one char over the limit fails", - currentNamespace: "tenant-" + strings.Repeat("a", 45), // 52 chars - tenantName: strings.Repeat("b", 11), // 11 chars -> 52+1+11 = 64 - wantError: true, - }, - { - name: "deeply nested failure with issue-style names", - currentNamespace: "tenant-" + strings.Repeat("a", 35), // 42 chars - tenantName: strings.Repeat("b", 25), // 25 chars -> 42+1+25 = 68 - wantError: true, - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - r := &REST{ - kindName: "Tenant", - releaseConfig: config.ReleaseConfig{ - Prefix: "tenant-", - }, - } - - errs := r.validateTenantNamespaceLength(tt.currentNamespace, tt.tenantName) - - if tt.wantError && len(errs) == 0 { - computed := r.computeTenantNamespace(tt.currentNamespace, tt.tenantName) - t.Errorf("expected error for parent=%q name=%q (computed=%q, len=%d), got none", - tt.currentNamespace, tt.tenantName, computed, len(computed)) - return - } - if !tt.wantError && len(errs) > 0 { - t.Errorf("unexpected error for parent=%q name=%q: %v", - tt.currentNamespace, tt.tenantName, errs) - return - } - - // For failing cases, verify the error message surfaces the - // computed namespace string and its actual length so a - // regression in the message format is caught. - if tt.wantError { - computed := r.computeTenantNamespace(tt.currentNamespace, tt.tenantName) - msg := errs.ToAggregate().Error() - if !strings.Contains(msg, computed) { - t.Errorf("error message must contain computed namespace %q, got: %s", computed, msg) - } - if !strings.Contains(msg, fmt.Sprintf("%d characters", len(computed))) { - t.Errorf("error message must contain the computed length %d, got: %s", len(computed), msg) - } - } - }) - } -} diff --git a/pkg/registry/apps/application/rest_watch_test.go b/pkg/registry/apps/application/rest_watch_test.go deleted file mode 100644 index 93a51f3c..00000000 --- a/pkg/registry/apps/application/rest_watch_test.go +++ /dev/null @@ -1,223 +0,0 @@ -package application - -import ( - "context" - "testing" - "time" - - cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" - appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1" - "github.com/cozystack/cozystack/pkg/config" - helmv2 "github.com/fluxcd/helm-controller/api/v2" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/types" - "k8s.io/apimachinery/pkg/watch" - "k8s.io/utils/ptr" - "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/client/fake" -) - -func TestWmResultChan_NilWatcher(t *testing.T) { - ch := wmResultChan(nil) - if ch != nil { - t.Error("expected nil channel for nil watcher") - } -} - -func TestWmResultChan_ValidWatcher(t *testing.T) { - fw := watch.NewFake() - ch := wmResultChan(fw) - if ch == nil { - t.Error("expected non-nil channel for valid watcher") - } - fw.Stop() -} - -// TestWatchIntegration_WorkloadMonitorTriggersModifiedEvent verifies the -// full path: WM event → label lookup → HelmRelease Get → Application conversion. -func TestWatchIntegration_WorkloadMonitorTriggersModifiedEvent(t *testing.T) { - scheme := runtime.NewScheme() - _ = cozyv1alpha1.AddToScheme(scheme) - _ = helmv2.AddToScheme(scheme) - - hr := &helmv2.HelmRelease{ - ObjectMeta: metav1.ObjectMeta{ - Name: "postgresql-mydb", - Namespace: "default", - Labels: map[string]string{ - ApplicationKindLabel: "PostgreSQL", - ApplicationGroupLabel: "apps.cozystack.io", - ApplicationNameLabel: "mydb", - }, - }, - } - hr.Status.Conditions = []metav1.Condition{ - {Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"}, - } - - wm := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(false), - }, - } - - c := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(hr, wm).Build() - - r := newTestRESTWithSchemesFromClient(c) - - // Simulate the Watch goroutine path: extract app name from WM labels, - // construct HelmRelease name, look up HR, convert to Application - wmAppName := wm.Labels[ApplicationNameLabel] - hrName := r.releaseConfig.Prefix + wmAppName - - foundHR := &helmv2.HelmRelease{} - if err := c.Get(context.TODO(), types.NamespacedName{Namespace: "default", Name: hrName}, foundHR); err != nil { - t.Fatalf("failed to get HelmRelease: %v", err) - } - app, err := r.ConvertHelmReleaseToApplication(context.TODO(), foundHR) - if err != nil { - t.Fatalf("failed to convert: %v", err) - } - if app.Name != "mydb" { - t.Errorf("expected app name 'mydb', got %q", app.Name) - } - - // Verify WorkloadsReady is False due to non-operational WM - wc := findCondition(app.GetConditions(), "WorkloadsReady") - if wc == nil { - t.Fatal("expected WorkloadsReady condition") - } - if wc.Status != metav1.ConditionFalse { - t.Errorf("expected WorkloadsReady=False, got %s", wc.Status) - } -} - -// TestWatchIntegration_MonitorDeletionDropsWorkloadsReady verifies that when a -// WorkloadMonitor is deleted, the Application's WorkloadsReady condition -// disappears. Ready condition always reflects HelmRelease state regardless. -func TestWatchIntegration_MonitorDeletionDropsWorkloadsReady(t *testing.T) { - scheme := runtime.NewScheme() - _ = cozyv1alpha1.AddToScheme(scheme) - _ = helmv2.AddToScheme(scheme) - - hr := &helmv2.HelmRelease{ - ObjectMeta: metav1.ObjectMeta{ - Name: "postgresql-mydb", - Namespace: "default", - Labels: map[string]string{ - ApplicationKindLabel: "PostgreSQL", - ApplicationGroupLabel: "apps.cozystack.io", - ApplicationNameLabel: "mydb", - }, - }, - } - hr.Status.Conditions = []metav1.Condition{ - {Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"}, - } - - nonOpMonitor := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(false), - }, - } - - c := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(hr, nonOpMonitor).Build() - r := newTestRESTWithSchemesFromClient(c) - - // Step 1: With non-operational monitor, WorkloadsReady=False, Ready=True - app1, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - wc1 := findCondition(app1.GetConditions(), "WorkloadsReady") - if wc1 == nil || wc1.Status != metav1.ConditionFalse { - t.Fatalf("expected WorkloadsReady=False with non-operational monitor, got %v", wc1) - } - rc1 := findCondition(app1.GetConditions(), "Ready") - if rc1 == nil || rc1.Status != metav1.ConditionTrue { - t.Fatalf("expected Ready=True (reflects HelmRelease), got %v", rc1) - } - - // Step 2: Delete the monitor - if err := c.Delete(context.TODO(), nonOpMonitor); err != nil { - t.Fatalf("failed to delete monitor: %v", err) - } - - // Step 3: WorkloadsReady should disappear, Ready stays True - app2, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - wc2 := findCondition(app2.GetConditions(), "WorkloadsReady") - if wc2 != nil { - t.Error("expected no WorkloadsReady condition after monitor deletion") - } - rc2 := findCondition(app2.GetConditions(), "Ready") - if rc2 == nil { - t.Fatal("expected Ready condition") - } - if rc2.Status != metav1.ConditionTrue { - t.Errorf("expected Ready=True after monitor deletion, got %s", rc2.Status) - } -} - -// TestWatchIntegration_WMWatcherCloseProducesNilChannel verifies that -// after wmWatcher is set to nil, wmResultChan returns nil channel. -func TestWatchIntegration_WMWatcherCloseProducesNilChannel(t *testing.T) { - fw := watch.NewFake() - ch := wmResultChan(fw) - if ch == nil { - t.Fatal("expected non-nil channel before close") - } - - fw.Stop() - - timeout := time.After(time.Second) - for { - select { - case _, ok := <-ch: - if !ok { - var nilWatcher watch.Interface - nilCh := wmResultChan(nilWatcher) - if nilCh != nil { - t.Error("expected nil channel after watcher set to nil") - } - return - } - case <-timeout: - t.Fatal("timeout waiting for watcher channel to close") - } - } -} - -func newTestRESTWithSchemesFromClient(c client.Client) *REST { - return NewREST(c, nil, &config.Resource{ - Application: config.ApplicationConfig{ - Kind: "PostgreSQL", - Plural: "postgresqls", - Singular: "postgresql", - }, - Release: config.ReleaseConfig{ - Prefix: "postgresql-", - }, - }) -} diff --git a/pkg/registry/apps/application/rest_workloads_test.go b/pkg/registry/apps/application/rest_workloads_test.go deleted file mode 100644 index b706c323..00000000 --- a/pkg/registry/apps/application/rest_workloads_test.go +++ /dev/null @@ -1,342 +0,0 @@ -package application - -import ( - "context" - "testing" - - cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" - appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1" - "github.com/cozystack/cozystack/pkg/config" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/utils/ptr" - "sigs.k8s.io/controller-runtime/pkg/client/fake" - - helmv2 "github.com/fluxcd/helm-controller/api/v2" -) - -func newTestRESTWithSchemes(objs ...runtime.Object) *REST { - scheme := runtime.NewScheme() - _ = cozyv1alpha1.AddToScheme(scheme) - _ = helmv2.AddToScheme(scheme) - - builder := fake.NewClientBuilder().WithScheme(scheme) - for _, obj := range objs { - builder = builder.WithRuntimeObjects(obj) - } - c := builder.Build() - - return NewREST(c, nil, &config.Resource{ - Application: config.ApplicationConfig{ - Kind: "PostgreSQL", - Plural: "postgresqls", - Singular: "postgresql", - }, - Release: config.ReleaseConfig{ - Prefix: "postgresql-", - }, - }) -} - -func TestGetWorkloadsOperational_NoMonitors(t *testing.T) { - r := newTestRESTWithSchemes() - ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if ws.found { - t.Error("expected found=false when no monitors exist") - } - if !ws.operational { - t.Error("expected operational=true when no monitors exist") - } -} - -func TestGetWorkloadsOperational_AllOperational(t *testing.T) { - m1 := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(true), - }, - } - m2 := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-2", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(true), - }, - } - - r := newTestRESTWithSchemes(m1, m2) - ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !ws.found { - t.Error("expected found=true") - } - if !ws.operational { - t.Error("expected operational=true when all monitors are operational") - } -} - -func TestGetWorkloadsOperational_SomeNotOperational(t *testing.T) { - m1 := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(true), - }, - } - m2 := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-2", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(false), - }, - } - - r := newTestRESTWithSchemes(m1, m2) - ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !ws.found { - t.Error("expected found=true") - } - if ws.operational { - t.Error("expected operational=false when at least one monitor is not operational") - } -} - -func TestGetWorkloadsOperational_OperationalNil(t *testing.T) { - m := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: nil, // Not yet reconciled - }, - } - - r := newTestRESTWithSchemes(m) - ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !ws.found { - t.Error("expected found=true") - } - if !ws.unknown { - t.Error("expected unknown=true when Operational is nil") - } -} - -func TestGetWorkloadsOperational_MixedNilAndOperational(t *testing.T) { - m1 := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(true), - }, - } - m2 := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-2", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: nil, - }, - } - - r := newTestRESTWithSchemes(m1, m2) - ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !ws.unknown { - t.Error("expected unknown=true when at least one monitor has nil Operational") - } -} - -func TestGetWorkloadsOperational_MixedFailedAndPending(t *testing.T) { - m1 := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(false), // Confirmed failure - }, - } - m2 := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-2", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: nil, // Not yet reconciled - }, - } - - r := newTestRESTWithSchemes(m1, m2) - ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if ws.operational { - t.Error("expected operational=false when at least one monitor is explicitly failed") - } - if !ws.unknown { - t.Error("expected unknown=true when at least one monitor has nil Operational") - } -} - -func TestConvertConditions_MixedFailedAndPendingShowsFalse(t *testing.T) { - mFailed := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-failed", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(false), - }, - } - mPending := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-pending", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "mydb", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: nil, - }, - } - - r := newTestRESTWithSchemes(mFailed, mPending) - hr := &helmv2.HelmRelease{ - ObjectMeta: metav1.ObjectMeta{ - Name: "postgresql-mydb", - Namespace: "default", - Labels: map[string]string{ - ApplicationKindLabel: "PostgreSQL", - ApplicationGroupLabel: "apps.cozystack.io", - ApplicationNameLabel: "mydb", - }, - }, - } - hr.Status.Conditions = []metav1.Condition{ - {Type: "Ready", Status: metav1.ConditionTrue, Reason: "Succeeded", Message: "ok"}, - } - - app, err := r.convertHelmReleaseToApplication(context.TODO(), hr, nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - - // Concrete failure should take priority over unknown - wc := findCondition(app.GetConditions(), "WorkloadsReady") - if wc == nil { - t.Fatal("expected WorkloadsReady condition") - } - if wc.Status != metav1.ConditionFalse { - t.Errorf("expected WorkloadsReady=False (failure takes priority over unknown), got %s", wc.Status) - } -} - -func TestGetWorkloadsOperational_DifferentApp_NotFound(t *testing.T) { - m := &cozyv1alpha1.WorkloadMonitor{ - ObjectMeta: metav1.ObjectMeta{ - Name: "mon-1", - Namespace: "default", - Labels: map[string]string{ - appsv1alpha1.ApplicationKindLabel: "PostgreSQL", - appsv1alpha1.ApplicationGroupLabel: "apps.cozystack.io", - appsv1alpha1.ApplicationNameLabel: "other-db", - }, - }, - Status: cozyv1alpha1.WorkloadMonitorStatus{ - Operational: ptr.To(false), - }, - } - - r := newTestRESTWithSchemes(m) - ws, err := r.getWorkloadsOperational(context.TODO(), "default", "mydb", nil) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if ws.found { - t.Error("expected found=false for different app name") - } - if !ws.operational { - t.Error("expected operational=true when no matching monitors found") - } -} - diff --git a/pkg/registry/core/tenantnamespace/rest.go b/pkg/registry/core/tenantnamespace/rest.go index 4ee97eb0..f1ed3fab 100644 --- a/pkg/registry/core/tenantnamespace/rest.go +++ b/pkg/registry/core/tenantnamespace/rest.go @@ -17,8 +17,6 @@ import ( apierrors "k8s.io/apimachinery/pkg/api/errors" metainternal "k8s.io/apimachinery/pkg/apis/meta/internalversion" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/fields" - "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/types" @@ -26,7 +24,6 @@ import ( "k8s.io/apimachinery/pkg/watch" "k8s.io/apiserver/pkg/endpoints/request" "k8s.io/apiserver/pkg/registry/rest" - "k8s.io/klog/v2" "sigs.k8s.io/controller-runtime/pkg/client" corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1" @@ -126,18 +123,8 @@ func (r *REST) Get( return nil, apierrors.NewNotFound(r.gvr.GroupResource(), name) } - // Check if user has access to this namespace - hasAccess, err := r.hasAccessToNamespace(ctx, name) - if err != nil { - return nil, err - } - if !hasAccess { - // Return Forbidden to follow standard K8s RBAC behavior - return nil, apierrors.NewForbidden(r.gvr.GroupResource(), name, fmt.Errorf("access denied")) - } - ns := &corev1.Namespace{} - err = r.c.Get(ctx, types.NamespacedName{Namespace: "", Name: name}, ns, &client.GetOptions{Raw: opts}) + err := r.c.Get(ctx, types.NamespacedName{Namespace: "", Name: name}, ns, &client.GetOptions{Raw: opts}) if err != nil { return nil, err } @@ -156,33 +143,11 @@ func (r *REST) Get( // ----------------------------------------------------------------------------- func (r *REST) Watch(ctx context.Context, opts *metainternal.ListOptions) (watch.Interface, error) { - // Extract user identity once for the lifetime of the watch — it does not - // change between events and rebuilding it per event is wasteful. - u, ok := request.UserFrom(ctx) - if !ok { - return nil, apierrors.NewUnauthorized("user missing in context") - } - username := u.GetName() - groups := make(map[string]struct{}) - for _, group := range u.GetGroups() { - groups[group] = struct{}{} - } - nsList := &corev1.NamespaceList{} - - // Build upstream watch options with field and label selectors - rawOpts := &metav1.ListOptions{ + nsWatch, err := r.w.Watch(ctx, nsList, &client.ListOptions{Raw: &metav1.ListOptions{ Watch: true, ResourceVersion: opts.ResourceVersion, - } - if opts.FieldSelector != nil { - rawOpts.FieldSelector = opts.FieldSelector.String() - } - if opts.LabelSelector != nil { - rawOpts.LabelSelector = opts.LabelSelector.String() - } - - nsWatch, err := r.w.Watch(ctx, nsList, &client.ListOptions{Raw: rawOpts}) + }}) if err != nil { return nil, err } @@ -224,30 +189,6 @@ func (r *REST) Watch(ctx context.Context, opts *metainternal.ListOptions) (watch continue } - // Apply defensive filtering for field and label selectors - if opts.FieldSelector != nil { - if !opts.FieldSelector.Matches(fields.Set{"metadata.name": ns.Name}) { - continue - } - } - if opts.LabelSelector != nil { - if !opts.LabelSelector.Matches(labels.Set(ns.Labels)) { - continue - } - } - - // Check if user has access to this namespace using the cached - // identity — avoids re-extracting user/groups on every event. - hasAccess, err := r.hasAccessToNamespaceForUser(ctx, ns.Name, username, groups) - if err != nil { - klog.ErrorS(err, "Failed to check access for namespace in watch", "namespace", ns.Name) - continue - } - if !hasAccess { - // User doesn't have access, skip this event - continue - } - out := &corev1alpha1.TenantNamespace{ TypeMeta: metav1.TypeMeta{ APIVersion: corev1alpha1.SchemeGroupVersion.String(), @@ -368,26 +309,6 @@ func (r *REST) makeList(src *corev1.NamespaceList, allowed []string) *corev1alph return out } -// matchesSubject checks if a RoleBinding subject matches the user's identity. -// It handles Group, User, and ServiceAccount subjects with proper namespace fallback. -func matchesSubject(subj rbacv1.Subject, bindingNamespace, username string, groups map[string]struct{}) bool { - switch subj.Kind { - case "Group": - _, ok := groups[subj.Name] - return ok - case "User": - return subj.Name == username - case "ServiceAccount": - saNamespace := subj.Namespace - if saNamespace == "" { - saNamespace = bindingNamespace - } - return username == fmt.Sprintf("system:serviceaccount:%s:%s", saNamespace, subj.Name) - default: - return false - } -} - func (r *REST) filterAccessible( ctx context.Context, names []string, @@ -426,9 +347,22 @@ func (r *REST) filterAccessible( subjectLoop: for j := range rbs.Items[i].Subjects { subj := rbs.Items[i].Subjects[j] - if matchesSubject(subj, rbs.Items[i].Namespace, u.GetName(), groups) { - allowedNameSet[rbs.Items[i].Namespace] = struct{}{} - break subjectLoop + switch subj.Kind { + case "Group": + if _, ok = groups[subj.Name]; ok { + allowedNameSet[rbs.Items[i].Namespace] = struct{}{} + break subjectLoop + } + case "User": + if subj.Name == u.GetName() { + allowedNameSet[rbs.Items[i].Namespace] = struct{}{} + break subjectLoop + } + case "ServiceAccount": + if u.GetName() == fmt.Sprintf("system:serviceaccount:%s:%s", subj.Namespace, subj.Name) { + allowedNameSet[rbs.Items[i].Namespace] = struct{}{} + break subjectLoop + } } } } @@ -439,60 +373,6 @@ func (r *REST) filterAccessible( return allowed, nil } -// hasAccessToNamespace checks if the user has access to a single namespace. -// This is optimized for Get/Watch operations where we check one namespace at a time. -// It lists RoleBindings only in the target namespace instead of all cluster RoleBindings. -func (r *REST) hasAccessToNamespace( - ctx context.Context, - namespace string, -) (bool, error) { - u, ok := request.UserFrom(ctx) - if !ok { - return false, fmt.Errorf("user missing in context") - } - groups := make(map[string]struct{}) - for _, group := range u.GetGroups() { - groups[group] = struct{}{} - } - return r.hasAccessToNamespaceForUser(ctx, namespace, u.GetName(), groups) -} - -// hasAccessToNamespaceForUser is the inner check that does not re-extract user -// identity from context. Use this in hot paths (e.g. the Watch loop) where the -// caller has already cached the user name and groups. -func (r *REST) hasAccessToNamespaceForUser( - ctx context.Context, - namespace, username string, - groups map[string]struct{}, -) (bool, error) { - // Check privileged groups - if _, ok := groups["system:masters"]; ok { - return true, nil - } - if _, ok := groups["cozystack-cluster-admin"]; ok { - return true, nil - } - - // List RoleBindings only in the target namespace - rbs := &rbacv1.RoleBindingList{} - err := r.c.List(ctx, rbs, client.InNamespace(namespace)) - if err != nil { - return false, fmt.Errorf("failed to list rolebindings in %s: %w", namespace, err) - } - - // Check if user is in any RoleBinding subjects - for i := range rbs.Items { - for j := range rbs.Items[i].Subjects { - subj := rbs.Items[i].Subjects[j] - if matchesSubject(subj, rbs.Items[i].Namespace, username, groups) { - return true, nil - } - } - } - - return false, nil -} - // ----------------------------------------------------------------------------- // Boiler-plate // ----------------------------------------------------------------------------- diff --git a/pkg/registry/core/tenantnamespace/rest_test.go b/pkg/registry/core/tenantnamespace/rest_test.go index 52d2a075..7f2979bc 100644 --- a/pkg/registry/core/tenantnamespace/rest_test.go +++ b/pkg/registry/core/tenantnamespace/rest_test.go @@ -3,20 +3,10 @@ package tenantnamespace import ( - "context" "testing" corev1 "k8s.io/api/core/v1" - rbacv1 "k8s.io/api/rbac/v1" - apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/runtime/schema" - "k8s.io/apiserver/pkg/authentication/user" - "k8s.io/apiserver/pkg/endpoints/request" - "sigs.k8s.io/controller-runtime/pkg/client/fake" - - corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1" ) func TestMakeListSortsAlphabetically(t *testing.T) { @@ -48,466 +38,3 @@ func TestMakeListSortsAlphabetically(t *testing.T) { } } } - -// Security tests for IDOR fix - -func TestHasAccessToNamespace_WithUserAccess(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, - } - - rb := &rbacv1.RoleBinding{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-binding", - Namespace: "tenant-test", - }, - Subjects: []rbacv1.Subject{ - {Kind: "User", Name: "test-user", APIGroup: "rbac.authorization.k8s.io"}, - }, - RoleRef: rbacv1.RoleRef{ - APIGroup: "rbac.authorization.k8s.io", - Kind: "Role", - Name: "test-role", - }, - } - - client := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(ns, rb). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "test-user", - Groups: []string{"system:authenticated"}, - } - ctx := request.WithUser(context.Background(), u) - - hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test") - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !hasAccess { - t.Error("expected user to have access, but got false") - } -} - -func TestHasAccessToNamespace_WithoutAccess(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, - } - - // RoleBinding for different user - rb := &rbacv1.RoleBinding{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-binding", - Namespace: "tenant-test", - }, - Subjects: []rbacv1.Subject{ - {Kind: "User", Name: "other-user", APIGroup: "rbac.authorization.k8s.io"}, - }, - RoleRef: rbacv1.RoleRef{ - APIGroup: "rbac.authorization.k8s.io", - Kind: "Role", - Name: "test-role", - }, - } - - client := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(ns, rb). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "test-user", - Groups: []string{"system:authenticated"}, - } - ctx := request.WithUser(context.Background(), u) - - hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test") - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if hasAccess { - t.Error("expected user to NOT have access, but got true") - } -} - -func TestHasAccessToNamespace_WithGroupAccess(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, - } - - rb := &rbacv1.RoleBinding{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-binding", - Namespace: "tenant-test", - }, - Subjects: []rbacv1.Subject{ - {Kind: "Group", Name: "test-group", APIGroup: "rbac.authorization.k8s.io"}, - }, - RoleRef: rbacv1.RoleRef{ - APIGroup: "rbac.authorization.k8s.io", - Kind: "Role", - Name: "test-role", - }, - } - - client := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(ns, rb). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "test-user", - Groups: []string{"system:authenticated", "test-group"}, - } - ctx := request.WithUser(context.Background(), u) - - hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test") - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !hasAccess { - t.Error("expected user to have access via group, but got false") - } -} - -func TestHasAccessToNamespace_SystemMasters(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, - } - - client := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(ns). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "admin", - Groups: []string{"system:masters"}, - } - ctx := request.WithUser(context.Background(), u) - - hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test") - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !hasAccess { - t.Error("expected system:masters to have access, but got false") - } -} - -func TestHasAccessToNamespace_CozyAdminGroup(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, - } - - client := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(ns). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "cozy-admin", - Groups: []string{"cozystack-cluster-admin"}, - } - ctx := request.WithUser(context.Background(), u) - - hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test") - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !hasAccess { - t.Error("expected cozystack-cluster-admin to have access, but got false") - } -} - -func TestHasAccessToNamespace_ServiceAccount(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, - } - - rb := &rbacv1.RoleBinding{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-binding", - Namespace: "tenant-test", - }, - Subjects: []rbacv1.Subject{ - {Kind: "ServiceAccount", Name: "test-sa", Namespace: "tenant-test"}, - }, - RoleRef: rbacv1.RoleRef{ - APIGroup: "rbac.authorization.k8s.io", - Kind: "Role", - Name: "test-role", - }, - } - - client := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(ns, rb). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "system:serviceaccount:tenant-test:test-sa", - Groups: []string{"system:authenticated"}, - } - ctx := request.WithUser(context.Background(), u) - - hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test") - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !hasAccess { - t.Error("expected service account to have access, but got false") - } -} - -func TestHasAccessToNamespace_ServiceAccountEmptyNamespace(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, - } - - // ServiceAccount subject with empty namespace should default to RoleBinding namespace - rb := &rbacv1.RoleBinding{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-binding", - Namespace: "tenant-test", - }, - Subjects: []rbacv1.Subject{ - {Kind: "ServiceAccount", Name: "test-sa", Namespace: ""}, // Empty namespace - }, - RoleRef: rbacv1.RoleRef{ - APIGroup: "rbac.authorization.k8s.io", - Kind: "Role", - Name: "test-role", - }, - } - - client := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(ns, rb). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "system:serviceaccount:tenant-test:test-sa", - Groups: []string{"system:authenticated"}, - } - ctx := request.WithUser(context.Background(), u) - - hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test") - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if !hasAccess { - t.Error("expected service account with empty namespace to have access, but got false") - } -} - -func TestGet_WithAccess(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, - } - - rb := &rbacv1.RoleBinding{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-binding", - Namespace: "tenant-test", - }, - Subjects: []rbacv1.Subject{ - {Kind: "User", Name: "test-user", APIGroup: "rbac.authorization.k8s.io"}, - }, - RoleRef: rbacv1.RoleRef{ - APIGroup: "rbac.authorization.k8s.io", - Kind: "Role", - Name: "test-role", - }, - } - - client := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(ns, rb). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "test-user", - Groups: []string{"system:authenticated"}, - } - ctx := request.WithUser(context.Background(), u) - - obj, err := r.Get(ctx, "tenant-test", &metav1.GetOptions{}) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - tn, ok := obj.(*corev1alpha1.TenantNamespace) - if !ok { - t.Fatalf("expected *TenantNamespace, got %T", obj) - } - if tn.Name != "tenant-test" { - t.Errorf("expected name %q, got %q", "tenant-test", tn.Name) - } - if tn.Kind != "TenantNamespace" { - t.Errorf("expected Kind=TenantNamespace, got %q", tn.Kind) - } - if tn.APIVersion != corev1alpha1.SchemeGroupVersion.String() { - t.Errorf("expected APIVersion=%q, got %q", corev1alpha1.SchemeGroupVersion.String(), tn.APIVersion) - } -} - -func TestGet_WithoutAccess(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - ns := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, - } - - // RoleBinding for different user - rb := &rbacv1.RoleBinding{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-binding", - Namespace: "tenant-test", - }, - Subjects: []rbacv1.Subject{ - {Kind: "User", Name: "other-user", APIGroup: "rbac.authorization.k8s.io"}, - }, - RoleRef: rbacv1.RoleRef{ - APIGroup: "rbac.authorization.k8s.io", - Kind: "Role", - Name: "test-role", - }, - } - - client := fake.NewClientBuilder(). - WithScheme(scheme). - WithObjects(ns, rb). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "test-user", - Groups: []string{"system:authenticated"}, - } - ctx := request.WithUser(context.Background(), u) - - obj, err := r.Get(ctx, "tenant-test", &metav1.GetOptions{}) - if err == nil { - t.Fatal("expected error, got nil") - } - if obj != nil { - t.Errorf("expected nil object, got %v", obj) - } - - // Verify it returns Forbidden to follow standard K8s RBAC behavior - if !apierrors.IsForbidden(err) { - t.Errorf("expected Forbidden error, got %v", err) - } -} - -func TestGet_NonTenantNamespace(t *testing.T) { - scheme := runtime.NewScheme() - _ = corev1.AddToScheme(scheme) - _ = rbacv1.AddToScheme(scheme) - - client := fake.NewClientBuilder(). - WithScheme(scheme). - Build() - - r := &REST{ - c: client, - gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, - } - - u := &user.DefaultInfo{ - Name: "test-user", - Groups: []string{"system:masters"}, - } - ctx := request.WithUser(context.Background(), u) - - obj, err := r.Get(ctx, "default", &metav1.GetOptions{}) - if err == nil { - t.Fatal("expected error for non-tenant namespace, got nil") - } - if obj != nil { - t.Errorf("expected nil object, got %v", obj) - } - if !apierrors.IsNotFound(err) { - t.Errorf("expected NotFound error, got %v", err) - } -} diff --git a/tools/openapi-gen/main.go b/tools/openapi-gen/main.go deleted file mode 100644 index 74b23b2b..00000000 --- a/tools/openapi-gen/main.go +++ /dev/null @@ -1,247 +0,0 @@ -// Copyright 2024 The Cozystack Authors. -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -// Command openapi-gen assembles the OpenAPI v3 spec for apps.cozystack.io by -// spinning up an in-process Kubernetes API server with stub storage, so the -// framework generates the exact same paths and schemas as the real server. -package main - -import ( - "context" - "encoding/json" - "fmt" - "net/http" - "net/http/httptest" - "os" - "path/filepath" - - cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1" - appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1" - "github.com/cozystack/cozystack/pkg/apiserver" - cozyserver "github.com/cozystack/cozystack/pkg/cmd/server" - "github.com/cozystack/cozystack/pkg/config" - sampleopenapi "github.com/cozystack/cozystack/pkg/generated/openapi" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/runtime/schema" - "k8s.io/apimachinery/pkg/watch" - "k8s.io/apiserver/pkg/endpoints/openapi" - "k8s.io/apiserver/pkg/registry/rest" - genericapiserver "k8s.io/apiserver/pkg/server" - utilfeature "k8s.io/apiserver/pkg/util/feature" - restclient "k8s.io/client-go/rest" - basecompatibility "k8s.io/component-base/compatibility" - baseversion "k8s.io/component-base/version" - "sigs.k8s.io/yaml" -) - -func main() { - if err := run(); err != nil { - fmt.Fprintf(os.Stderr, "error: %v\n", err) - os.Exit(1) - } -} - -func run() error { - // Find all ApplicationDefinition YAML files - pattern := "packages/system/*-rd/cozyrds/*.yaml" - matches, err := filepath.Glob(pattern) - if err != nil { - return fmt.Errorf("glob %q: %w", pattern, err) - } - if len(matches) == 0 { - return fmt.Errorf("no files matched %q — run from repo root", pattern) - } - - // Parse ApplicationDefinitions and build ResourceConfig - var resources []config.Resource - for _, path := range matches { - data, err := os.ReadFile(path) - if err != nil { - return fmt.Errorf("read %s: %w", path, err) - } - var appDef cozyv1alpha1.ApplicationDefinition - if err := yaml.Unmarshal(data, &appDef); err != nil { - return fmt.Errorf("parse %s: %w", path, err) - } - if appDef.Spec.Application.Kind == "" { - continue - } - resources = append(resources, config.Resource{ - Application: config.ApplicationConfig{ - Kind: appDef.Spec.Application.Kind, - Singular: appDef.Spec.Application.Singular, - Plural: appDef.Spec.Application.Plural, - OpenAPISchema: appDef.Spec.Application.OpenAPISchema, - }, - }) - } - - if len(resources) == 0 { - return fmt.Errorf("no ApplicationDefinitions found") - } - - resourceConfig := &config.ResourceConfig{Resources: resources} - - // Register dynamic types in the apiserver scheme (same as the real server) - if err := appsv1alpha1.RegisterDynamicTypes(apiserver.Scheme, resourceConfig); err != nil { - return fmt.Errorf("register dynamic types: %w", err) - } - - version := os.Getenv("VERSION") - if version == "" { - version = "dev" - } - - // Create a minimal GenericAPIServer config - serverConfig := genericapiserver.NewConfig(apiserver.Codecs) - serverConfig.ExternalAddress = "localhost:443" - serverConfig.LoopbackClientConfig = &restclient.Config{} - serverConfig.FeatureGate = utilfeature.DefaultMutableFeatureGate - if baseversion.DefaultKubeBinaryVersion != "" { - serverConfig.EffectiveVersion = basecompatibility.NewEffectiveVersionFromString(baseversion.DefaultKubeBinaryVersion, "", "") - } - - // OpenAPI v3 only — the v2 config is required by the framework but we only extract v3. - kindSchemas := cozyserver.KindSchemasFromConfig(resourceConfig) - serverConfig.OpenAPIConfig = genericapiserver.DefaultOpenAPIConfig( - sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme), - ) - serverConfig.OpenAPIV3Config = genericapiserver.DefaultOpenAPIV3Config( - sampleopenapi.GetOpenAPIDefinitions, openapi.NewDefinitionNamer(apiserver.Scheme), - ) - serverConfig.OpenAPIV3Config.Info.Title = "Cozystack apps.cozystack.io API" - serverConfig.OpenAPIV3Config.Info.Version = version - serverConfig.OpenAPIV3Config.PostProcessSpec = cozyserver.BuildPostProcessV3(kindSchemas) - - // Create the server - completed := serverConfig.Complete(nil) - server, err := completed.New("openapi-gen", genericapiserver.NewEmptyDelegate()) - if err != nil { - return fmt.Errorf("create server: %w", err) - } - - // Install apps API group with stub REST storage - appsStorage := map[string]rest.Storage{} - for _, res := range resourceConfig.Resources { - appsStorage[res.Application.Plural] = &stubREST{ - gvk: schema.GroupVersion{ - Group: "apps.cozystack.io", - Version: "v1alpha1", - }.WithKind(res.Application.Kind), - singularName: res.Application.Singular, - } - } - if err := apiserver.InstallAppsAPIGroup(server, appsStorage); err != nil { - return fmt.Errorf("install apps API group: %w", err) - } - - // PrepareRun triggers OpenAPI spec generation - server.PrepareRun() - - // Extract the v3 spec by hitting the server's HTTP handler directly - v3Path := "/openapi/v3/apis/apps.cozystack.io/v1alpha1" - req, err := http.NewRequest("GET", v3Path, nil) - if err != nil { - return fmt.Errorf("create request: %w", err) - } - req.Header.Set("Accept", "application/json") - rec := httptest.NewRecorder() - server.Handler.ServeHTTP(rec, req) - - if rec.Code != http.StatusOK { - return fmt.Errorf("GET %s returned %d: %s", v3Path, rec.Code, rec.Body.String()) - } - - // Pretty-print the JSON - var raw json.RawMessage - if err := json.Unmarshal(rec.Body.Bytes(), &raw); err != nil { - return fmt.Errorf("parse v3 response: %w", err) - } - - enc := json.NewEncoder(os.Stdout) - enc.SetIndent("", " ") - return enc.Encode(raw) -} - -// stubREST implements the same REST interfaces as the real application.REST -// but never handles actual requests. It exists solely so the K8s framework -// generates the correct OpenAPI paths and schemas. -type stubREST struct { - gvk schema.GroupVersionKind - singularName string -} - -// Compile-time interface checks — same set as the real application.REST. -var ( - _ rest.Getter = &stubREST{} - _ rest.Lister = &stubREST{} - _ rest.Creater = &stubREST{} - _ rest.Updater = &stubREST{} - _ rest.Patcher = &stubREST{} - _ rest.GracefulDeleter = &stubREST{} - _ rest.Watcher = &stubREST{} -) - -func (s *stubREST) New() runtime.Object { - obj := &appsv1alpha1.Application{} - obj.TypeMeta = metav1.TypeMeta{ - APIVersion: s.gvk.GroupVersion().String(), - Kind: s.gvk.Kind, - } - return obj -} - -func (s *stubREST) NewList() runtime.Object { - obj := &appsv1alpha1.ApplicationList{} - obj.TypeMeta = metav1.TypeMeta{ - APIVersion: s.gvk.GroupVersion().String(), - Kind: s.gvk.Kind + "List", - } - return obj -} - -func (s *stubREST) Destroy() {} -func (s *stubREST) NamespaceScoped() bool { return true } -func (s *stubREST) GetSingularName() string { return s.singularName } -func (s *stubREST) GroupVersionKind(schema.GroupVersion) schema.GroupVersionKind { return s.gvk } - -func (s *stubREST) Get(_ context.Context, _ string, _ *metav1.GetOptions) (runtime.Object, error) { - return nil, fmt.Errorf("stub: not implemented") -} - -func (s *stubREST) List(_ context.Context, _ *metainternalversion.ListOptions) (runtime.Object, error) { - return nil, fmt.Errorf("stub: not implemented") -} - -func (s *stubREST) Create(_ context.Context, _ runtime.Object, _ rest.ValidateObjectFunc, _ *metav1.CreateOptions) (runtime.Object, error) { - return nil, fmt.Errorf("stub: not implemented") -} - -func (s *stubREST) Update(_ context.Context, _ string, _ rest.UpdatedObjectInfo, _ rest.ValidateObjectFunc, _ rest.ValidateObjectUpdateFunc, _ bool, _ *metav1.UpdateOptions) (runtime.Object, bool, error) { - return nil, false, fmt.Errorf("stub: not implemented") -} - -func (s *stubREST) Delete(_ context.Context, _ string, _ rest.ValidateObjectFunc, _ *metav1.DeleteOptions) (runtime.Object, bool, error) { - return nil, false, fmt.Errorf("stub: not implemented") -} - -func (s *stubREST) Watch(_ context.Context, _ *metainternalversion.ListOptions) (watch.Interface, error) { - return nil, fmt.Errorf("stub: not implemented") -} - -func (s *stubREST) ConvertToTable(_ context.Context, _ runtime.Object, _ runtime.Object) (*metav1.Table, error) { - return nil, fmt.Errorf("stub: not implemented") -}