From 5963c3c449ce13c413bb2d77aa9c9f48a03f1238 Mon Sep 17 00:00:00 2001 From: wenyunqing Date: Thu, 8 Oct 2026 16:52:21 +0800 Subject: [PATCH 1/8] feat(ci): validate model variants against released Helm charts Check every variant in changed model version YAMLs using the chart release selected by its declared version constraint. Run strict Helm lint, template rendering, and Kubernetes/CRD schema validation with pinned tools and schemas. Add local commands, regression and integration tests, and CI artifacts for rendered manifests and validation logs. Validator changes trigger a full catalog check. --- .github/workflows/lint.yml | 39 + .gitignore | 2 + README.md | 9 +- hack/install-helm-tools.js | 43 + hack/lib/crd-schema.js | 81 + hack/lib/crd-schema.test.js | 67 + hack/lib/helm-validation.js | 115 + hack/lib/helm-validation.test.js | 102 + hack/update-helm-schemas.js | 59 + hack/validate-helm.integration.test.js | 76 + hack/validate-helm.js | 201 + hack/validate-helm.test.js | 79 + package.json | 5 + schema/helm/README.md | 129 + schema/helm/config.json | 26 + .../llmscaler_v1alpha1.json | 465 + .../llmscaler_v1alpha1.json | 465 + .../llmslorequirement_v1alpha1.json | 474 + .../llmslorequirement_v1alpha1.json | 462 + .../leaderworkerset_v1.json | 16589 ++++++++++++++++ .../servicemonitor_v1.json | 1441 ++ .../modelroute_v1alpha1.json | 541 + schema/helm/provenance.json | 121 + schema/helm/sources.json | 46 + 24 files changed, 21636 insertions(+), 1 deletion(-) create mode 100644 hack/install-helm-tools.js create mode 100644 hack/lib/crd-schema.js create mode 100644 hack/lib/crd-schema.test.js create mode 100644 hack/lib/helm-validation.js create mode 100644 hack/lib/helm-validation.test.js create mode 100644 hack/update-helm-schemas.js create mode 100644 hack/validate-helm.integration.test.js create mode 100644 hack/validate-helm.js create mode 100644 hack/validate-helm.test.js create mode 100644 schema/helm/README.md create mode 100644 schema/helm/config.json create mode 100644 schema/helm/crds/autoscaling.4pd.io/llmscaler_v1alpha1.json create mode 100644 schema/helm/crds/autoscaling.modelsphere.dev/llmscaler_v1alpha1.json create mode 100644 schema/helm/crds/inference.modelsphere.dev/llmslorequirement_v1alpha1.json create mode 100644 schema/helm/crds/inference.x-k8s.io/llmslorequirement_v1alpha1.json create mode 100644 schema/helm/crds/leaderworkerset.x-k8s.io/leaderworkerset_v1.json create mode 100644 schema/helm/crds/monitoring.coreos.com/servicemonitor_v1.json create mode 100644 schema/helm/crds/routing.modelsphere.dev/modelroute_v1alpha1.json create mode 100644 schema/helm/provenance.json create mode 100644 schema/helm/sources.json diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index dfe4bde..ac50503 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -26,3 +26,42 @@ jobs: - name: Test the catalog library run: npm run test:lib + + validate-helm: + name: validate-helm + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v7 + with: + fetch-depth: 0 + # Compare the PR head, not GitHub's synthetic merge commit. + ref: ${{ github.event.pull_request.head.sha }} + + - uses: actions/setup-node@v7 + with: + node-version: 24 + cache: npm + + - name: Install validator dependencies + run: npm ci + + - name: Test Helm validator + run: npm run test:helm + + - name: Install pinned Helm and kubeconform + run: npm run helm:install + + - name: Validate changed model variants + env: + BASE_REF: ${{ github.event.pull_request.base.sha }} + run: npm run validate:helm -- --base "$BASE_REF" + + - name: Save Helm validation logs and manifests + if: always() + uses: actions/upload-artifact@v4 + with: + name: helm-validation + path: artifacts/helm-validation/ + if-no-files-found: ignore + retention-days: 14 diff --git a/.gitignore b/.gitignore index 66af114..025caf1 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,7 @@ # MacOS *.DS_Store +.cache/helm-validation/ +artifacts/helm-validation/ # Created by https://www.toptal.com/developers/gitignore/api/node # Edit at https://www.toptal.com/developers/gitignore?templates=node diff --git a/README.md b/README.md index 1a33159..e448a4e 100644 --- a/README.md +++ b/README.md @@ -82,7 +82,9 @@ cp -r models/glm5.1 models/my-model # or models/kimi-k2.5 for a multi-node mode 3. Check it, and preview the catalog page: ```sh - npm run validate:schema # the same check CI runs + npm run validate:schema # catalog structure and tuning references + npm run helm:install # pinned Helm and kubeconform (first time) + npm run validate:helm -- models/my-model/my-model-1.0.0.yaml npm run build:site # then open site/index.html ``` @@ -114,6 +116,11 @@ hack/serve.sh serve it over HTTP, for local development A published catalog is a static site, and `./hack/serve.sh` is the smallest thing that behaves like one: it rebuilds the index, then serves the tree. +PRs also run the independent `validate-helm` check on every variant in changed +version YAMLs, using the declared released chart, Helm's values schema and +strict Kubernetes/CRD schemas. See [Helm validation](schema/helm/README.md) for +local commands, schema updates, artifacts, and validation limits. + ## Versions are immutable A model publishes versions, like a package: `models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.2.0.yaml`, diff --git a/hack/install-helm-tools.js b/hack/install-helm-tools.js new file mode 100644 index 0000000..c62db55 --- /dev/null +++ b/hack/install-helm-tools.js @@ -0,0 +1,43 @@ +#!/usr/bin/env node +"use strict"; + +const fs = require("node:fs"); +const path = require("node:path"); +const crypto = require("node:crypto"); +const {execFileSync} = require("node:child_process"); +const {root} = require("./lib/catalog"); +const config = require("../schema/helm/config.json"); + +async function main() { + const platform = `${process.platform}-${{x64: "amd64", arm64: "arm64"}[process.arch]}`; + const sums = config.toolChecksums[platform]; + if (!sums) throw new Error(`unsupported platform: ${platform}`); + const output = path.join(root, ".cache/helm-validation/bin"); + fs.mkdirSync(output, {recursive: true}); + for (const name of ["helm", "kubeconform"]) { + const version = config[`${name}Version`]; + const archive = name === "helm" ? `helm-v${version}-${platform}.tar.gz` : `kubeconform-${platform}.tar.gz`; + const url = name === "helm" ? `https://get.helm.sh/${archive}` : + `https://github.com/yannh/kubeconform/releases/download/v${version}/${archive}`; + const response = await fetch(url, {signal: AbortSignal.timeout(60000)}); + if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`); + const bytes = Buffer.from(await response.arrayBuffer()); + if (crypto.createHash("sha256").update(bytes).digest("hex") !== sums[name]) { + throw new Error(`${archive}: checksum mismatch`); + } + const temp = fs.mkdtempSync(path.join(output, ".install-")); + try { + const archivePath = path.join(temp, archive); + fs.writeFileSync(archivePath, bytes); + const member = name === "helm" ? `${platform}/helm` : "kubeconform"; + execFileSync("tar", ["-xzf", archivePath, "-C", temp, member]); + fs.copyFileSync(path.join(temp, member), path.join(output, name)); + fs.chmodSync(path.join(output, name), 0o755); + } finally { + fs.rmSync(temp, {recursive: true, force: true}); + } + console.log(`Installed ${name} ${version} (${platform}, sha256:${sums[name]})`); + } +} + +main().catch((err) => {console.error(err.message); process.exitCode = 1;}); diff --git a/hack/lib/crd-schema.js b/hack/lib/crd-schema.js new file mode 100644 index 0000000..b48c0b4 --- /dev/null +++ b/hack/lib/crd-schema.js @@ -0,0 +1,81 @@ +"use strict"; + +// Versioned with the repository; changing this contract requires regeneration. +const CONVERTER_VERSION = "catalog-crd-schema-v1"; + +function convertSchema(input) { + if (typeof input === "boolean") return input; + const schema = structuredClone(input); + for (const key of ["properties", "patternProperties", "definitions", "$defs"]) { + if (schema[key]) { + schema[key] = Object.fromEntries(Object.entries(schema[key]).map(([k, v]) => [k, convertSchema(v)])); + } + } + for (const key of ["items", "additionalProperties", "not", "contains", "if", "then", "else"]) { + if (schema[key] && typeof schema[key] === "object") { + schema[key] = Array.isArray(schema[key]) ? schema[key].map(convertSchema) : convertSchema(schema[key]); + } + } + for (const key of ["allOf", "anyOf", "oneOf"]) { + if (schema[key]) schema[key] = schema[key].map(convertSchema); + } + // Close defined objects, including objects inside arrays. Explicit map schemas + // and Kubernetes' preserve-unknown-fields escape hatch must remain open. + if (schema.properties && schema.additionalProperties === undefined) { + schema.additionalProperties = schema["x-kubernetes-preserve-unknown-fields"] === true; + } + if (schema["x-kubernetes-int-or-string"] || schema.format === "int-or-string") { + schema.type = ["integer", "string"]; + delete schema.format; + } + if (schema.nullable === true) { + delete schema.nullable; + return {anyOf: [schema, {type: "null"}]}; + } + delete schema.nullable; + return schema; +} + +function objectMetaSchema(definitions) { + const name = "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta"; + const used = {}; + function visit(value) { + if (!value || typeof value !== "object") return; + if (value.$ref) { + const prefix = "#/definitions/"; + if (!value.$ref.startsWith(prefix)) throw new Error(`unexpected metadata reference ${value.$ref}`); + const key = value.$ref.slice(prefix.length); + if (!Object.hasOwn(used, key)) { + if (!definitions[key]) throw new Error(`missing metadata definition ${key}`); + used[key] = definitions[key]; + visit(used[key]); + } + } + for (const child of Object.values(value)) visit(child); + } + const schema = {$ref: `#/definitions/${name}`}; + visit(schema); + return {schema, definitions: used}; +} + +function crdSchemas(crd, metadata = {schema: {type: "object"}, definitions: {}}) { + if (crd?.kind !== "CustomResourceDefinition") throw new Error("expected a CustomResourceDefinition"); + const {group, names, versions} = crd.spec; + return versions.filter((v) => v.served).map((v) => { + if (!v.schema?.openAPIV3Schema) throw new Error(`${group}/${v.name}/${names.kind}: missing OpenAPI schema`); + const schema = convertSchema(v.schema.openAPIV3Schema); + schema.$schema = "http://json-schema.org/draft-07/schema#"; + schema.properties ??= {}; + schema.properties.apiVersion = {type: "string", enum: [`${group}/${v.name}`]}; + schema.properties.kind = {type: "string", enum: [names.kind]}; + // The API server supplies ObjectMeta even when the CRD omits metadata or + // leaves it as type: object. Use the same pinned Kubernetes schema as native resources. + schema.properties.metadata = structuredClone(metadata.schema); + if (Object.keys(metadata.definitions).length) schema.definitions = structuredClone(metadata.definitions); + schema.required = [...new Set([...(schema.required ?? []), "apiVersion", "kind", "metadata"])]; + schema.additionalProperties = false; + return {group, version: v.name, kind: names.kind, schema, file: `${group}/${names.kind.toLowerCase()}_${v.name}.json`}; + }); +} + +module.exports = {CONVERTER_VERSION, convertSchema, crdSchemas, objectMetaSchema}; diff --git a/hack/lib/crd-schema.test.js b/hack/lib/crd-schema.test.js new file mode 100644 index 0000000..68f1c1a --- /dev/null +++ b/hack/lib/crd-schema.test.js @@ -0,0 +1,67 @@ +"use strict"; + +const test = require("node:test"); +const assert = require("node:assert/strict"); +const Ajv = require("ajv"); +const {convertSchema, crdSchemas, objectMetaSchema} = require("./crd-schema"); + +const compile = (schema) => new Ajv({strict: false}).compile(schema); + +test("strictness descends into array items while preserving typed maps and free objects", () => { + const validate = compile(convertSchema({type: "object", properties: { + env: {type: "array", items: {type: "object", properties: {name: {type: "string"}}, required: ["name"]}}, + labels: {type: "object", additionalProperties: {type: "string"}}, + free: {type: "object", "x-kubernetes-preserve-unknown-fields": true, properties: {known: {type: "string"}}} + }})); + assert(validate({env: [{name: "A"}], labels: {"example.com/key": "yes"}, free: {arbitrary: {nested: true}}})); + assert(!validate({env: [{name: "A", typo: true}]})); + assert(!validate({labels: {key: 1}})); + assert(!validate({free: {known: 1}})); +}); + +test("IntOrString and nullable fields retain valid Kubernetes values", () => { + const validate = compile(convertSchema({type: "object", properties: { + port: {"x-kubernetes-int-or-string": true, anyOf: [{type: "integer"}, {type: "string"}]}, + otherPort: {format: "int-or-string"}, + optional: {type: "string", enum: ["yes"], nullable: true} + }})); + assert(validate({port: 80, otherPort: "http", optional: null})); + assert(validate({port: "http", otherPort: 80, optional: "yes"})); + assert(!validate({port: false})); + assert(!validate({optional: "no"})); +}); + +test("CRD conversion publishes only served versions and enforces full GVK", () => { + const schemas = crdSchemas({kind: "CustomResourceDefinition", spec: { + group: "example.dev", names: {kind: "Example"}, versions: [ + {name: "v1", served: true, schema: {openAPIV3Schema: {type: "object", properties: {metadata: {type: "object"}}}}}, + {name: "v2", served: false} + ] + }}); + assert.deepEqual(schemas.map((s) => s.file), ["example.dev/example_v1.json"]); + const validate = compile(schemas[0].schema); + assert(validate({apiVersion: "example.dev/v1", kind: "Example", metadata: {name: "test"}})); + assert(!validate({apiVersion: "other.dev/v1", kind: "Example", metadata: {}})); + assert(!validate({apiVersion: "example.dev/v1", kind: "Wrong", metadata: {}})); + assert(!validate({apiVersion: "example.dev/v1", kind: "Example"})); +}); + +test("implicit metadata is supplied even for CRDs that omit it, with transitive references", () => { + const name = "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta"; + const metadata = objectMetaSchema({ + [name]: {type: "object", additionalProperties: false, properties: { + name: {type: "string"}, labels: {$ref: "#/definitions/Labels"} + }}, + Labels: {type: "object", additionalProperties: {type: "string"}}, + Unused: {type: "number"} + }); + assert.equal(metadata.definitions.Unused, undefined); + const [result] = crdSchemas({kind: "CustomResourceDefinition", spec: { + group: "example.dev", names: {kind: "Example"}, versions: [{name: "v1", served: true, + schema: {openAPIV3Schema: {type: "object", properties: {spec: {type: "object"}}}}}] + }}, metadata); + const validate = compile(result.schema); + assert(validate({apiVersion: "example.dev/v1", kind: "Example", metadata: {name: "x", labels: {key: "value"}}})); + assert(!validate({apiVersion: "example.dev/v1", kind: "Example", metadata: {typo: true}})); + assert(!validate({apiVersion: "example.dev/v1", kind: "Example", metadata: {labels: {key: 1}}})); +}); diff --git a/hack/lib/helm-validation.js b/hack/lib/helm-validation.js new file mode 100644 index 0000000..acbf81f --- /dev/null +++ b/hack/lib/helm-validation.js @@ -0,0 +1,115 @@ +"use strict"; + +const fs = require("node:fs"); +const path = require("node:path"); +const {spawnSync} = require("node:child_process"); +const YAML = require("yaml"); + +function isVersionFile(file) { + return /^models\/[^/]+\/[^/]+\.ya?ml$/.test(file) && !/\/metadata\.ya?ml$/.test(file); +} + +function affectsValidator(file) { + return file.startsWith("schema/helm/") || + /^hack\/(validate-helm|install-helm-tools|update-helm-schemas)(\.integration)?\.(js|test\.js)$/.test(file) || + /^hack\/lib\/(helm-validation|crd-schema|catalog)(\.test)?\.js$/.test(file) || + ["package.json", "package-lock.json", ".github/workflows/lint.yml"].includes(file); +} + +function command(bin, args, options = {}) { + const result = spawnSync(bin, args, {encoding: "utf8", timeout: 120000, maxBuffer: 64 * 1024 * 1024, ...options}); + const stdout = result.stdout ?? ""; + const stderr = result.stderr ?? ""; + return {stdout, stderr, ok: result.status === 0 && !result.error, + log: `$ ${bin} ${args.map((a) => JSON.stringify(a)).join(" ")}\n${stdout}${stderr}` + + (result.error ? `\n${result.error.message}\n` : "") + `\nexit: ${result.status}, signal: ${result.signal ?? "none"}\n`}; +} + +function git(root, args) { + const result = command("git", args, {cwd: root}); + if (!result.ok) throw new Error(result.log); + return result.stdout; +} + +function allVersionFiles(root) { + function walk(dir) { + return fs.readdirSync(path.join(root, dir), {withFileTypes: true}).flatMap((entry) => { + const file = `${dir}/${entry.name}`; + return entry.isDirectory() ? walk(file) : isVersionFile(file) ? [file] : []; + }); + } + return walk("models").sort(); +} + +// Keep both sides of renames for validator-change detection. NUL delimiters +// preserve filenames with whitespace; missing old/deleted model paths are excluded. +function selectFiles(root, {all = false, base = "origin/HEAD", files = []} = {}) { + if (all) return {files: allVersionFiles(root), reason: "--all"}; + if (files.length) { + const selected = files.map((file) => path.relative(root, path.resolve(root, file)).split(path.sep).join("/")); + if (selected.some((file) => !isVersionFile(file) || !fs.existsSync(path.join(root, file)))) { + throw new Error("explicit files must be existing model version YAMLs under models/"); + } + return {files: [...new Set(selected)].sort(), reason: "explicit files"}; + } + const mergeBase = git(root, ["merge-base", base, "HEAD"]).trim(); + const tokens = git(root, ["diff", "--name-status", "-z", "--find-renames", mergeBase, "HEAD"]).split("\0"); + const changed = []; + for (let i = 0; i < tokens.length && tokens[i];) { + const status = tokens[i++]; + changed.push(tokens[i++]); + if (/^[RC]/.test(status)) changed.push(tokens[i++]); + } + if (changed.some(affectsValidator)) return {files: allVersionFiles(root), reason: "validator/dependency/schema changes", mergeBase}; + return {files: [...new Set(changed.filter((file) => isVersionFile(file) && fs.existsSync(path.join(root, file))))].sort(), + reason: `changes since merge-base with ${base}`, mergeBase}; +} + +function isObject(value) { + return value !== null && typeof value === "object" && !Array.isArray(value); +} + +function variantValues(variant) { + const values = variant.values === undefined ? {} : structuredClone(variant.values); + if (!isObject(values)) throw new Error("variants[].values: must be an object"); + let injected = false; + if (values.modelRoute === undefined) values.modelRoute = {}; + if (isObject(values.modelRoute)) { + if (values.modelRoute.nginx === undefined) values.modelRoute.nginx = {}; + if (isObject(values.modelRoute.nginx) && !Object.hasOwn(values.modelRoute.nginx, "outputConfigMap")) { + values.modelRoute.nginx.outputConfigMap = "ci/openresty-conf"; + injected = true; + } + } + return {values, injected}; +} + +function kubeconformArgs(config, schemaDir, cacheDir, rendered) { + // Local schemas use the FULL group. Native schemas also enforce apiVersion + // and kind enums, so a similarly named unknown CR cannot pass as a native kind. + return ["-strict", "-summary", "-verbose", "-output", "json", "-kubernetes-version", config.kubernetesVersion, + "-cache", cacheDir, + "-schema-location", `${schemaDir}/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json`, + "-schema-location", `https://raw.githubusercontent.com/yannh/kubernetes-json-schema/${config.kubernetesSchemaCommit}/` + + "{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json", rendered]; +} + +function parseVersions(file) { + const doc = YAML.parse(fs.readFileSync(file, "utf8")); + if (!Array.isArray(doc?.variants) || !doc.variants.length) throw new Error("variants: expected a nonempty array"); + const ids = new Set(); + for (const [index, variant] of doc.variants.entries()) { + if (!isObject(variant) || typeof variant.id !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(variant.id)) { + throw new Error(`variants[${index}].id: invalid variant id`); + } + if (ids.has(variant.id)) throw new Error(`variants[${index}].id: duplicate ${variant.id}`); + ids.add(variant.id); + if (!/^[a-z0-9][a-z0-9-]*$/.test(variant.chart?.name ?? "") || + typeof variant.chart?.version !== "string" || !variant.chart.version.trim()) { + throw new Error(`variants[${index}].chart: expected name and version constraint`); + } + } + return doc.variants; +} + +module.exports = {command, selectFiles, isVersionFile, affectsValidator, variantValues, kubeconformArgs, parseVersions}; diff --git a/hack/lib/helm-validation.test.js b/hack/lib/helm-validation.test.js new file mode 100644 index 0000000..a6c6600 --- /dev/null +++ b/hack/lib/helm-validation.test.js @@ -0,0 +1,102 @@ +"use strict"; + +const test = require("node:test"); +const assert = require("node:assert/strict"); +const fs = require("node:fs"); +const os = require("node:os"); +const path = require("node:path"); +const {execFileSync} = require("node:child_process"); +const {selectFiles, variantValues, kubeconformArgs} = require("./helm-validation"); +const config = require("../../schema/helm/config.json"); + +function repository(t) { + const dir = fs.mkdtempSync(path.join(os.tmpdir(), "helm-selection-")); + t.after(() => fs.rmSync(dir, {recursive: true, force: true})); + const git = (...args) => execFileSync("git", args, {cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"]}).trim(); + git("init", "-b", "main"); + git("config", "user.name", "Validator Test"); + git("config", "user.email", "validator@example.invalid"); + function write(file, body = "test\n") { + fs.mkdirSync(path.dirname(path.join(dir, file)), {recursive: true}); + fs.writeFileSync(path.join(dir, file), body); + } + function commit() { git("add", "."); git("commit", "-m", "fixture"); } + write("models/example/example-1.0.0.yaml"); + write("models/example/metadata.yaml"); + write("hack/validate-helm.js"); + commit(); + git("branch", "base"); + return {dir, git, write, commit}; +} + +test("documentation and metadata changes select no version files", (t) => { + const r = repository(t); + r.write("README.md"); r.write("models/example/metadata.yaml", "modified\n"); r.commit(); + assert.deepEqual(selectFiles(r.dir, {base: "base"}).files, []); +}); + +test("add, modify and rename destinations are selected; deletions are excluded", (t) => { + const r = repository(t); + r.write("models/example/example-1.1.0.yaml"); r.commit(); + r.git("branch", "before"); + r.git("mv", "models/example/example-1.0.0.yaml", "models/example/renamed version-1.0.0.yml"); + r.write("models/example/example-1.1.0.yaml", "modified\n"); + r.write("models/example/example-1.2.0.yaml"); r.commit(); + assert.deepEqual(selectFiles(r.dir, {base: "before"}).files, [ + "models/example/example-1.1.0.yaml", "models/example/example-1.2.0.yaml", "models/example/renamed version-1.0.0.yml"]); + r.git("rm", "models/example/example-1.2.0.yaml"); r.commit(); + assert(!selectFiles(r.dir, {base: "before"}).files.includes("models/example/example-1.2.0.yaml")); +}); + +test("selection uses the common ancestor even when the target branch advances", (t) => { + const r = repository(t); + r.write("models/example/feature-1.0.0.yaml"); r.commit(); + r.git("checkout", "base"); r.write("models/example/base-only-1.0.0.yaml"); r.commit(); + r.git("checkout", "main"); + assert.deepEqual(selectFiles(r.dir, {base: "base"}).files, ["models/example/feature-1.0.0.yaml"]); +}); + +test("validator, dependency and schema changes, including deletions, trigger all versions", (t) => { + for (const file of ["hack/validate-helm.js", "hack/lib/crd-schema.js", "schema/helm/config.json", "package-lock.json", ".github/workflows/lint.yml"]) { + const r = repository(t); + r.write(file, "changed\n"); r.commit(); + assert.equal(selectFiles(r.dir, {base: "base"}).reason, "validator/dependency/schema changes"); + } + const r = repository(t); + r.git("rm", "hack/validate-helm.js"); r.commit(); + assert.equal(selectFiles(r.dir, {base: "base"}).reason, "validator/dependency/schema changes"); + const renamed = repository(t); + renamed.git("mv", "hack/validate-helm.js", "archived-validator.txt"); renamed.commit(); + assert.equal(selectFiles(renamed.dir, {base: "base"}).reason, "validator/dependency/schema changes"); +}); + +test("unknown base fails rather than reporting no changes", (t) => { + const r = repository(t); + assert.throws(() => selectFiles(r.dir, {base: "missing-ref"})); +}); + +test("only an absent route output is supplied; explicit invalid values survive", () => { + const original = {values: {extraArgs: ["--x"], modelRoute: {nginx: {outputConfigMap: ""}}}}; + assert.equal(variantValues(original).injected, false); + assert.equal(variantValues(original).values.modelRoute.nginx.outputConfigMap, ""); + for (const value of [null, false, 17]) { + assert.equal(variantValues({values: {modelRoute: {nginx: {outputConfigMap: value}}}}).values.modelRoute.nginx.outputConfigMap, value); + } + const defaults = variantValues({}); + assert.equal(defaults.values.modelRoute.nginx.outputConfigMap, "ci/openresty-conf"); + assert.equal(defaults.values.scaler, undefined); + assert.equal(defaults.values.cart, undefined); + const variant = {values: {env: [{name: "VALUE", value: "test"}]}}; + variantValues(variant); + assert.deepEqual(variant, {values: {env: [{name: "VALUE", value: "test"}]}}); + assert.throws(() => variantValues({values: null})); + assert.equal(variantValues({values: {modelRoute: null}}).values.modelRoute, null); +}); + +test("strict validation uses full group and pinned native schema without missing-schema bypass", () => { + const args = kubeconformArgs(config, "/schemas", "/cache", "/rendered.yaml"); + assert(args.includes("-strict")); + assert(!args.includes("-ignore-missing-schemas")); + assert(args.some((arg) => arg.includes("{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}"))); + assert(args.some((arg) => arg.includes(config.kubernetesSchemaCommit))); +}); diff --git a/hack/update-helm-schemas.js b/hack/update-helm-schemas.js new file mode 100644 index 0000000..58a120c --- /dev/null +++ b/hack/update-helm-schemas.js @@ -0,0 +1,59 @@ +#!/usr/bin/env node +"use strict"; + +const fs = require("node:fs"); +const path = require("node:path"); +const crypto = require("node:crypto"); +const YAML = require("yaml"); +const {root} = require("./lib/catalog"); +const {CONVERTER_VERSION, crdSchemas, objectMetaSchema} = require("./lib/crd-schema"); +const config = require("../schema/helm/config.json"); +const sources = require("../schema/helm/sources.json").sources; + +async function main() { + if (config.converterVersion !== CONVERTER_VERSION) throw new Error("converter version mismatch"); + const output = path.join(root, "schema/helm/crds"); + const files = new Map(); + const records = []; + const metadataUrl = `https://raw.githubusercontent.com/yannh/kubernetes-json-schema/${config.kubernetesSchemaCommit}/` + + `v${config.kubernetesVersion}-standalone-strict/_definitions.json`; + const metadataResponse = await fetch(metadataUrl, {signal: AbortSignal.timeout(60000)}); + if (!metadataResponse.ok) throw new Error(`${metadataUrl}: HTTP ${metadataResponse.status}`); + const metadataBody = await metadataResponse.text(); + const metadata = objectMetaSchema(JSON.parse(metadataBody).definitions); + // Download and convert everything before replacing the generated directory. + for (const source of sources) { + if (!/^[a-f0-9]{40}$/.test(source.commit)) throw new Error("source must use a full commit SHA"); + const url = `https://raw.githubusercontent.com/${source.repository}/${source.commit}/${source.path}`; + const response = await fetch(url, {signal: AbortSignal.timeout(60000)}); + if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`); + const body = await response.text(); + const schemas = YAML.parseAllDocuments(body).flatMap((doc) => { + if (doc.errors.length) throw doc.errors[0]; + const crd = doc.toJS(); + if (!crd) return []; + if (crd.spec?.names?.kind !== source.kind) throw new Error(`${url}: unexpected CRD kind`); + return crdSchemas(crd, metadata); + }); + if (!schemas.length) throw new Error(`${url}: no served schemas`); + for (const {file, schema} of schemas) { + if (files.has(file)) throw new Error(`duplicate schema ${file}`); + files.set(file, JSON.stringify(schema, null, 2) + "\n"); + } + records.push({...source, url, sha256: crypto.createHash("sha256").update(body).digest("hex"), + schemas: schemas.map(({file, group, version, kind}) => ({file, group, version, kind}))}); + } + fs.rmSync(output, {recursive: true, force: true}); + for (const [file, body] of files) { + const target = path.join(output, file); + fs.mkdirSync(path.dirname(target), {recursive: true}); + fs.writeFileSync(target, body); + console.log(`Generated schema/helm/crds/${file}`); + } + fs.writeFileSync(path.join(root, "schema/helm/provenance.json"), + JSON.stringify({converterVersion: CONVERTER_VERSION, + objectMeta: {url: metadataUrl, sha256: crypto.createHash("sha256").update(metadataBody).digest("hex")}, + sources: records}, null, 2) + "\n"); +} + +main().catch((err) => {console.error(err.message); process.exitCode = 1;}); diff --git a/hack/validate-helm.integration.test.js b/hack/validate-helm.integration.test.js new file mode 100644 index 0000000..b5acaa0 --- /dev/null +++ b/hack/validate-helm.integration.test.js @@ -0,0 +1,76 @@ +"use strict"; + +// Explicit, network-backed acceptance suite: npm run test:helm:integration. +const test = require("node:test"); +const assert = require("node:assert/strict"); +const fs = require("node:fs"); +const os = require("node:os"); +const path = require("node:path"); +const YAML = require("yaml"); +const {root} = require("./lib/catalog"); +const {main} = require("./validate-helm"); +const {command, kubeconformArgs} = require("./lib/helm-validation"); +const config = require("../schema/helm/config.json"); + +test("released charts: fixed/range versions, all example variants, LWS, defaults and invalid configurations", {timeout: 240000}, (t) => { + const temp = fs.mkdtempSync(path.join(os.tmpdir(), "helm-acceptance-")); + t.after(() => fs.rmSync(temp, {recursive: true, force: true})); + fs.mkdirSync(path.join(temp, "models/fixtures"), {recursive: true}); + fs.mkdirSync(path.join(temp, "schema")); + fs.symlinkSync(path.join(root, "schema/helm"), path.join(temp, "schema/helm"), "dir"); + fs.symlinkSync(path.join(root, ".cache"), path.join(temp, ".cache"), "dir"); + function write(name, doc) { + fs.writeFileSync(path.join(temp, `models/fixtures/${name}.yaml`), YAML.stringify(doc)); + } + for (const [name, file] of [ + ["valid-fixed", "models/glm5.3/glm5.3-1.0.0.yaml"], + ["valid-range", "models/glm5.3/glm5.3-1.0.1.yaml"], + ["valid-gemma", "models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml"], + ["valid-lws", "models/kimi-k2.5/kimi-k2.5-1.0.0.yaml"] + ]) write(name, YAML.parse(fs.readFileSync(path.join(root, file), "utf8"))); + const base = {variants: [{id: "fixture", chart: {name: "sglang", version: ">=0.7.8"}}]}; + write("valid-defaults", base); + const invalids = [ + ["bad-key", {unkownField: true}, "lint"], + ["bad-type", {service: {port: "bad"}}, "lint"], + ["bad-env", {env: [{name: "TEST", value: "x", misspelled: true}]}, "kubeconform"], + ["bad-volume", {volumes: [{name: "bad", emptyDir: {misspelled: true}}]}, "kubeconform"], + ["bad-resources", {resources: {requsets: {cpu: "1"}}}, "kubeconform"], + ["bad-crd", {sloRequirement: {extraSpec: {unknownSpecField: true}}}, "kubeconform"], + ["bad-template", {sloRequirement: {extraSpec: {serviceId: "duplicate"}}}, "template"], + ["bad-explicit-route", {modelRoute: {nginx: {outputConfigMap: ""}}}, "template"] + ]; + for (const [name, values] of invalids) { + const doc = structuredClone(base); doc.variants[0].values = values; write(name, doc); + } + const noVersion = structuredClone(base); noVersion.variants[0].chart.version = "9999.0.0"; + write("bad-resolution", noVersion); + const output = path.join(temp, "artifacts"); + assert.equal(main({all: true, files: [], output}, {repositoryRoot: temp}), false); + const summary = JSON.parse(fs.readFileSync(path.join(output, "summary.json"), "utf8")); + for (const result of summary.results.filter((r) => path.basename(r.file).startsWith("valid-"))) { + assert.equal(result.ok, true, `${result.file}: ${JSON.stringify(result)}`); + } + const fixed = summary.results.find((r) => r.file.endsWith("valid-fixed.yaml")); + assert.equal(fixed.chart.version, "0.7.1"); + assert.equal(summary.results.filter((r) => r.file.endsWith("valid-gemma.yaml")).length, 2); + for (const [name, , stage] of invalids) { + const result = summary.results.find((r) => r.file.endsWith(`${name}.yaml`)); + assert.equal(result.ok, false, name); + assert.equal(result.stages[stage], false, `${name}: ${JSON.stringify(result)}`); + } + assert.match(summary.results.find((r) => r.file.endsWith("bad-resolution.yaml")).error, /no published/); + // Verify the exact production kubeconform invocation fails for unknown GVKs, + // even if their kind resembles an existing native resource or known CRD. + const cache = path.join(temp, "schema-cache"); fs.mkdirSync(cache); + for (const [apiVersion, kind] of [ + ["unknown.example/v1", "Unknown"], ["wrong.example/v1", "ModelRoute"], + ["routing.modelsphere.dev/v9", "ModelRoute"], ["apps.wrong.example/v1", "Deployment"] + ]) { + const rendered = path.join(temp, "unknown.yaml"); + fs.writeFileSync(rendered, YAML.stringify({apiVersion, kind, metadata: {name: "unknown"}})); + const result = command(path.join(root, ".cache/helm-validation/bin/kubeconform"), + kubeconformArgs(config, path.join(root, "schema/helm/crds"), cache, rendered)); + assert.equal(result.ok, false, `${apiVersion}/${kind}`); + } +}); diff --git a/hack/validate-helm.js b/hack/validate-helm.js new file mode 100644 index 0000000..7f8993c --- /dev/null +++ b/hack/validate-helm.js @@ -0,0 +1,201 @@ +#!/usr/bin/env node +"use strict"; + +const fs = require("node:fs"); +const path = require("node:path"); +const crypto = require("node:crypto"); +const YAML = require("yaml"); +const {root} = require("./lib/catalog"); +const {command, selectFiles, variantValues, kubeconformArgs, parseVersions} = require("./lib/helm-validation"); +const config = require("../schema/helm/config.json"); + +function options(args) { + const opts = {files: [], output: path.join(root, "artifacts/helm-validation")}; + for (let i = 0; i < args.length; i++) { + const arg = args[i]; + if (arg === "--all") opts.all = true; + else if (["--base", "--output"].includes(arg)) { + if (!args[i + 1] || args[i + 1].startsWith("--")) throw new Error(`${arg}: missing argument`); + opts[arg.slice(2)] = args[++i]; + } else if (arg.startsWith("-")) throw new Error(`unknown option ${arg}`); + else opts.files.push(arg); + } + if ([Boolean(opts.all), Boolean(opts.base), Boolean(opts.files.length)].filter(Boolean).length > 1) { + throw new Error("choose one of --all, --base REF, or explicit files"); + } + opts.output = path.resolve(root, opts.output); + return opts; +} + +function main(opts, {repositoryRoot = root, runCommand = command} = {}) { + const root = repositoryRoot; + fs.mkdirSync(opts.output, {recursive: true}); + // Each invocation has isolated Helm settings and a fresh repository snapshot. + const runDir = fs.mkdtempSync(path.join(opts.output, "run-")); + const summary = {config, files: [], results: []}; + const writeSummary = () => { + const body = JSON.stringify(summary, null, 2) + "\n"; + fs.writeFileSync(path.join(opts.output, "summary.json"), body); + fs.writeFileSync(path.join(runDir, "summary.json"), body); + }; + const log = (message) => { + console.log(message); + fs.appendFileSync(path.join(runDir, "validation.log"), message + "\n"); + }; + const bin = (name) => { + const installed = path.join(root, ".cache/helm-validation/bin", name); + return fs.existsSync(installed) ? installed : name; + }; + const env = {...process.env, HELM_CONFIG_HOME: path.join(runDir, "helm/config"), + HELM_CACHE_HOME: path.join(runDir, "helm/cache"), HELM_DATA_HOME: path.join(runDir, "helm/data"), + HELM_PLUGINS: path.join(runDir, "helm/plugins")}; + const invoke = (tool, args, dir, stage) => { + const result = runCommand(tool, args, {cwd: root, env}); + fs.writeFileSync(path.join(dir, `${stage}.log`), result.log); + return result; + }; + const requireSuccess = (result, stage) => { + if (!result.ok) throw new Error(`${stage}: ${result.log}`); + return result.stdout; + }; + try { + const selection = selectFiles(root, opts); + Object.assign(summary, selection, {runDirectory: path.relative(root, runDir)}); + log(`Selection: ${selection.reason}${selection.mergeBase ? ` (${selection.mergeBase})` : ""}`); + if (!selection.files.length) { + log("No model version configuration changes (无版本配置变更)."); + return true; + } + log(`Validating ${selection.files.length} version files; Kubernetes ${config.kubernetesVersion}.`); + for (const [name, args] of [["helm", ["version", "--short"]], ["kubeconform", ["-v"]]]) { + const version = requireSuccess(invoke(bin(name), args, runDir, `${name}-version`), "tools").trim(); + if (!new RegExp(`^v${config[`${name}Version`].replaceAll(".", "\\.")}(?:\\+|$)`).test(version)) { + throw new Error(`${name}: expected ${config[`${name}Version`]}, got ${version}; run npm run helm:install`); + } + } + const schemaDir = path.join(root, "schema/helm/crds"); + const provenance = JSON.parse(fs.readFileSync(path.join(root, "schema/helm/provenance.json"), "utf8")); + if (provenance.converterVersion !== config.converterVersion) throw new Error("CRD converter version mismatch"); + const apis = [...new Set(provenance.sources.flatMap((source) => source.schemas.map((s) => `${s.group}/${s.version}`)))]; + const schemaCache = path.join(runDir, "schema-cache"); + fs.mkdirSync(schemaCache); + requireSuccess(invoke(bin("helm"), ["repo", "add", "catalog", config.chartRepository], runDir, "chart-repository"), "chart-repository"); + const index = YAML.parse(fs.readFileSync(path.join(env.HELM_CACHE_HOME, "repository/catalog-index.yaml"), "utf8")); + const requests = new Map(); + const packages = new Map(); + const chartDir = path.join(runDir, "charts"); + fs.mkdirSync(chartDir); + function chartFor(chart, dir) { + const requestKey = JSON.stringify(chart); + if (requests.has(requestKey)) { + const cached = requests.get(requestKey); + if (cached instanceof Error) throw cached; + return cached; + } + try { + const search = invoke(bin("helm"), ["search", "repo", `catalog/${chart.name}`, "--versions", "--version", chart.version, "--output", "json"], dir, "chart-resolution"); + // Helm searches descriptions as well as names. Restrict its results to + // the exact declared chart, retaining Helm's version precedence. + const matches = JSON.parse(requireSuccess(search, "chart-resolution")).filter((m) => m.name === `catalog/${chart.name}`); + if (!matches.length) throw new Error(`chart.version: no published ${chart.name} matches ${JSON.stringify(chart.version)}`); + const actualVersion = matches[0].version; + const key = `${chart.name}@${actualVersion}`; + if (!packages.has(key)) { + requireSuccess(invoke(bin("helm"), ["pull", `catalog/${chart.name}`, "--version", actualVersion, "--destination", chartDir], dir, "chart-download"), "chart-download"); + const archive = path.join(chartDir, `${chart.name}-${actualVersion}.tgz`); + const digest = crypto.createHash("sha256").update(fs.readFileSync(archive)).digest("hex"); + const published = index.entries[chart.name]?.find((entry) => entry.version === actualVersion); + if (!published?.digest || digest !== published.digest) throw new Error(`chart-download: ${key}: repository digest mismatch`); + const members = requireSuccess(invoke("tar", ["-tzf", archive], dir, "chart-package"), "chart-package").split("\n"); + if (!members.includes(`${chart.name}/values.schema.json`)) throw new Error(`${key}: published package is missing values.schema.json`); + const metadata = YAML.parse(requireSuccess(invoke(bin("helm"), ["show", "chart", archive], dir, "chart-metadata"), "chart-metadata")); + if (metadata.name !== chart.name || metadata.version !== actualVersion) throw new Error(`${key}: package metadata mismatch`); + packages.set(key, {archive, name: chart.name, actualVersion, digest: `sha256:${digest}`}); + } + const pkg = packages.get(key); + requests.set(requestKey, pkg); + return pkg; + } catch (err) { + requests.set(requestKey, err); + throw err; + } + } + for (const file of selection.files) { + let variants; + try { variants = parseVersions(path.join(root, file)); } + catch (err) { + log(`FAIL ${file} [parse]: ${err.message}`); + summary.results.push({file, stage: "parse", ok: false, error: err.message}); + continue; + } + for (const [index, variant] of variants.entries()) { + const label = `${file} :: ${variant.id} (variants[${index}])`; + const hash = crypto.createHash("sha256").update(file).digest("hex").slice(0, 12); + const dir = path.join(runDir, `${path.basename(file)}-${hash}`, variant.id); + fs.mkdirSync(dir, {recursive: true}); + const record = {file, variant: variant.id, variantIndex: index, declaredChart: variant.chart, + artifacts: path.relative(root, dir), stages: {}, ok: false}; + summary.results.push(record); + let stage = "values"; + try { + const {values, injected} = variantValues(variant); + record.injectedRouteConfig = injected; + if (injected) log(`${label}: supplying absent values.modelRoute.nginx.outputConfigMap=ci/openresty-conf`); + const valuesFile = path.join(dir, "values.yaml"); + fs.writeFileSync(valuesFile, YAML.stringify(values)); + stage = "chart"; + const pkg = chartFor(variant.chart, dir); + record.chart = {name: pkg.name, version: pkg.actualVersion, digest: pkg.digest}; + log(`${label}: chart ${pkg.name}@${pkg.actualVersion} ${pkg.digest}`); + fs.writeFileSync(path.join(dir, "chart.json"), JSON.stringify(record.chart, null, 2) + "\n"); + const shared = ["--values", valuesFile, "--kube-version", config.kubernetesVersion]; + // Run both stages even when lint fails: template can expose separate failures. + stage = "lint"; + const lint = invoke(bin("helm"), ["lint", pkg.archive, "--strict", ...shared], dir, "lint"); + record.stages.lint = lint.ok; + if (!lint.ok) log(`FAIL ${label} [lint]:\n${lint.log}`); + stage = "template"; + const template = invoke(bin("helm"), ["template", "catalog-ci", pkg.archive, "--namespace", "ci", ...shared, + ...apis.flatMap((api) => ["--api-versions", api])], dir, "template"); + record.stages.template = template.ok; + if (!template.ok) log(`FAIL ${label} [template]:\n${template.log}`); + const rendered = path.join(dir, "rendered.yaml"); + fs.writeFileSync(rendered, template.stdout); + if (template.ok) { + // An empty render must not turn a broken chart into a successful check. + stage = "template"; + const docs = YAML.parseAllDocuments(template.stdout); + if (docs.some((d) => d.errors.length) || !docs.some((d) => d.toJS()?.kind)) { + record.stages.template = false; + throw new Error("template: no Kubernetes resources or malformed rendered YAML"); + } + stage = "kubeconform"; + const kube = invoke(bin("kubeconform"), kubeconformArgs(config, schemaDir, schemaCache, rendered), dir, "kubeconform"); + record.stages.kubeconform = kube.ok; + if (!kube.ok) log(`FAIL ${label} [kubeconform]:\n${kube.log}`); + } + record.ok = ["lint", "template", "kubeconform"].every((name) => record.stages[name] === true); + if (record.ok) log(`PASS ${label}`); + } catch (err) { + record.error = err.message; + record.stage = stage; + fs.writeFileSync(path.join(dir, "error.log"), `[${stage}] ${err.message}\n`); + log(`FAIL ${label} [${stage}]: ${err.message}`); + } + } + } + const failed = summary.results.filter((r) => !r.ok).length; + log(`${summary.results.length} checks: ${summary.results.length - failed} passed, ${failed} failed. Artifacts: ${runDir}`); + return failed === 0; + } catch (err) { + summary.error = err.message; + log(`FAIL [setup]: ${err.message}`); + return false; + } finally { writeSummary(); } +} + +if (require.main === module) { + try { process.exitCode = main(options(process.argv.slice(2))) ? 0 : 1; } + catch (err) { console.error(err.message); process.exitCode = 1; } +} +module.exports = {options, main}; diff --git a/hack/validate-helm.test.js b/hack/validate-helm.test.js new file mode 100644 index 0000000..168917d --- /dev/null +++ b/hack/validate-helm.test.js @@ -0,0 +1,79 @@ +"use strict"; + +const test = require("node:test"); +const assert = require("node:assert/strict"); +const fs = require("node:fs"); +const os = require("node:os"); +const path = require("node:path"); +const crypto = require("node:crypto"); +const YAML = require("yaml"); +const {main, options} = require("./validate-helm"); +const config = require("../schema/helm/config.json"); + +function fixture(t, failure) { + const root = fs.mkdtempSync(path.join(os.tmpdir(), "helm-validator-")); + t.after(() => fs.rmSync(root, {recursive: true, force: true})); + const file = "models/example/example-1.0.0.yaml"; + fs.mkdirSync(path.join(root, "models/example"), {recursive: true}); + fs.writeFileSync(path.join(root, file), YAML.stringify({variants: [ + {id: "default", default: true, chart: {name: "sglang", version: "0.7.1"}}, + {id: "other", chart: {name: "sglang", version: ">=0.7.1"}, values: {extraArgs: ["--other"]}} + ]})); + fs.mkdirSync(path.join(root, "schema/helm"), {recursive: true}); + fs.writeFileSync(path.join(root, "schema/helm/provenance.json"), JSON.stringify({converterVersion: config.converterVersion, sources: []})); + const calls = []; + const bytes = Buffer.from("fixture-package"); + const runCommand = (bin, args, opts) => { + calls.push(args); + let stdout = ""; + if (args[0] === "version") stdout = `v${config.helmVersion}+test`; + else if (args[0] === "-v") stdout = `v${config.kubeconformVersion}`; + else if (args[0] === "repo") { + const dir = path.join(opts.env.HELM_CACHE_HOME, "repository"); + fs.mkdirSync(dir, {recursive: true}); + fs.writeFileSync(path.join(dir, "catalog-index.yaml"), YAML.stringify({entries: {sglang: [ + {version: "0.7.1", digest: crypto.createHash("sha256").update(bytes).digest("hex")} + ]}})); + } else if (args[0] === "search") stdout = JSON.stringify(failure === "resolution" ? [] : [{name: "catalog/sglang", version: "0.7.1"}]); + else if (args[0] === "pull") fs.writeFileSync(path.join(args.at(-1), "sglang-0.7.1.tgz"), bytes); + else if (args[0] === "-tzf") stdout = failure === "schema" ? "sglang/Chart.yaml\n" : "sglang/Chart.yaml\nsglang/values.schema.json\n"; + else if (args[0] === "show") stdout = "name: sglang\nversion: 0.7.1\n"; + else if (args[0] === "template") stdout = failure === "empty" ? "" : "apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: example\n"; + const stage = args[0] === "-strict" ? "kubeconform" : args[0] === "pull" ? "download" : args[0]; + const ok = stage !== failure; + return {stdout, ok, log: ok ? stdout : `${stage}: fixture failure at spec.template.spec.containers[0].env[0]\n`}; + }; + const output = path.join(root, "artifacts"); + const run = () => main({all: true, files: [], output}, {repositoryRoot: root, runCommand}); + const summary = () => JSON.parse(fs.readFileSync(path.join(output, "summary.json"), "utf8")); + return {run, summary, calls, root}; +} + +test("every variant uses independent values and the resolved package is reused", (t) => { + const f = fixture(t); + assert.equal(f.run(), true); + const s = f.summary(); + assert.equal(s.results.length, 2); + assert(s.results.every((r) => r.ok && r.chart.version === "0.7.1" && r.chart.digest.startsWith("sha256:"))); + assert.equal(f.calls.filter((a) => a[0] === "pull").length, 1); + const values = s.results.map((r) => YAML.parse(fs.readFileSync(path.join(f.root, r.artifacts, "values.yaml"), "utf8"))); + assert.equal(values[0].extraArgs, undefined); + assert.deepEqual(values[1].extraArgs, ["--other"]); + assert(f.calls.filter((a) => ["lint", "template"].includes(a[0])).every((a) => a.includes(config.kubernetesVersion))); +}); + +for (const failure of ["resolution", "download", "schema", "lint", "template", "kubeconform", "empty"]) { + test(`${failure} failure cannot report success`, (t) => { + const f = fixture(t, failure); + assert.equal(f.run(), false); + assert(f.summary().results.every((r) => !r.ok)); + if (failure === "lint") assert.equal(f.calls.filter((a) => a[0] === "template").length, 2); + if (failure === "template") assert.equal(f.calls.filter((a) => a[0] === "-strict").length, 0); + }); +} + +test("CLI rejects ambiguous selectors and incomplete arguments", () => { + assert.throws(() => options(["--all", "--base", "main"])); + assert.throws(() => options(["--base"])); + assert.throws(() => options(["--unknown"])); +}); diff --git a/package.json b/package.json index 50db4f8..aa753b7 100644 --- a/package.json +++ b/package.json @@ -17,6 +17,11 @@ "scripts": { "test": "./hack/validate.sh", "validate:schema": "node hack/validate-schema.js", + "validate:helm": "node hack/validate-helm.js", + "helm:install": "node hack/install-helm-tools.js", + "helm:update-schemas": "node hack/update-helm-schemas.js", + "test:helm": "node --test hack/lib/helm-validation.test.js hack/lib/crd-schema.test.js hack/validate-helm.test.js", + "test:helm:integration": "node --test hack/validate-helm.integration.test.js", "test:lib": "node --test 'hack/lib/*.test.js'", "prepare": "husky", "build:site": "node hack/build-site.js" diff --git a/schema/helm/README.md b/schema/helm/README.md new file mode 100644 index 0000000..eaf5500 --- /dev/null +++ b/schema/helm/README.md @@ -0,0 +1,129 @@ +# Helm validation schemas + +`npm run validate:helm` checks every variant in selected model version YAMLs. +It downloads **released** charts from the official repository, lets Helm merge +the chart defaults with `variant.values`, runs `helm lint --strict` and +`helm template`, then runs `kubeconform -strict`. It never ignores missing +schemas. It does not build dependencies: the dependency charts in the released +package are the ones being checked. + +## Reproduce locally + +Use Node.js 24 (CI's version), `git`, and `tar`. macOS and Linux on AMD64/ARM64 +are supported by the installer. Versions and archive SHA-256 checksums are in +[`config.json`](config.json). + +```sh +npm ci +npm run helm:install +npm run validate:helm -- --base origin/master +npm run validate:helm -- --all +npm run validate:helm -- models/glm5.3/glm5.3-1.0.1.yaml +npm run test:helm +npm run test:helm:integration +``` + +Without a selector, the base is `origin/HEAD`. `--base` compares committed HEAD +with the common ancestor of that ref and HEAD. Local uncommitted version edits +can be checked with explicit file paths or `--all`. Added/modified version +YAMLs and rename destinations are checked; deleted versions are excluded. +Metadata, reports, and documentation alone select no files. Changes to the +validator, its tests, dependency manifests, workflow, or this schema directory +select every version. All variants are checked, regardless of `default`. + +Only absent `values.modelRoute.nginx.outputConfigMap` is supplied with +`ci/openresty-conf`, with a log message. Explicit empty, null, or invalid values +are preserved. No feature is disabled to make validation pass. Missing `values` +means chart defaults plus that route placeholder. + +The repository index is fetched once per invocation. Helm resolves the declared +version constraint, and each resolved chart package is downloaded once and +checked against the index's SHA-256 digest. Every variant records the declared +constraint, resolved version and digest. Version ranges check the currently +selected release; they do not guarantee all past or future matching releases. + +The default artifact directory is `artifacts/helm-validation/`; override it with +`--output DIR`. `summary.json` identifies files, variants, actual chart versions, +stage results and per-variant artifact directories. Each invocation has a fresh +`run-*` directory with extracted values, rendered manifests, tool logs, downloaded +charts, a schema cache and isolated Helm settings. CI uploads these artifacts +even on failure. Helm and kubeconform errors retain field paths. + +## Schema sources and updates + +[`sources.json`](sources.json) locks upstream CRDs to full commit SHAs. +[`provenance.json`](provenance.json) records source URLs, source hashes, served +versions and generated filenames. Both historical and current API groups are +included for `LLMScaler` and `LLMSLORequirement`: chart `0.7.1` uses the older +groups, while later releases use `modelsphere.dev`. + +The converter is repository-versioned as `catalog-crd-schema-v1` in +[`hack/lib/crd-schema.js`](../../hack/lib/crd-schema.js), using the YAML parser +locked in `package-lock.json`. It converts all served versions, adds strictness +recursively to defined objects (including array items), preserves explicitly +typed maps and `x-kubernetes-preserve-unknown-fields`, handles nullable schemas +and Kubernetes `IntOrString`, and enforces full API group, version and kind. +Kubernetes supplies `metadata` implicitly for custom resources; the converter +adds the same pinned strict Kubernetes `ObjectMeta` and its required definitions +to each CRD schema, including CRDs that omit it. + +Native Kubernetes schemas use the configured `1.36.3` baseline and a pinned +`yannh/kubernetes-json-schema` commit. Helm uses the same version baseline. +Schema checking requires no cluster. Downloading tools, charts, and native +schemas requires public network access; CRD schemas are committed locally. + +To update a source, edit its commit/path in `sources.json` (and the Kubernetes +commit/version in `config.json` when needed), then regenerate and verify: + +```sh +npm run helm:update-schemas +npm run test:helm +npm run test:helm:integration +npm run validate:helm -- --all +``` + +Review generated changes together with provenance. Changes to conversion rules +must regenerate the schemas; bump the converter version when changing an +already deployed conversion contract. Tool updates must also update archive +checksums in `config.json`. + +The acceptance suite checks GLM's fixed and ranged chart declarations, both +Gemma variants, an LWS deployment, default values, misspelled fields, incorrect +types, invalid Kubernetes nesting, invalid CRD fields, template errors, no matching +release, and unknown/mismatched GVKs. Unit tests additionally cover selection, +download failures, a missing chart values schema, empty renders and failure +propagation. + +## Rollout and limits + +The initial full-catalog run checked 43 variants: 41 passed and two existing +Qwen configurations failed Helm's template check. Their published YAMLs are +intentionally preserved; the gate has no exception for these failures. + +| Version file | Variant | Declared / resolved chart | Existing failure | +| --- | --- | --- | --- | +| `models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml` | `sglang-tp2-h100` | `0.7.1` / `0.7.1` | `values.progressDeadlineSeconds: 2000` is below the startup probe budget, `180 × 30 = 5400` seconds. | +| `models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml` | `sglang-tp2-h100` | `>=0.7.1` / `0.8.10` | The same deadline/startup budget mismatch. | + +Consequently, this validator's introduction and subsequent changes that trigger +full-catalog validation will fail until those historical incompatibilities are +resolved. PRs that change other version configurations validate only their +selected files. The real acceptance suite passes independently of these two +historical failures. The resolved range version above records the initial run +and may change on future runs. + +After this workflow is merged and its check has run, add **`validate-helm`** to +the target branch's required status checks in GitHub branch protection/rulesets. +The job runs on every PR, without workflow path filters, so the required check +also completes for documentation-only PRs. + +This is offline compatibility validation of values and resource schemas. It +does not execute CEL, admission webhooks, or controller business logic, and +does not verify model paths, image pulls, engine arguments, or GPU execution. +Chart fields without constraints that never render cannot be fully checked here; +fix those constraints in the chart repository rather than duplicating the chart +contract in this catalog. + +References: [Helm schema validation](https://helm.sh/docs/v3/topics/charts/#schema-files), +[kubeconform custom schemas](https://github.com/yannh/kubeconform#customresourcedefinition-crd-support), +[kubeconform limits](https://github.com/yannh/kubeconform#limits-of-kubeconform-validation). diff --git a/schema/helm/config.json b/schema/helm/config.json new file mode 100644 index 0000000..a9e7383 --- /dev/null +++ b/schema/helm/config.json @@ -0,0 +1,26 @@ +{ + "helmVersion": "3.20.2", + "kubeconformVersion": "0.8.0", + "kubernetesVersion": "1.36.3", + "chartRepository": "https://modelsphere.github.io/helm-charts/", + "kubernetesSchemaCommit": "39a87cd29966bc0b3434e8cfbc2061782c8cb69a", + "converterVersion": "catalog-crd-schema-v1", + "toolChecksums": { + "darwin-arm64": { + "helm": "139c794c22f16b579d08ddd3008c8038b9bb2814f35b5bcca91f50a1f458978d", + "kubeconform": "f84f4dfbebf4a6b0b230385fa065a39ea35e02608c2b50d025dcf64775a69d67" + }, + "darwin-amd64": { + "helm": "7de04301f28b902a74f6286ed941cadc86ee5e6a9086a18f2ccf1f548e99d618", + "kubeconform": "71dbc87ac9f24099a62b93570e65aa06312ba6ac8aea63b7f86e9d999edf5a92" + }, + "linux-amd64": { + "helm": "258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea", + "kubeconform": "9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883" + }, + "linux-arm64": { + "helm": "5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691", + "kubeconform": "1f53fc8e81258197a35e8603054162a5af1de8c5af13746c71ab680d9534ed87" + } + } +} diff --git a/schema/helm/crds/autoscaling.4pd.io/llmscaler_v1alpha1.json b/schema/helm/crds/autoscaling.4pd.io/llmscaler_v1alpha1.json new file mode 100644 index 0000000..5743781 --- /dev/null +++ b/schema/helm/crds/autoscaling.4pd.io/llmscaler_v1alpha1.json @@ -0,0 +1,465 @@ +{ + "description": "LLMScaler is the Schema for the llmscalers API", + "properties": { + "apiVersion": { + "type": "string", + "enum": [ + "autoscaling.4pd.io/v1alpha1" + ] + }, + "kind": { + "type": "string", + "enum": [ + "LLMScaler" + ] + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" + }, + "spec": { + "description": "spec defines the desired state of LLMScaler", + "properties": { + "customProvider": { + "description": "customProvider configures the Custom metric provider. Required when\nmetricProvider is Custom, ignored otherwise.", + "properties": { + "namespace": { + "description": "namespace optionally narrows the match to decisions carrying this\nnamespace, for a server that reports the same serviceId in several. When\nempty, serviceId alone selects the decision — and a serviceId matching\nmore than one decision is an error rather than a choice, so set this if\nthe server ever reports duplicates.", + "type": "string" + }, + "path": { + "default": "/decisions", + "description": "path is the request path on serverAddress. Defaults to /decisions.", + "type": "string" + }, + "serviceId": { + "description": "serviceId names the service whose decision to read. It is sent as the\nserviceId query parameter and is also matched against\ndecisions[].serviceId in the reply, since the server is free to answer\nwith more than it was asked for.", + "type": "string" + } + }, + "required": [ + "serviceId" + ], + "type": "object", + "additionalProperties": false + }, + "maxReplicas": { + "description": "maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up", + "format": "int32", + "minimum": 1, + "type": "integer" + }, + "metricProvider": { + "default": "Prometheus", + "description": "metricProvider selects where the scaling signal comes from.\n\"Prometheus\" (default) evaluates spec.metrics as PromQL against\nspec.serverAddress and derives replicas from them. \"Custom\" ignores\nspec.metrics entirely and reads a replica count straight off the decision\nserver described by spec.customProvider — the two are alternatives, not\nlayers, and there is no fallback from one to the other.", + "enum": [ + "Prometheus", + "Custom" + ], + "type": "string" + }, + "metrics": { + "description": "metrics contains the specifications for which to use to calculate the\ndesired replica count. Required (and non-empty) under the Prometheus\nprovider; ignored under Custom, which gets its recommendation from the\ndecision server instead.", + "items": { + "description": "MetricSpec defines a Prometheus query and the target value to scale on.", + "properties": { + "name": { + "description": "name is an optional identifier for this metric, used in logs and events.", + "type": "string" + }, + "query": { + "description": "query is a PromQL instant query returning the current metric value as a\nsingle (averaged) scalar. Scaling compares it to target as\n desiredReplicas = ceil(readyReplicas * value / target)\nso it should be a per-replica value — e.g. wrap it in avg(...). Bake any\nlabel filters into the query. Example:\n avg(vllm:kv_cache_usage_perc{model_name=\"opt-125m\"})\nA result of more than one series is an error, not a sample to pick from:\naggregate away every label the source varies on (backend, model, route,\npod). A query that errors, returns no data, or returns NaN/Inf is skipped\nfor that sync rather than read as zero; if every metric is skipped the\nreplica count is held where it is.", + "type": "string" + }, + "target": { + "description": "target is the desired per-replica value of the query result. When the\nmeasured value exceeds target, replicas scale up proportionally. It must be\na finite positive number on the same scale as the query — a \"%\" suffix is\nrejected, since \"80%\" cannot be resolved without knowing whether the query\nreturns a 0-1 fraction (write \"0.8\") or a 0-100 percentage (write \"80\").", + "type": "string" + } + }, + "required": [ + "query", + "target" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "minReplicas": { + "description": "minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down", + "format": "int32", + "minimum": 1, + "type": "integer" + }, + "preemption": { + "description": "preemption defines whether priority-based preemption is enabled", + "properties": { + "enable": { + "type": "boolean" + }, + "priorityClass": { + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "retryPeriodSeconds": { + "default": 10, + "description": "retryPeriodSeconds is the interval at which the autoscaler retries when an error occurs or target is not found. Defaults to 10.", + "format": "int32", + "type": "integer" + }, + "scaleDown": { + "description": "scaleDown defines the behavior for scaling down, e.g. cache-aware teardown", + "properties": { + "behavior": { + "default": "CacheAware", + "description": "behavior controls how pods are chosen when scaling down.\n\"CacheAware\" (default) biases removal toward the coldest-cache pods by\nsetting a low controller.kubernetes.io/pod-deletion-cost on the pods being\nremoved, so the ReplicaSet deletes them first. This is best-effort and only\napplies to Deployment/ReplicaSet targets — StatefulSet/LWS scale-down is\nordinal-based and ignores the hint. \"None\" opts out and uses the workload\ncontroller's default deletion order.", + "enum": [ + "CacheAware", + "None" + ], + "type": "string" + }, + "deletionCostQuery": { + "description": "deletionCostQuery is an optional PromQL instant query used to compute each\npod's controller.kubernetes.io/pod-deletion-cost at scale-down time (only\napplies when behavior is CacheAware). It is evaluated against\nspec.serverAddress and must return one series per pod\ncarrying a \"pod\" label; the sample value becomes that pod's deletion cost.\nLower cost is deleted first, so the expression should yield lower numbers\nfor colder / less valuable pods (e.g. \"vllm:kv_cache_usage_perc * 100\").\nWhen empty, a newest-pod-first heuristic is used instead. It is PromQL, so\nit is only consulted under the Prometheus metric provider — under Custom,\nspec.serverAddress is a decision server with no query API, and the\nheuristic is used regardless of what is set here.", + "type": "string" + }, + "maxStepReplicas": { + "description": "maxStepReplicas caps how many replicas a single scale-down step may remove,\nso the fleet shrinks gradually instead of dropping straight from N to\nminReplicas when the metric collapses. It bounds the size of a step, not how\noften one happens: the next scale-down also waits for the previous one to\nsettle, so steps are at least syncPeriodSeconds apart and can be further\napart while the target is still converging. A full descent therefore takes\nroughly ceil((current-minReplicas)/maxStepReplicas) steps at that spacing —\non a slow-settling workload prefer a larger step. It rate-limits the write\nonly:\nstatus.desiredReplicas keeps reporting the uncapped recommendation, and\nsubsequent syncs keep stepping toward it until they meet. Scaling never goes\nbelow minReplicas, and scale-up is unaffected. 0 (default) means unlimited —\nscale down straight to the recommendation.", + "format": "int32", + "minimum": 0, + "type": "integer" + }, + "stabilizationWindowSeconds": { + "description": "stabilizationWindowSeconds dampens scale-down: replicas are held at the\nhighest recommendation seen within this many seconds, so a brief metric dip\ndoesn't shrink the fleet. Scale-up is immediate. 0 disables stabilization.", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "serverAddress": { + "description": "serverAddress is the metric source endpoint: the Prometheus query API\n(e.g. http://prometheus:9090) under the Prometheus provider, or the\ndecision server's base URL (e.g. http://decisions:80) under Custom.", + "type": "string" + }, + "serverHeaders": { + "additionalProperties": { + "type": "string" + }, + "description": "serverHeaders are additional HTTP headers sent with every metric-fetch\nrequest to the metric source (e.g. Authorization for a secured endpoint).\nValues are used verbatim.", + "type": "object" + }, + "syncPeriodSeconds": { + "default": 15, + "description": "syncPeriodSeconds is the interval at which the autoscaler evaluates metrics and scales. Defaults to 15.", + "format": "int32", + "type": "integer" + }, + "targetRef": { + "description": "targetRef points to the resource (e.g., Deployment) to scale", + "properties": { + "apiVersion": { + "type": "string" + }, + "kind": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "apiVersion", + "kind", + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "maxReplicas", + "minReplicas", + "serverAddress", + "targetRef" + ], + "type": "object", + "x-kubernetes-validations": [ + { + "message": "spec.metrics must be non-empty unless spec.metricProvider is Custom", + "rule": "(has(self.metricProvider) && self.metricProvider == 'Custom') || (has(self.metrics) && size(self.metrics) > 0)" + }, + { + "message": "spec.customProvider is required when spec.metricProvider is Custom", + "rule": "!(has(self.metricProvider) && self.metricProvider == 'Custom') || has(self.customProvider)" + } + ], + "additionalProperties": false + }, + "status": { + "description": "status defines the observed state of LLMScaler", + "properties": { + "conditions": { + "description": "conditions represent the current state of the LLMScaler resource.", + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "type" + ], + "x-kubernetes-list-type": "map" + }, + "currentReplicas": { + "description": "currentReplicas is the current number of replicas of pods managed by this autoscaler", + "format": "int32", + "type": "integer" + }, + "desiredReplicas": { + "description": "desiredReplicas is the desired number of replicas of pods managed by this autoscaler", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "spec", + "apiVersion", + "kind", + "metadata" + ], + "type": "object", + "additionalProperties": false, + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { + "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", + "type": "object" + }, + "creationTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "deletionGracePeriodSeconds": { + "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", + "format": "int64", + "type": "integer" + }, + "deletionTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "finalizers": { + "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set", + "x-kubernetes-patch-strategy": "merge" + }, + "generateName": { + "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", + "type": "string" + }, + "generation": { + "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", + "format": "int64", + "type": "integer" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", + "type": "object" + }, + "managedFields": { + "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", + "type": "string" + }, + "ownerReferences": { + "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "uid" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "uid", + "x-kubernetes-patch-strategy": "merge" + }, + "resourceVersion": { + "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", + "type": "string" + }, + "selfLink": { + "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", + "type": "string" + }, + "uid": { + "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { + "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", + "format": "date-time", + "type": "string" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { + "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", + "type": "string" + }, + "fieldsType": { + "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", + "type": "string" + }, + "fieldsV1": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", + "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." + }, + "manager": { + "description": "Manager is an identifier of the workflow managing these fields.", + "type": "string" + }, + "operation": { + "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", + "type": "string" + }, + "subresource": { + "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", + "type": "string" + }, + "time": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { + "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", + "type": "object" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { + "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", + "properties": { + "apiVersion": { + "description": "API version of the referent.", + "type": "string" + }, + "blockOwnerDeletion": { + "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", + "type": "boolean" + }, + "controller": { + "description": "If true, this reference points to the managing controller.", + "type": "boolean" + }, + "kind": { + "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "name": { + "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "uid": { + "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "required": [ + "apiVersion", + "kind", + "name", + "uid" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + } +} diff --git a/schema/helm/crds/autoscaling.modelsphere.dev/llmscaler_v1alpha1.json b/schema/helm/crds/autoscaling.modelsphere.dev/llmscaler_v1alpha1.json new file mode 100644 index 0000000..0c07922 --- /dev/null +++ b/schema/helm/crds/autoscaling.modelsphere.dev/llmscaler_v1alpha1.json @@ -0,0 +1,465 @@ +{ + "description": "LLMScaler is the Schema for the llmscalers API", + "properties": { + "apiVersion": { + "type": "string", + "enum": [ + "autoscaling.modelsphere.dev/v1alpha1" + ] + }, + "kind": { + "type": "string", + "enum": [ + "LLMScaler" + ] + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" + }, + "spec": { + "description": "spec defines the desired state of LLMScaler", + "properties": { + "customProvider": { + "description": "customProvider configures the Custom metric provider. Required when\nmetricProvider is Custom, ignored otherwise.", + "properties": { + "namespace": { + "description": "namespace optionally narrows the match to decisions carrying this\nnamespace, for a server that reports the same serviceId in several. When\nempty, serviceId alone selects the decision — and a serviceId matching\nmore than one decision is an error rather than a choice, so set this if\nthe server ever reports duplicates.", + "type": "string" + }, + "path": { + "default": "/decisions", + "description": "path is the request path on serverAddress. Defaults to /decisions.", + "type": "string" + }, + "serviceId": { + "description": "serviceId names the service whose decision to read. It is sent as the\nserviceId query parameter and is also matched against\ndecisions[].serviceId in the reply, since the server is free to answer\nwith more than it was asked for.", + "type": "string" + } + }, + "required": [ + "serviceId" + ], + "type": "object", + "additionalProperties": false + }, + "maxReplicas": { + "description": "maxReplicas is the upper limit for the number of replicas to which the\nautoscaler can scale up. 0 pins the fleet at zero replicas, which\ncombined with minReplicas: 0 disables scaling entirely.", + "format": "int32", + "minimum": 0, + "type": "integer" + }, + "metricProvider": { + "default": "Prometheus", + "description": "metricProvider selects where the scaling signal comes from.\n\"Prometheus\" (default) evaluates spec.metrics as PromQL against\nspec.serverAddress and derives replicas from them. \"Custom\" ignores\nspec.metrics entirely and reads a replica count straight off the decision\nserver described by spec.customProvider — the two are alternatives, not\nlayers, and there is no fallback from one to the other.", + "enum": [ + "Prometheus", + "Custom" + ], + "type": "string" + }, + "metrics": { + "description": "metrics contains the specifications for which to use to calculate the\ndesired replica count. Required (and non-empty) under the Prometheus\nprovider; ignored under Custom, which gets its recommendation from the\ndecision server instead.", + "items": { + "description": "MetricSpec defines a Prometheus query and the target value to scale on.", + "properties": { + "name": { + "description": "name is an optional identifier for this metric, used in logs and events.", + "type": "string" + }, + "query": { + "description": "query is a PromQL instant query returning the current metric value as a\nsingle (averaged) scalar. Scaling compares it to target as\n desiredReplicas = ceil(readyReplicas * value / target)\nso it should be a per-replica value — e.g. wrap it in avg(...). Bake any\nlabel filters into the query. Example:\n avg(vllm:kv_cache_usage_perc{model_name=\"opt-125m\"})\nA result of more than one series is an error, not a sample to pick from:\naggregate away every label the source varies on (backend, model, route,\npod). A query that errors, returns no data, or returns NaN/Inf is skipped\nfor that sync rather than read as zero; if every metric is skipped the\nreplica count is held where it is.", + "type": "string" + }, + "target": { + "description": "target is the desired per-replica value of the query result. When the\nmeasured value exceeds target, replicas scale up proportionally. It must be\na finite positive number on the same scale as the query — a \"%\" suffix is\nrejected, since \"80%\" cannot be resolved without knowing whether the query\nreturns a 0-1 fraction (write \"0.8\") or a 0-100 percentage (write \"80\").", + "type": "string" + } + }, + "required": [ + "query", + "target" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "minReplicas": { + "description": "minReplicas is the lower limit for the number of replicas to which the\nautoscaler can scale down. 0 enables scale-to-zero: an idle target is\nscaled all the way down, and wakes back up when a metric evaluates to a\npositive recommendation (under the Prometheus provider the ratio is then\ncomputed against a single-replica baseline, since a fleet of zero has no\nper-replica measurement to scale off).", + "format": "int32", + "minimum": 0, + "type": "integer" + }, + "preemption": { + "description": "preemption defines whether priority-based preemption is enabled", + "properties": { + "enable": { + "type": "boolean" + }, + "priorityClass": { + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "retryPeriodSeconds": { + "default": 10, + "description": "retryPeriodSeconds is the interval at which the autoscaler retries when an error occurs or target is not found. Defaults to 10.", + "format": "int32", + "type": "integer" + }, + "scaleDown": { + "description": "scaleDown defines the behavior for scaling down, e.g. cache-aware teardown", + "properties": { + "behavior": { + "default": "CacheAware", + "description": "behavior controls how pods are chosen when scaling down.\n\"CacheAware\" (default) biases removal toward the coldest-cache pods by\nsetting a low controller.kubernetes.io/pod-deletion-cost on the pods being\nremoved, so the ReplicaSet deletes them first. This is best-effort and only\napplies to Deployment/ReplicaSet targets — StatefulSet/LWS scale-down is\nordinal-based and ignores the hint. \"None\" opts out and uses the workload\ncontroller's default deletion order.", + "enum": [ + "CacheAware", + "None" + ], + "type": "string" + }, + "deletionCostQuery": { + "description": "deletionCostQuery is an optional PromQL instant query used to compute each\npod's controller.kubernetes.io/pod-deletion-cost at scale-down time (only\napplies when behavior is CacheAware). It is evaluated against\nspec.serverAddress and must return one series per pod\ncarrying a \"pod\" label; the sample value becomes that pod's deletion cost.\nLower cost is deleted first, so the expression should yield lower numbers\nfor colder / less valuable pods (e.g. \"vllm:kv_cache_usage_perc * 100\").\nWhen empty, a newest-pod-first heuristic is used instead. It is PromQL, so\nit is only consulted under the Prometheus metric provider — under Custom,\nspec.serverAddress is a decision server with no query API, and the\nheuristic is used regardless of what is set here.", + "type": "string" + }, + "maxStepReplicas": { + "description": "maxStepReplicas caps how many replicas a single scale-down step may remove,\nso the fleet shrinks gradually instead of dropping straight from N to\nminReplicas when the metric collapses. It bounds the size of a step, not how\noften one happens: the next scale-down also waits for the previous one to\nsettle, so steps are at least syncPeriodSeconds apart and can be further\napart while the target is still converging. A full descent therefore takes\nroughly ceil((current-minReplicas)/maxStepReplicas) steps at that spacing —\non a slow-settling workload prefer a larger step. It rate-limits the write\nonly:\nstatus.desiredReplicas keeps reporting the uncapped recommendation, and\nsubsequent syncs keep stepping toward it until they meet. Scaling never goes\nbelow minReplicas, and scale-up is unaffected. 0 (default) means unlimited —\nscale down straight to the recommendation.", + "format": "int32", + "minimum": 0, + "type": "integer" + }, + "stabilizationWindowSeconds": { + "description": "stabilizationWindowSeconds dampens scale-down: replicas are held at the\nhighest recommendation seen within this many seconds, so a brief metric dip\ndoesn't shrink the fleet. Scale-up is immediate. 0 disables stabilization.", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "serverAddress": { + "description": "serverAddress is the metric source endpoint: the Prometheus query API\n(e.g. http://prometheus:9090) under the Prometheus provider, or the\ndecision server's base URL (e.g. http://decisions:80) under Custom.", + "type": "string" + }, + "serverHeaders": { + "additionalProperties": { + "type": "string" + }, + "description": "serverHeaders are additional HTTP headers sent with every metric-fetch\nrequest to the metric source (e.g. Authorization for a secured endpoint).\nValues are used verbatim.", + "type": "object" + }, + "syncPeriodSeconds": { + "default": 15, + "description": "syncPeriodSeconds is the interval at which the autoscaler evaluates metrics and scales. Defaults to 15.", + "format": "int32", + "type": "integer" + }, + "targetRef": { + "description": "targetRef points to the resource (e.g., Deployment) to scale", + "properties": { + "apiVersion": { + "type": "string" + }, + "kind": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "apiVersion", + "kind", + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "maxReplicas", + "minReplicas", + "serverAddress", + "targetRef" + ], + "type": "object", + "x-kubernetes-validations": [ + { + "message": "spec.metrics must be non-empty unless spec.metricProvider is Custom", + "rule": "(has(self.metricProvider) && self.metricProvider == 'Custom') || (has(self.metrics) && size(self.metrics) > 0)" + }, + { + "message": "spec.customProvider is required when spec.metricProvider is Custom", + "rule": "!(has(self.metricProvider) && self.metricProvider == 'Custom') || has(self.customProvider)" + } + ], + "additionalProperties": false + }, + "status": { + "description": "status defines the observed state of LLMScaler", + "properties": { + "conditions": { + "description": "conditions represent the current state of the LLMScaler resource.", + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "type" + ], + "x-kubernetes-list-type": "map" + }, + "currentReplicas": { + "description": "currentReplicas is the current number of replicas of pods managed by this autoscaler", + "format": "int32", + "type": "integer" + }, + "desiredReplicas": { + "description": "desiredReplicas is the desired number of replicas of pods managed by this autoscaler", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "spec", + "apiVersion", + "kind", + "metadata" + ], + "type": "object", + "additionalProperties": false, + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { + "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", + "type": "object" + }, + "creationTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "deletionGracePeriodSeconds": { + "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", + "format": "int64", + "type": "integer" + }, + "deletionTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "finalizers": { + "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set", + "x-kubernetes-patch-strategy": "merge" + }, + "generateName": { + "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", + "type": "string" + }, + "generation": { + "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", + "format": "int64", + "type": "integer" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", + "type": "object" + }, + "managedFields": { + "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", + "type": "string" + }, + "ownerReferences": { + "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "uid" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "uid", + "x-kubernetes-patch-strategy": "merge" + }, + "resourceVersion": { + "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", + "type": "string" + }, + "selfLink": { + "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", + "type": "string" + }, + "uid": { + "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { + "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", + "format": "date-time", + "type": "string" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { + "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", + "type": "string" + }, + "fieldsType": { + "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", + "type": "string" + }, + "fieldsV1": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", + "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." + }, + "manager": { + "description": "Manager is an identifier of the workflow managing these fields.", + "type": "string" + }, + "operation": { + "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", + "type": "string" + }, + "subresource": { + "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", + "type": "string" + }, + "time": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { + "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", + "type": "object" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { + "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", + "properties": { + "apiVersion": { + "description": "API version of the referent.", + "type": "string" + }, + "blockOwnerDeletion": { + "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", + "type": "boolean" + }, + "controller": { + "description": "If true, this reference points to the managing controller.", + "type": "boolean" + }, + "kind": { + "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "name": { + "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "uid": { + "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "required": [ + "apiVersion", + "kind", + "name", + "uid" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + } +} diff --git a/schema/helm/crds/inference.modelsphere.dev/llmslorequirement_v1alpha1.json b/schema/helm/crds/inference.modelsphere.dev/llmslorequirement_v1alpha1.json new file mode 100644 index 0000000..7b015aa --- /dev/null +++ b/schema/helm/crds/inference.modelsphere.dev/llmslorequirement_v1alpha1.json @@ -0,0 +1,474 @@ +{ + "properties": { + "spec": { + "properties": { + "maximumDeployment": { + "properties": { + "type": { + "default": "replica", + "enum": [ + "replica" + ], + "type": "string" + }, + "value": { + "description": "Highest replica count the decision service may recommend. 0 (with minimumDeployment.value also 0) turns the service off.", + "minimum": 0, + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "minimumDeployment": { + "default": { + "type": "replica", + "value": 1 + }, + "properties": { + "type": { + "default": "replica", + "enum": [ + "replica", + "concurrency" + ], + "type": "string" + }, + "value": { + "description": "Lowest replica count the decision service may recommend. 0 enables scale-to-zero: an idle service is scaled all the way down.", + "default": 1, + "minimum": 0, + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "otps": { + "description": "Output Tokens Per Second (OTPS) SLO configuration.", + "properties": { + "default": { + "description": "Default fallback metrics applied when input does not hit any specific range.", + "properties": { + "metrics": { + "items": { + "properties": { + "threshold": { + "format": "float", + "minimum": 0, + "type": "number" + }, + "type": { + "enum": [ + "avg", + "p50", + "p80", + "p90", + "p95", + "p99" + ], + "type": "string" + } + }, + "required": [ + "type", + "threshold" + ], + "type": "object", + "additionalProperties": false + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "metrics" + ], + "type": "object", + "additionalProperties": false + }, + "ranges": { + "items": { + "properties": { + "contextLengthRangeHigh": { + "minimum": 1, + "type": "integer" + }, + "contextLengthRangeLow": { + "minimum": 0, + "type": "integer" + }, + "metrics": { + "description": "Multiple metric definitions (p50, p90, etc.) for this context range.", + "items": { + "properties": { + "threshold": { + "format": "float", + "minimum": 0, + "type": "number" + }, + "type": { + "enum": [ + "avg", + "p50", + "p80", + "p90", + "p95", + "p99" + ], + "type": "string" + } + }, + "required": [ + "type", + "threshold" + ], + "type": "object", + "additionalProperties": false + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "contextLengthRangeLow", + "metrics" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + } + }, + "type": "object", + "additionalProperties": false + }, + "priority": { + "default": 0, + "description": "Priority level from 0 to 10. Deployments with higher priority acquire nodes first.", + "maximum": 10, + "minimum": 0, + "type": "integer" + }, + "serviceId": { + "description": "Identifier referencing the target service.", + "type": "string" + }, + "ttft": { + "description": "Time To First Token (TTFT) SLO configuration.", + "properties": { + "default": { + "description": "Default fallback metrics applied when input does not hit any specific range.", + "properties": { + "metrics": { + "items": { + "properties": { + "threshold": { + "format": "float", + "minimum": 0, + "type": "number" + }, + "type": { + "enum": [ + "avg", + "p50", + "p80", + "p90", + "p95", + "p99" + ], + "type": "string" + } + }, + "required": [ + "type", + "threshold" + ], + "type": "object", + "additionalProperties": false + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "metrics" + ], + "type": "object", + "additionalProperties": false + }, + "ranges": { + "items": { + "properties": { + "contextLengthRangeHigh": { + "minimum": 1, + "type": "integer" + }, + "contextLengthRangeLow": { + "minimum": 0, + "type": "integer" + }, + "metrics": { + "description": "Multiple metric definitions (p50, p90, etc.) for this context range.", + "items": { + "properties": { + "threshold": { + "format": "float", + "minimum": 0, + "type": "number" + }, + "type": { + "enum": [ + "avg", + "p50", + "p80", + "p90", + "p95", + "p99" + ], + "type": "string" + } + }, + "required": [ + "type", + "threshold" + ], + "type": "object", + "additionalProperties": false + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "contextLengthRangeLow", + "metrics" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "serviceId" + ], + "type": "object", + "x-kubernetes-validations": [ + { + "rule": "!has(self.maximumDeployment) || self.minimumDeployment.value <= self.maximumDeployment.value", + "message": "minimumDeployment.value must be less than or equal to maximumDeployment.value" + }, + { + "rule": "!has(self.maximumDeployment) || self.minimumDeployment.value != 0 || self.maximumDeployment.value == 0", + "message": "maximumDeployment.value must be 0 when minimumDeployment.value is 0 (scale-to-zero is only for temporarily suspending the service)" + } + ], + "additionalProperties": false + }, + "apiVersion": { + "type": "string", + "enum": [ + "inference.modelsphere.dev/v1alpha1" + ] + }, + "kind": { + "type": "string", + "enum": [ + "LLMSLORequirement" + ] + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" + } + }, + "type": "object", + "additionalProperties": false, + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { + "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", + "type": "object" + }, + "creationTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "deletionGracePeriodSeconds": { + "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", + "format": "int64", + "type": "integer" + }, + "deletionTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "finalizers": { + "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set", + "x-kubernetes-patch-strategy": "merge" + }, + "generateName": { + "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", + "type": "string" + }, + "generation": { + "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", + "format": "int64", + "type": "integer" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", + "type": "object" + }, + "managedFields": { + "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", + "type": "string" + }, + "ownerReferences": { + "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "uid" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "uid", + "x-kubernetes-patch-strategy": "merge" + }, + "resourceVersion": { + "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", + "type": "string" + }, + "selfLink": { + "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", + "type": "string" + }, + "uid": { + "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { + "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", + "format": "date-time", + "type": "string" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { + "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", + "type": "string" + }, + "fieldsType": { + "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", + "type": "string" + }, + "fieldsV1": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", + "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." + }, + "manager": { + "description": "Manager is an identifier of the workflow managing these fields.", + "type": "string" + }, + "operation": { + "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", + "type": "string" + }, + "subresource": { + "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", + "type": "string" + }, + "time": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { + "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", + "type": "object" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { + "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", + "properties": { + "apiVersion": { + "description": "API version of the referent.", + "type": "string" + }, + "blockOwnerDeletion": { + "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", + "type": "boolean" + }, + "controller": { + "description": "If true, this reference points to the managing controller.", + "type": "boolean" + }, + "kind": { + "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "name": { + "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "uid": { + "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "required": [ + "apiVersion", + "kind", + "name", + "uid" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ] +} diff --git a/schema/helm/crds/inference.x-k8s.io/llmslorequirement_v1alpha1.json b/schema/helm/crds/inference.x-k8s.io/llmslorequirement_v1alpha1.json new file mode 100644 index 0000000..50fa938 --- /dev/null +++ b/schema/helm/crds/inference.x-k8s.io/llmslorequirement_v1alpha1.json @@ -0,0 +1,462 @@ +{ + "properties": { + "spec": { + "properties": { + "maximumDeployment": { + "properties": { + "type": { + "default": "replica", + "enum": [ + "replica" + ], + "type": "string" + }, + "value": { + "minimum": 1, + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "minimumDeployment": { + "default": { + "type": "replica", + "value": 1 + }, + "properties": { + "type": { + "default": "replica", + "enum": [ + "replica", + "concurrency" + ], + "type": "string" + }, + "value": { + "default": 1, + "minimum": 1, + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "otps": { + "description": "Output Tokens Per Second (OTPS) SLO configuration.", + "properties": { + "default": { + "description": "Default fallback metrics applied when input does not hit any specific range.", + "properties": { + "metrics": { + "items": { + "properties": { + "threshold": { + "format": "float", + "minimum": 0, + "type": "number" + }, + "type": { + "enum": [ + "avg", + "p50", + "p80", + "p90", + "p95", + "p99" + ], + "type": "string" + } + }, + "required": [ + "type", + "threshold" + ], + "type": "object", + "additionalProperties": false + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "metrics" + ], + "type": "object", + "additionalProperties": false + }, + "ranges": { + "items": { + "properties": { + "contextLengthRangeHigh": { + "minimum": 1, + "type": "integer" + }, + "contextLengthRangeLow": { + "minimum": 0, + "type": "integer" + }, + "metrics": { + "description": "Multiple metric definitions (p50, p90, etc.) for this context range.", + "items": { + "properties": { + "threshold": { + "format": "float", + "minimum": 0, + "type": "number" + }, + "type": { + "enum": [ + "avg", + "p50", + "p80", + "p90", + "p95", + "p99" + ], + "type": "string" + } + }, + "required": [ + "type", + "threshold" + ], + "type": "object", + "additionalProperties": false + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "contextLengthRangeLow", + "metrics" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + } + }, + "type": "object", + "additionalProperties": false + }, + "priority": { + "default": 0, + "description": "Priority level from 0 to 10. Deployments with higher priority acquire nodes first.", + "maximum": 10, + "minimum": 0, + "type": "integer" + }, + "serviceId": { + "description": "Identifier referencing the target service.", + "type": "string" + }, + "ttft": { + "description": "Time To First Token (TTFT) SLO configuration.", + "properties": { + "default": { + "description": "Default fallback metrics applied when input does not hit any specific range.", + "properties": { + "metrics": { + "items": { + "properties": { + "threshold": { + "format": "float", + "minimum": 0, + "type": "number" + }, + "type": { + "enum": [ + "avg", + "p50", + "p80", + "p90", + "p95", + "p99" + ], + "type": "string" + } + }, + "required": [ + "type", + "threshold" + ], + "type": "object", + "additionalProperties": false + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "metrics" + ], + "type": "object", + "additionalProperties": false + }, + "ranges": { + "items": { + "properties": { + "contextLengthRangeHigh": { + "minimum": 1, + "type": "integer" + }, + "contextLengthRangeLow": { + "minimum": 0, + "type": "integer" + }, + "metrics": { + "description": "Multiple metric definitions (p50, p90, etc.) for this context range.", + "items": { + "properties": { + "threshold": { + "format": "float", + "minimum": 0, + "type": "number" + }, + "type": { + "enum": [ + "avg", + "p50", + "p80", + "p90", + "p95", + "p99" + ], + "type": "string" + } + }, + "required": [ + "type", + "threshold" + ], + "type": "object", + "additionalProperties": false + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "contextLengthRangeLow", + "metrics" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "serviceId" + ], + "type": "object", + "additionalProperties": false + }, + "apiVersion": { + "type": "string", + "enum": [ + "inference.x-k8s.io/v1alpha1" + ] + }, + "kind": { + "type": "string", + "enum": [ + "LLMSLORequirement" + ] + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" + } + }, + "type": "object", + "additionalProperties": false, + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { + "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", + "type": "object" + }, + "creationTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "deletionGracePeriodSeconds": { + "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", + "format": "int64", + "type": "integer" + }, + "deletionTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "finalizers": { + "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set", + "x-kubernetes-patch-strategy": "merge" + }, + "generateName": { + "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", + "type": "string" + }, + "generation": { + "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", + "format": "int64", + "type": "integer" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", + "type": "object" + }, + "managedFields": { + "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", + "type": "string" + }, + "ownerReferences": { + "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "uid" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "uid", + "x-kubernetes-patch-strategy": "merge" + }, + "resourceVersion": { + "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", + "type": "string" + }, + "selfLink": { + "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", + "type": "string" + }, + "uid": { + "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { + "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", + "format": "date-time", + "type": "string" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { + "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", + "type": "string" + }, + "fieldsType": { + "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", + "type": "string" + }, + "fieldsV1": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", + "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." + }, + "manager": { + "description": "Manager is an identifier of the workflow managing these fields.", + "type": "string" + }, + "operation": { + "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", + "type": "string" + }, + "subresource": { + "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", + "type": "string" + }, + "time": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { + "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", + "type": "object" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { + "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", + "properties": { + "apiVersion": { + "description": "API version of the referent.", + "type": "string" + }, + "blockOwnerDeletion": { + "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", + "type": "boolean" + }, + "controller": { + "description": "If true, this reference points to the managing controller.", + "type": "boolean" + }, + "kind": { + "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "name": { + "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "uid": { + "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "required": [ + "apiVersion", + "kind", + "name", + "uid" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ] +} diff --git a/schema/helm/crds/leaderworkerset.x-k8s.io/leaderworkerset_v1.json b/schema/helm/crds/leaderworkerset.x-k8s.io/leaderworkerset_v1.json new file mode 100644 index 0000000..f1d08a1 --- /dev/null +++ b/schema/helm/crds/leaderworkerset.x-k8s.io/leaderworkerset_v1.json @@ -0,0 +1,16589 @@ +{ + "description": "LeaderWorkerSet is the Schema for the leaderworkersets API", + "properties": { + "apiVersion": { + "type": "string", + "enum": [ + "leaderworkerset.x-k8s.io/v1" + ] + }, + "kind": { + "type": "string", + "enum": [ + "LeaderWorkerSet" + ] + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" + }, + "spec": { + "description": "spec defines the desired behavior of LeaderWorkerSet.", + "properties": { + "groupIdentity": { + "default": "Ordinal", + "description": "groupIdentity determines how group identities are assigned.\nOrdinal (default) manages leaders through a StatefulSet: groups are named\n-0..-N-1 and scale down always removes the highest ordinal.\nHash manages leaders through a Deployment: group names are hash-suffixed,\nscale down prefers unscheduled and not-ready groups over healthy ones, and\nrollouts are paced by a group readiness gate on the leader pods.\nThis field is immutable.", + "enum": [ + "Ordinal", + "Hash" + ], + "type": "string" + }, + "groupReplacementPolicy": { + "default": "PostTermination", + "description": "groupReplacementPolicy controls when a replacement group may start\nscheduling after a group is deleted, whether by the restart policy\nrecreating a failed group, by a rolling update or by a scale down that\nraces a scale up.\nPostTermination (default) admits a replacement only once a previously\ndeleted group has been fully removed, so the new group lands on the\ncapacity the old one released instead of preempting other workloads.\nThis matches the StatefulSet semantics of groupIdentity Ordinal, where a\nleader pod cannot be recreated until its predecessor is gone, and is the\nonly supported value in that mode.\nImmediate admits replacement groups as soon as the leader Deployment\ncreates them, overlapping with the teardown of the old group. Only\nsupported with groupIdentity Hash.", + "enum": [ + "Immediate", + "PostTermination" + ], + "type": "string" + }, + "leaderWorkerTemplate": { + "description": "leaderWorkerTemplate defines the template for leader/worker pods", + "properties": { + "leaderTemplate": { + "description": "leaderTemplate defines the pod template for leader pods.", + "properties": { + "metadata": { + "description": "Standard object's metadata.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "finalizers": { + "items": { + "type": "string" + }, + "type": "array" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "spec": { + "description": "Specification of the desired behavior of the pod.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + "properties": { + "activeDeadlineSeconds": { + "description": "Optional duration in seconds the pod may be active on the node relative to\nStartTime before the system will actively try to mark it failed and kill associated containers.\nValue must be a positive integer.", + "format": "int64", + "type": "integer" + }, + "affinity": { + "description": "If specified, the pod's scheduling constraints", + "properties": { + "nodeAffinity": { + "description": "Describes node affinity scheduling rules for the pod.", + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node matches the corresponding matchExpressions; the\nnode(s) with the highest sum are the most preferred.", + "items": { + "description": "An empty preferred scheduling term matches all objects with implicit weight 0\n(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).", + "properties": { + "preference": { + "description": "A node selector term, associated with the corresponding weight.", + "properties": { + "matchExpressions": { + "description": "A list of node selector requirements by node's labels.", + "items": { + "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + "properties": { + "key": { + "description": "The label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + "type": "string" + }, + "values": { + "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchFields": { + "description": "A list of node selector requirements by node's fields.", + "items": { + "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + "properties": { + "key": { + "description": "The label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + "type": "string" + }, + "values": { + "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "weight": { + "description": "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.", + "format": "int32", + "type": "integer" + } + }, + "required": [ + "preference", + "weight" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to an update), the system\nmay or may not try to eventually evict the pod from its node.", + "properties": { + "nodeSelectorTerms": { + "description": "Required. A list of node selector terms. The terms are ORed.", + "items": { + "description": "A null or empty node selector term matches no objects. The requirements of\nthem are ANDed.\nThe TopologySelectorTerm type implements a subset of the NodeSelectorTerm.", + "properties": { + "matchExpressions": { + "description": "A list of node selector requirements by node's labels.", + "items": { + "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + "properties": { + "key": { + "description": "The label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + "type": "string" + }, + "values": { + "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchFields": { + "description": "A list of node selector requirements by node's fields.", + "items": { + "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + "properties": { + "key": { + "description": "The label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + "type": "string" + }, + "values": { + "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "nodeSelectorTerms" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "podAffinity": { + "description": "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).", + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + "items": { + "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", + "properties": { + "podAffinityTerm": { + "description": "Required. A pod affinity term, associated with the corresponding weight.", + "properties": { + "labelSelector": { + "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "mismatchLabelKeys": { + "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "namespaceSelector": { + "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "namespaces": { + "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologyKey": { + "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + "type": "string" + } + }, + "required": [ + "topologyKey" + ], + "type": "object", + "additionalProperties": false + }, + "weight": { + "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", + "format": "int32", + "type": "integer" + } + }, + "required": [ + "podAffinityTerm", + "weight" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", + "items": { + "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", + "properties": { + "labelSelector": { + "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "mismatchLabelKeys": { + "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "namespaceSelector": { + "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "namespaces": { + "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologyKey": { + "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + "type": "string" + } + }, + "required": [ + "topologyKey" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "podAntiAffinity": { + "description": "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + "items": { + "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", + "properties": { + "podAffinityTerm": { + "description": "Required. A pod affinity term, associated with the corresponding weight.", + "properties": { + "labelSelector": { + "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "mismatchLabelKeys": { + "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "namespaceSelector": { + "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "namespaces": { + "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologyKey": { + "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + "type": "string" + } + }, + "required": [ + "topologyKey" + ], + "type": "object", + "additionalProperties": false + }, + "weight": { + "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", + "format": "int32", + "type": "integer" + } + }, + "required": [ + "podAffinityTerm", + "weight" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "description": "If the anti-affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the anti-affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", + "items": { + "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", + "properties": { + "labelSelector": { + "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "mismatchLabelKeys": { + "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "namespaceSelector": { + "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "namespaces": { + "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologyKey": { + "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + "type": "string" + } + }, + "required": [ + "topologyKey" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "automountServiceAccountToken": { + "description": "AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.", + "type": "boolean" + }, + "containers": { + "description": "List of containers belonging to the pod.\nContainers cannot currently be added or removed.\nThere must be at least one container in a Pod.\nCannot be updated.", + "items": { + "description": "A single application container that you want to run within a pod.", + "properties": { + "args": { + "description": "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "command": { + "description": "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "env": { + "description": "List of environment variables to set in the container.\nCannot be updated.", + "items": { + "description": "EnvVar represents an environment variable present in a Container.", + "properties": { + "name": { + "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "value": { + "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + "type": "string" + }, + "valueFrom": { + "description": "Source for the environment variable's value. Cannot be used if value is not empty.", + "properties": { + "configMapKeyRef": { + "description": "Selects a key of a ConfigMap.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fieldRef": { + "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fileKeyRef": { + "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + "properties": { + "key": { + "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + "type": "string" + }, + "optional": { + "default": false, + "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + "type": "boolean" + }, + "path": { + "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + "type": "string" + }, + "volumeName": { + "description": "The name of the volume mount containing the env file.", + "type": "string" + } + }, + "required": [ + "key", + "path", + "volumeName" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secretKeyRef": { + "description": "Selects a key of a secret in the pod's namespace", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "envFrom": { + "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + "items": { + "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + "properties": { + "configMapRef": { + "description": "The ConfigMap to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "prefix": { + "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "secretRef": { + "description": "The Secret to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "image": { + "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", + "type": "string" + }, + "imagePullPolicy": { + "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + "type": "string" + }, + "lifecycle": { + "description": "Actions that the management system should take in response to container lifecycle events.\nCannot be updated.", + "properties": { + "postStart": { + "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "preStop": { + "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "stopSignal": { + "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "livenessProbe": { + "description": "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "name": { + "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", + "type": "string" + }, + "ports": { + "description": "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", + "items": { + "description": "ContainerPort represents a network port in a single container.", + "properties": { + "containerPort": { + "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + "format": "int32", + "type": "integer" + }, + "hostIP": { + "description": "What host IP to bind the external port to.", + "type": "string" + }, + "hostPort": { + "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + "format": "int32", + "type": "integer" + }, + "name": { + "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + "type": "string" + }, + "protocol": { + "default": "TCP", + "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + "type": "string" + } + }, + "required": [ + "containerPort" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "containerPort", + "protocol" + ], + "x-kubernetes-list-type": "map" + }, + "readinessProbe": { + "description": "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "resizePolicy": { + "description": "Resources resize policy for the container.\nThis field cannot be set on ephemeral containers.", + "items": { + "description": "ContainerResizePolicy represents resource resize policy for the container.", + "properties": { + "resourceName": { + "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", + "type": "string" + }, + "restartPolicy": { + "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", + "type": "string" + } + }, + "required": [ + "resourceName", + "restartPolicy" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "resources": { + "description": "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "properties": { + "claims": { + "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + "items": { + "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", + "properties": { + "name": { + "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + "type": "string" + }, + "request": { + "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "restartPolicy": { + "description": "RestartPolicy defines the restart behavior of individual containers in a pod.\nThis overrides the pod-level restart policy. When this field is not specified,\nthe restart behavior is defined by the Pod's restart policy and the container type.\nAdditionally, setting the RestartPolicy as \"Always\" for the init container will\nhave the following effect:\nthis init container will be continually restarted on\nexit until all regular containers have terminated. Once all regular\ncontainers have completed, all init containers with restartPolicy \"Always\"\nwill be shut down. This lifecycle differs from normal init containers and\nis often referred to as a \"sidecar\" container. Although this init\ncontainer still starts in the init container sequence, it does not wait\nfor the container to complete before proceeding to the next init\ncontainer. Instead, the next init container starts immediately after this\ninit container is started, or after any startupProbe has successfully\ncompleted.", + "type": "string" + }, + "restartPolicyRules": { + "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. The rules are evaluated in\norder. Once a rule matches a container exit condition, the remaining\nrules are ignored. If no rule matches the container exit condition,\nthe Container-level restart policy determines the whether the container\nis restarted or not. Constraints on the rules:\n- At most 20 rules are allowed.\n- Rules can have the same action.\n- Identical rules are not forbidden in validations.\nWhen rules are specified, container MUST set RestartPolicy explicitly\neven it if matches the Pod's RestartPolicy.", + "items": { + "description": "ContainerRestartRule describes how a container exit is handled.", + "properties": { + "action": { + "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", + "type": "string" + }, + "exitCodes": { + "description": "Represents the exit codes to check on container exits.", + "properties": { + "operator": { + "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", + "type": "string" + }, + "values": { + "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", + "items": { + "format": "int32", + "type": "integer" + }, + "type": "array", + "x-kubernetes-list-type": "set" + } + }, + "required": [ + "operator" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "action" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "securityContext": { + "description": "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + "properties": { + "allowPrivilegeEscalation": { + "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "appArmorProfile": { + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "capabilities": { + "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "add": { + "description": "Added capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "drop": { + "description": "Removed capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "privileged": { + "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "procMount": { + "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "readOnlyRootFilesystem": { + "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "runAsGroup": { + "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "runAsNonRoot": { + "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "boolean" + }, + "runAsUser": { + "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "seLinuxOptions": { + "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "level": { + "description": "Level is SELinux level label that applies to the container.", + "type": "string" + }, + "role": { + "description": "Role is a SELinux role label that applies to the container.", + "type": "string" + }, + "type": { + "description": "Type is a SELinux type label that applies to the container.", + "type": "string" + }, + "user": { + "description": "User is a SELinux user label that applies to the container.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "seccompProfile": { + "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + "type": "string" + }, + "type": { + "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "windowsOptions": { + "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + "properties": { + "gmsaCredentialSpec": { + "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + "type": "string" + }, + "gmsaCredentialSpecName": { + "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + "type": "string" + }, + "hostProcess": { + "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + "type": "boolean" + }, + "runAsUserName": { + "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "startupProbe": { + "description": "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "stdin": { + "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", + "type": "boolean" + }, + "stdinOnce": { + "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", + "type": "boolean" + }, + "terminationMessagePath": { + "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + "type": "string" + }, + "terminationMessagePolicy": { + "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + "type": "string" + }, + "tty": { + "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", + "type": "boolean" + }, + "volumeDevices": { + "description": "volumeDevices is the list of block devices to be used by the container.", + "items": { + "description": "volumeDevice describes a mapping of a raw block device within a container.", + "properties": { + "devicePath": { + "description": "devicePath is the path inside of the container that the device will be mapped to.", + "type": "string" + }, + "name": { + "description": "name must match the name of a persistentVolumeClaim in the pod", + "type": "string" + } + }, + "required": [ + "devicePath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "devicePath" + ], + "x-kubernetes-list-type": "map" + }, + "volumeMounts": { + "description": "Pod volumes to mount into the container's filesystem.\nCannot be updated.", + "items": { + "description": "VolumeMount describes a mounting of a Volume within a container.", + "properties": { + "bindMountOptions": { + "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "mountPath": { + "description": "Path within the container at which the volume should be mounted.", + "type": "string" + }, + "mountPropagation": { + "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + "type": "string" + }, + "name": { + "description": "This must match the Name of a Volume.", + "type": "string" + }, + "readOnly": { + "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + "type": "boolean" + }, + "recursiveReadOnly": { + "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + "type": "string" + }, + "subPath": { + "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + "type": "string" + }, + "subPathExpr": { + "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + "type": "string" + } + }, + "required": [ + "mountPath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "mountPath" + ], + "x-kubernetes-list-type": "map" + }, + "workingDir": { + "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "dnsConfig": { + "description": "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", + "properties": { + "nameservers": { + "description": "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "options": { + "description": "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", + "items": { + "description": "PodDNSConfigOption defines DNS resolver options of a pod.", + "properties": { + "name": { + "description": "Name is this DNS resolver option's name.\nRequired.", + "type": "string" + }, + "value": { + "description": "Value is this DNS resolver option's value.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "searches": { + "description": "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "dnsPolicy": { + "description": "Set DNS policy for the pod.\nDefaults to \"ClusterFirst\".\nValid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'.\nDNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy.\nTo have DNS options set along with hostNetwork, you have to specify DNS policy\nexplicitly to 'ClusterFirstWithHostNet'.", + "type": "string" + }, + "enableServiceLinks": { + "description": "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", + "type": "boolean" + }, + "ephemeralContainers": { + "description": "List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing\npod to perform user-initiated actions such as debugging. This list cannot be specified when\ncreating a pod, and it cannot be modified by updating the pod spec. In order to add an\nephemeral container to an existing pod, use the pod's ephemeralcontainers subresource.", + "items": { + "description": "An EphemeralContainer is a temporary container that you may add to an existing Pod for\nuser-initiated activities such as debugging. Ephemeral containers have no resource or\nscheduling guarantees, and they will not be restarted when they exit or when a Pod is\nremoved or restarted. The kubelet may evict a Pod if an ephemeral container causes the\nPod to exceed its resource allocation.\n\nTo add an ephemeral container, use the ephemeralcontainers subresource of an existing\nPod. Ephemeral containers may not be removed or restarted.", + "properties": { + "args": { + "description": "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "command": { + "description": "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "env": { + "description": "List of environment variables to set in the container.\nCannot be updated.", + "items": { + "description": "EnvVar represents an environment variable present in a Container.", + "properties": { + "name": { + "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "value": { + "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + "type": "string" + }, + "valueFrom": { + "description": "Source for the environment variable's value. Cannot be used if value is not empty.", + "properties": { + "configMapKeyRef": { + "description": "Selects a key of a ConfigMap.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fieldRef": { + "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fileKeyRef": { + "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + "properties": { + "key": { + "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + "type": "string" + }, + "optional": { + "default": false, + "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + "type": "boolean" + }, + "path": { + "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + "type": "string" + }, + "volumeName": { + "description": "The name of the volume mount containing the env file.", + "type": "string" + } + }, + "required": [ + "key", + "path", + "volumeName" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secretKeyRef": { + "description": "Selects a key of a secret in the pod's namespace", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "envFrom": { + "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + "items": { + "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + "properties": { + "configMapRef": { + "description": "The ConfigMap to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "prefix": { + "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "secretRef": { + "description": "The Secret to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "image": { + "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", + "type": "string" + }, + "imagePullPolicy": { + "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + "type": "string" + }, + "lifecycle": { + "description": "Lifecycle is not allowed for ephemeral containers.", + "properties": { + "postStart": { + "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "preStop": { + "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "stopSignal": { + "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "livenessProbe": { + "description": "Probes are not allowed for ephemeral containers.", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "name": { + "description": "Name of the ephemeral container specified as a DNS_LABEL.\nThis name must be unique among all containers, init containers and ephemeral containers.", + "type": "string" + }, + "ports": { + "description": "Ports are not allowed for ephemeral containers.", + "items": { + "description": "ContainerPort represents a network port in a single container.", + "properties": { + "containerPort": { + "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + "format": "int32", + "type": "integer" + }, + "hostIP": { + "description": "What host IP to bind the external port to.", + "type": "string" + }, + "hostPort": { + "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + "format": "int32", + "type": "integer" + }, + "name": { + "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + "type": "string" + }, + "protocol": { + "default": "TCP", + "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + "type": "string" + } + }, + "required": [ + "containerPort" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "containerPort", + "protocol" + ], + "x-kubernetes-list-type": "map" + }, + "readinessProbe": { + "description": "Probes are not allowed for ephemeral containers.", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "resizePolicy": { + "description": "Resources resize policy for the container.", + "items": { + "description": "ContainerResizePolicy represents resource resize policy for the container.", + "properties": { + "resourceName": { + "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", + "type": "string" + }, + "restartPolicy": { + "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", + "type": "string" + } + }, + "required": [ + "resourceName", + "restartPolicy" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "resources": { + "description": "Resources are not allowed for ephemeral containers. Ephemeral containers use spare resources\nalready allocated to the pod.", + "properties": { + "claims": { + "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + "items": { + "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", + "properties": { + "name": { + "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + "type": "string" + }, + "request": { + "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "restartPolicy": { + "description": "Restart policy for the container to manage the restart behavior of each\ncontainer within a pod.\nYou cannot set this field on ephemeral containers.", + "type": "string" + }, + "restartPolicyRules": { + "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. You cannot set this field on\nephemeral containers.", + "items": { + "description": "ContainerRestartRule describes how a container exit is handled.", + "properties": { + "action": { + "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", + "type": "string" + }, + "exitCodes": { + "description": "Represents the exit codes to check on container exits.", + "properties": { + "operator": { + "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", + "type": "string" + }, + "values": { + "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", + "items": { + "format": "int32", + "type": "integer" + }, + "type": "array", + "x-kubernetes-list-type": "set" + } + }, + "required": [ + "operator" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "action" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "securityContext": { + "description": "Optional: SecurityContext defines the security options the ephemeral container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.", + "properties": { + "allowPrivilegeEscalation": { + "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "appArmorProfile": { + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "capabilities": { + "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "add": { + "description": "Added capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "drop": { + "description": "Removed capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "privileged": { + "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "procMount": { + "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "readOnlyRootFilesystem": { + "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "runAsGroup": { + "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "runAsNonRoot": { + "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "boolean" + }, + "runAsUser": { + "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "seLinuxOptions": { + "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "level": { + "description": "Level is SELinux level label that applies to the container.", + "type": "string" + }, + "role": { + "description": "Role is a SELinux role label that applies to the container.", + "type": "string" + }, + "type": { + "description": "Type is a SELinux type label that applies to the container.", + "type": "string" + }, + "user": { + "description": "User is a SELinux user label that applies to the container.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "seccompProfile": { + "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + "type": "string" + }, + "type": { + "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "windowsOptions": { + "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + "properties": { + "gmsaCredentialSpec": { + "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + "type": "string" + }, + "gmsaCredentialSpecName": { + "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + "type": "string" + }, + "hostProcess": { + "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + "type": "boolean" + }, + "runAsUserName": { + "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "startupProbe": { + "description": "Probes are not allowed for ephemeral containers.", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "stdin": { + "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", + "type": "boolean" + }, + "stdinOnce": { + "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", + "type": "boolean" + }, + "targetContainerName": { + "description": "If set, the name of the container from PodSpec that this ephemeral container targets.\nThe ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.\nIf not set then the ephemeral container uses the namespaces configured in the Pod spec.\n\nThe container runtime must implement support for this feature. If the runtime does not\nsupport namespace targeting then the result of setting this field is undefined.", + "type": "string" + }, + "terminationMessagePath": { + "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + "type": "string" + }, + "terminationMessagePolicy": { + "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + "type": "string" + }, + "tty": { + "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", + "type": "boolean" + }, + "volumeDevices": { + "description": "volumeDevices is the list of block devices to be used by the container.", + "items": { + "description": "volumeDevice describes a mapping of a raw block device within a container.", + "properties": { + "devicePath": { + "description": "devicePath is the path inside of the container that the device will be mapped to.", + "type": "string" + }, + "name": { + "description": "name must match the name of a persistentVolumeClaim in the pod", + "type": "string" + } + }, + "required": [ + "devicePath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "devicePath" + ], + "x-kubernetes-list-type": "map" + }, + "volumeMounts": { + "description": "Pod volumes to mount into the container's filesystem. Subpath mounts are not allowed for ephemeral containers.\nCannot be updated.", + "items": { + "description": "VolumeMount describes a mounting of a Volume within a container.", + "properties": { + "bindMountOptions": { + "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "mountPath": { + "description": "Path within the container at which the volume should be mounted.", + "type": "string" + }, + "mountPropagation": { + "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + "type": "string" + }, + "name": { + "description": "This must match the Name of a Volume.", + "type": "string" + }, + "readOnly": { + "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + "type": "boolean" + }, + "recursiveReadOnly": { + "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + "type": "string" + }, + "subPath": { + "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + "type": "string" + }, + "subPathExpr": { + "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + "type": "string" + } + }, + "required": [ + "mountPath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "mountPath" + ], + "x-kubernetes-list-type": "map" + }, + "workingDir": { + "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "evictionResponders": { + "description": "evictionResponders reference responders that react to Evictions based on EvictionRequests.\nResponders should observe and communicate through the Eviction Resource API to help with\nthe graceful termination of a pod. The responders are selected sequentially, according to\ntheir specified priority.\n\nResponders should periodically report on an eviction progress by updating the\n.status.responders[].heartbeatTime field of the Eviction object. If this field is not updated\nwithin the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction\nis passed over to the next responder with a lower priority. If there is no other responder,\nthe last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will\nevict the pod using the imperative Eviction API (pods//eviction subresource).\n\nThe maximum length of the responders list is 10.\nResponders are not supported when the pod is part of a PodGroup (.spec.schedulingGroup is set).\nThis field can only be set on creation and is immutable afterwards.", + "items": { + "description": "EvictionResponder allows you to specify the responder reacting to an Eviction.\nResponders should observe and communicate through the Eviction Resource API to help with\nthe graceful eviction of a target (e.g. termination of a pod).", + "properties": { + "name": { + "description": "name allows you to identify the responder responding to the Eviction.\n\nIt must be a valid domain-prefixed key (such as \"acme.io/foo\").\nDomain names *.k8s.io and *.kubernetes.io are reserved.\nThis field must be unique for each responder.\nThis field is required.", + "type": "string" + }, + "priority": { + "description": "priority for this responder. Higher priorities are selected first by the evictionrequest-controller.\nIf there are responders with the same priority, the responder whose domain name comes first in the\nalphabetical higher domain order, will be picked. This means that the top domain labels are compared\nalphabetically first, followed by the lower domain labels. The key is compared last.\n\nThe responder that is the managing controller of the pod should set the value of\nthis field to 10000 to allow both for preemption or fallback registration by other\nresponders.\n\nThe minimum value is 0 and the maximum value is 100000.\nThe interval 0-999 is reserved for responders with *.k8s.io suffix.\nThis field is required.", + "format": "int32", + "type": "integer" + } + }, + "required": [ + "name", + "priority" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "hostAliases": { + "description": "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified.", + "items": { + "description": "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", + "properties": { + "hostnames": { + "description": "Hostnames for the above IP address.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "ip": { + "description": "IP address of the host file entry.", + "type": "string" + } + }, + "required": [ + "ip" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "ip" + ], + "x-kubernetes-list-type": "map" + }, + "hostIPC": { + "description": "Use the host's ipc namespace.\nOptional: Default to false.", + "type": "boolean" + }, + "hostNetwork": { + "description": "Host networking requested for this pod. Use the host's network namespace.\nWhen using HostNetwork you should specify ports so the scheduler is aware.\nWhen `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,\nand unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.\nDefault to false.", + "type": "boolean" + }, + "hostPID": { + "description": "Use the host's pid namespace.\nOptional: Default to false.", + "type": "boolean" + }, + "hostUsers": { + "description": "Use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new userns is created for the pod. Setting false is useful for\nmitigating container breakout vulnerabilities even allowing users to run their\ncontainers as root without actually having root privileges on the host.", + "type": "boolean" + }, + "hostname": { + "description": "Specifies the hostname of the Pod\nIf not specified, the pod's hostname will be set to a system-defined value.", + "type": "string" + }, + "hostnameOverride": { + "description": "HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.\nThis field only specifies the pod's hostname and does not affect its DNS records.\nWhen this field is set to a non-empty string:\n- It takes precedence over the values set in `hostname` and `subdomain`.\n- The Pod's hostname will be set to this value.\n- `setHostnameAsFQDN` must be nil or set to false.\n- `hostNetwork` must be set to false.\n\nThis field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.", + "type": "string" + }, + "imagePullSecrets": { + "description": "ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.\nIf specified, these secrets will be passed to individual puller implementations for them to use.\nMore info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod", + "items": { + "description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "initContainers": { + "description": "List of initialization containers belonging to the pod.\nInit containers are executed in order prior to containers being started. If any\ninit container fails, the pod is considered to have failed and is handled according\nto its restartPolicy. The name for an init container or normal container must be\nunique among all containers.\nInit containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.\nThe resourceRequirements of an init container are taken into account during scheduling\nby finding the highest request/limit for each resource type, and then using the max of\nthat value or the sum of the normal containers. Limits are applied to init containers\nin a similar fashion.\nInit containers cannot currently be added or removed.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/", + "items": { + "description": "A single application container that you want to run within a pod.", + "properties": { + "args": { + "description": "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "command": { + "description": "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "env": { + "description": "List of environment variables to set in the container.\nCannot be updated.", + "items": { + "description": "EnvVar represents an environment variable present in a Container.", + "properties": { + "name": { + "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "value": { + "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + "type": "string" + }, + "valueFrom": { + "description": "Source for the environment variable's value. Cannot be used if value is not empty.", + "properties": { + "configMapKeyRef": { + "description": "Selects a key of a ConfigMap.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fieldRef": { + "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fileKeyRef": { + "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + "properties": { + "key": { + "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + "type": "string" + }, + "optional": { + "default": false, + "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + "type": "boolean" + }, + "path": { + "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + "type": "string" + }, + "volumeName": { + "description": "The name of the volume mount containing the env file.", + "type": "string" + } + }, + "required": [ + "key", + "path", + "volumeName" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secretKeyRef": { + "description": "Selects a key of a secret in the pod's namespace", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "envFrom": { + "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + "items": { + "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + "properties": { + "configMapRef": { + "description": "The ConfigMap to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "prefix": { + "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "secretRef": { + "description": "The Secret to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "image": { + "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", + "type": "string" + }, + "imagePullPolicy": { + "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + "type": "string" + }, + "lifecycle": { + "description": "Actions that the management system should take in response to container lifecycle events.\nCannot be updated.", + "properties": { + "postStart": { + "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "preStop": { + "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "stopSignal": { + "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "livenessProbe": { + "description": "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "name": { + "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", + "type": "string" + }, + "ports": { + "description": "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", + "items": { + "description": "ContainerPort represents a network port in a single container.", + "properties": { + "containerPort": { + "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + "format": "int32", + "type": "integer" + }, + "hostIP": { + "description": "What host IP to bind the external port to.", + "type": "string" + }, + "hostPort": { + "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + "format": "int32", + "type": "integer" + }, + "name": { + "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + "type": "string" + }, + "protocol": { + "default": "TCP", + "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + "type": "string" + } + }, + "required": [ + "containerPort" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "containerPort", + "protocol" + ], + "x-kubernetes-list-type": "map" + }, + "readinessProbe": { + "description": "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "resizePolicy": { + "description": "Resources resize policy for the container.\nThis field cannot be set on ephemeral containers.", + "items": { + "description": "ContainerResizePolicy represents resource resize policy for the container.", + "properties": { + "resourceName": { + "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", + "type": "string" + }, + "restartPolicy": { + "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", + "type": "string" + } + }, + "required": [ + "resourceName", + "restartPolicy" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "resources": { + "description": "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "properties": { + "claims": { + "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + "items": { + "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", + "properties": { + "name": { + "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + "type": "string" + }, + "request": { + "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "restartPolicy": { + "description": "RestartPolicy defines the restart behavior of individual containers in a pod.\nThis overrides the pod-level restart policy. When this field is not specified,\nthe restart behavior is defined by the Pod's restart policy and the container type.\nAdditionally, setting the RestartPolicy as \"Always\" for the init container will\nhave the following effect:\nthis init container will be continually restarted on\nexit until all regular containers have terminated. Once all regular\ncontainers have completed, all init containers with restartPolicy \"Always\"\nwill be shut down. This lifecycle differs from normal init containers and\nis often referred to as a \"sidecar\" container. Although this init\ncontainer still starts in the init container sequence, it does not wait\nfor the container to complete before proceeding to the next init\ncontainer. Instead, the next init container starts immediately after this\ninit container is started, or after any startupProbe has successfully\ncompleted.", + "type": "string" + }, + "restartPolicyRules": { + "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. The rules are evaluated in\norder. Once a rule matches a container exit condition, the remaining\nrules are ignored. If no rule matches the container exit condition,\nthe Container-level restart policy determines the whether the container\nis restarted or not. Constraints on the rules:\n- At most 20 rules are allowed.\n- Rules can have the same action.\n- Identical rules are not forbidden in validations.\nWhen rules are specified, container MUST set RestartPolicy explicitly\neven it if matches the Pod's RestartPolicy.", + "items": { + "description": "ContainerRestartRule describes how a container exit is handled.", + "properties": { + "action": { + "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", + "type": "string" + }, + "exitCodes": { + "description": "Represents the exit codes to check on container exits.", + "properties": { + "operator": { + "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", + "type": "string" + }, + "values": { + "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", + "items": { + "format": "int32", + "type": "integer" + }, + "type": "array", + "x-kubernetes-list-type": "set" + } + }, + "required": [ + "operator" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "action" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "securityContext": { + "description": "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + "properties": { + "allowPrivilegeEscalation": { + "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "appArmorProfile": { + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "capabilities": { + "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "add": { + "description": "Added capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "drop": { + "description": "Removed capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "privileged": { + "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "procMount": { + "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "readOnlyRootFilesystem": { + "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "runAsGroup": { + "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "runAsNonRoot": { + "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "boolean" + }, + "runAsUser": { + "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "seLinuxOptions": { + "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "level": { + "description": "Level is SELinux level label that applies to the container.", + "type": "string" + }, + "role": { + "description": "Role is a SELinux role label that applies to the container.", + "type": "string" + }, + "type": { + "description": "Type is a SELinux type label that applies to the container.", + "type": "string" + }, + "user": { + "description": "User is a SELinux user label that applies to the container.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "seccompProfile": { + "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + "type": "string" + }, + "type": { + "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "windowsOptions": { + "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + "properties": { + "gmsaCredentialSpec": { + "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + "type": "string" + }, + "gmsaCredentialSpecName": { + "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + "type": "string" + }, + "hostProcess": { + "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + "type": "boolean" + }, + "runAsUserName": { + "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "startupProbe": { + "description": "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "stdin": { + "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", + "type": "boolean" + }, + "stdinOnce": { + "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", + "type": "boolean" + }, + "terminationMessagePath": { + "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + "type": "string" + }, + "terminationMessagePolicy": { + "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + "type": "string" + }, + "tty": { + "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", + "type": "boolean" + }, + "volumeDevices": { + "description": "volumeDevices is the list of block devices to be used by the container.", + "items": { + "description": "volumeDevice describes a mapping of a raw block device within a container.", + "properties": { + "devicePath": { + "description": "devicePath is the path inside of the container that the device will be mapped to.", + "type": "string" + }, + "name": { + "description": "name must match the name of a persistentVolumeClaim in the pod", + "type": "string" + } + }, + "required": [ + "devicePath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "devicePath" + ], + "x-kubernetes-list-type": "map" + }, + "volumeMounts": { + "description": "Pod volumes to mount into the container's filesystem.\nCannot be updated.", + "items": { + "description": "VolumeMount describes a mounting of a Volume within a container.", + "properties": { + "bindMountOptions": { + "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "mountPath": { + "description": "Path within the container at which the volume should be mounted.", + "type": "string" + }, + "mountPropagation": { + "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + "type": "string" + }, + "name": { + "description": "This must match the Name of a Volume.", + "type": "string" + }, + "readOnly": { + "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + "type": "boolean" + }, + "recursiveReadOnly": { + "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + "type": "string" + }, + "subPath": { + "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + "type": "string" + }, + "subPathExpr": { + "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + "type": "string" + } + }, + "required": [ + "mountPath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "mountPath" + ], + "x-kubernetes-list-type": "map" + }, + "workingDir": { + "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "nodeName": { + "description": "NodeName indicates in which node this pod is scheduled.\nIf empty, this pod is a candidate for scheduling by the scheduler defined in schedulerName.\nOnce this field is set, the kubelet for this node becomes responsible for the lifecycle of this pod.\nThis field should not be used to express a desire for the pod to be scheduled on a specific node.\nhttps://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodename", + "type": "string" + }, + "nodeSelector": { + "additionalProperties": { + "type": "string" + }, + "description": "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + "type": "object", + "x-kubernetes-map-type": "atomic" + }, + "os": { + "description": "Specifies the OS of the containers in the pod.\nSome pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset:\n-securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset:\n- spec.hostPID\n- spec.hostIPC\n- spec.hostUsers\n- spec.resources\n- spec.securityContext.appArmorProfile\n- spec.securityContext.seLinuxOptions\n- spec.securityContext.seccompProfile\n- spec.securityContext.fsGroup\n- spec.securityContext.fsGroupChangePolicy\n- spec.securityContext.sysctls\n- spec.shareProcessNamespace\n- spec.securityContext.runAsUser\n- spec.securityContext.runAsGroup\n- spec.securityContext.supplementalGroups\n- spec.securityContext.supplementalGroupsPolicy\n- spec.containers[*].securityContext.appArmorProfile\n- spec.containers[*].securityContext.seLinuxOptions\n- spec.containers[*].securityContext.seccompProfile\n- spec.containers[*].securityContext.capabilities\n- spec.containers[*].securityContext.readOnlyRootFilesystem\n- spec.containers[*].securityContext.privileged\n- spec.containers[*].securityContext.allowPrivilegeEscalation\n- spec.containers[*].securityContext.procMount\n- spec.containers[*].securityContext.runAsUser\n- spec.containers[*].securityContext.runAsGroup", + "properties": { + "name": { + "description": "Name is the name of the operating system. The currently supported values are linux and windows.\nAdditional value may be defined in future and can be one of:\nhttps://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration\nClients should expect to handle additional values and treat unrecognized values in this field as os: null", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "overhead": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Overhead represents the resource overhead associated with running a pod for a given RuntimeClass.\nThis field will be autopopulated at admission time by the RuntimeClass admission controller. If\nthe RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests.\nThe RuntimeClass admission controller will reject Pod create requests which have the overhead already\nset. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value\ndefined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md", + "type": "object" + }, + "preemptionPolicy": { + "description": "PreemptionPolicy is the Policy for preempting pods with lower priority.\nOne of Never, PreemptLowerPriority.\nWhen Priority Admission Controller is enabled, it prevents users from setting\nthis field. The admission controller populates this field from PriorityClassName.\nDefaults to PreemptLowerPriority if unset.", + "type": "string" + }, + "priority": { + "description": "The priority value. Various system components use this field to find the\npriority of the pod. When Priority Admission Controller is enabled, it\nprevents users from setting this field. The admission controller populates\nthis field from PriorityClassName.\nThe higher the value, the higher the priority.", + "format": "int32", + "type": "integer" + }, + "priorityClassName": { + "description": "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", + "type": "string" + }, + "readinessGates": { + "description": "If specified, all readiness gates will be evaluated for pod readiness.\nA pod is ready when all its containers are ready AND\nall conditions specified in the readiness gates have status equal to \"True\"\nMore info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates", + "items": { + "description": "PodReadinessGate contains the reference to a pod condition", + "properties": { + "conditionType": { + "description": "ConditionType refers to a condition in the pod's condition list with matching type.", + "type": "string" + } + }, + "required": [ + "conditionType" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "resourceClaims": { + "description": "ResourceClaims defines which ResourceClaims must be allocated\nand reserved before the Pod is allowed to start. The resources\nwill be made available to those containers which consume them\nby name.\n\nThis is a stable field but requires that the\nDynamicResourceAllocation feature gate is enabled.\n\nThis field is immutable.", + "items": { + "description": "PodResourceClaim references exactly one ResourceClaim, either directly\nor by naming a ResourceClaimTemplate which is then turned into a ResourceClaim\nfor the pod.\n\nIt adds a name to it that uniquely identifies the ResourceClaim inside the Pod.\nContainers that need access to the ResourceClaim reference it with this name.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and this Pod\nbelongs to a PodGroup, a PodResourceClaim is matched to a\nPodGroupResourceClaim if all of their fields are equal (Name,\nResourceClaimName, and ResourceClaimTemplateName). A matched claim references\na single ResourceClaim shared across all Pods in the PodGroup, reserved for\nthe PodGroup in ResourceClaimStatus.ReservedFor rather than for individual\nPods.", + "properties": { + "name": { + "description": "Name uniquely identifies this resource claim inside the pod.\nThis must be a DNS_LABEL.", + "type": "string" + }, + "resourceClaimName": { + "description": "ResourceClaimName is the name of a ResourceClaim object in the same\nnamespace as this pod.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.", + "type": "string" + }, + "resourceClaimTemplateName": { + "description": "ResourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace as this pod.\n\nThe template will be used to create a new ResourceClaim, which will\nbe bound to this pod. When this pod is deleted, the ResourceClaim\nwill also be deleted. The pod name and resource name, along with a\ngenerated component, will be used to form a unique name for the\nResourceClaim, which will be recorded in pod.status.resourceClaimStatuses.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and the pod\nbelongs to a PodGroup that defines a PodGroupResourceClaim with the same\nName and ResourceClaimTemplateName, this PodResourceClaim resolves to the\nResourceClaim generated for the PodGroup. All pods in the group that\ndefine an equivalent PodResourceClaim matching the\nPodGroupResourceClaim's Name and ResourceClaimTemplateName share the same\ngenerated ResourceClaim. ResourceClaims generated for a PodGroup are\nowned by the PodGroup and their lifecycles are tied to the PodGroup\ninstead of any individual pod.\n\nThis field is immutable and no changes will be made to the\ncorresponding ResourceClaim by the control plane after creating the\nResourceClaim.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "resources": { + "description": "Resources is the total amount of CPU and Memory resources required by all\ncontainers in the pod. It supports specifying Requests and Limits for\n\"cpu\", \"memory\" and \"hugepages-\" resource names only. ResourceClaims are not supported.\n\nThis field enables fine-grained control over resource allocation for the\nentire pod, allowing resource sharing among containers in a pod.\n\nThis is an alpha field and requires enabling the PodLevelResources feature\ngate.", + "properties": { + "claims": { + "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + "items": { + "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", + "properties": { + "name": { + "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + "type": "string" + }, + "request": { + "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "restartPolicy": { + "description": "Restart policy for all containers within the pod.\nOne of Always, OnFailure, Never. In some contexts, only a subset of those values may be permitted.\nDefault to Always.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy", + "type": "string" + }, + "runtimeClassName": { + "description": "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used\nto run this pod. If no RuntimeClass resource matches the named class, the pod will not be run.\nIf unset or empty, the \"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class", + "type": "string" + }, + "schedulerName": { + "description": "If specified, the pod will be dispatched by specified scheduler.\nIf not specified, the pod will be dispatched by default scheduler.", + "type": "string" + }, + "schedulingGates": { + "description": "SchedulingGates is an opaque list of values that if specified will block scheduling the pod.\nIf schedulingGates is not empty, the pod will stay in the SchedulingGated state and the\nscheduler will not attempt to schedule the pod.\n\nSchedulingGates can only be set at pod creation time, and be removed only afterwards.", + "items": { + "description": "PodSchedulingGate is associated to a Pod to guard its scheduling.", + "properties": { + "name": { + "description": "Name of the scheduling gate.\nEach scheduling gate must have a unique name field.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "schedulingGroup": { + "description": "SchedulingGroup provides a reference to the immediate scheduling runtime\ngrouping object that this Pod belongs to.\nThis field is used by the scheduler to identify the group and apply the\ncorrect group scheduling policies. The association with a group also\nimpacts other lifecycle aspects of a Pod that are relevant in a wider context\nof scheduling like preemption, resource attachment, etc. If not specified,\nthe Pod is treated as a single unit in all of these aspects.\nThe group object referenced by this field may not exist at the time the\nPod is created.\nThis field is immutable, but a group object with the same name may be\nrecreated with different policies. Doing this during pod scheduling\nmay result in the placement not conforming to the expected policies.", + "properties": { + "podGroupName": { + "description": "PodGroupName specifies the name of the standalone PodGroup object\nthat represents the runtime instance of this group.\nMust be a DNS subdomain.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "securityContext": { + "description": "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.", + "properties": { + "appArmorProfile": { + "description": "appArmorProfile is the AppArmor options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "fsGroup": { + "description": "A special supplemental group that applies to all containers in a pod.\nSome volume types allow the Kubelet to change the ownership of that volume\nto be owned by the pod:\n\n1. The owning GID will be the FSGroup\n2. The setgid bit is set (new files created in the volume will be owned by FSGroup)\n3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "fsGroupChangePolicy": { + "description": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume\nbefore being exposed inside Pod. This field will only apply to\nvolume types which support fsGroup based ownership(and permissions).\nIt will have no effect on ephemeral volume types such as: secret, configmaps\nand emptydir.\nValid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "runAsGroup": { + "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "runAsNonRoot": { + "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "boolean" + }, + "runAsUser": { + "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "seLinuxChangePolicy": { + "description": "seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.\nIt has no effect on nodes that do not support SELinux or to volumes does not support SELinux.\nValid values are \"MountOption\" and \"Recursive\".\n\n\"Recursive\" means relabeling of all files on all Pod volumes by the container runtime.\nThis may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.\n\n\"MountOption\" mounts all eligible Pod volumes with `-o context` mount option.\nThis requires all Pods that share the same volume to use the same SELinux label.\nIt is not possible to share the same volume among privileged and unprivileged Pods.\nEligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes\nwhose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their\nCSIDriver instance. Other volumes are always re-labelled recursively.\n\nIf not specified, \"MountOption\" is used.\n\nThis field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.\n\nAll Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "seLinuxOptions": { + "description": "The SELinux context to be applied to all containers.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in SecurityContext. If set in\nboth SecurityContext and PodSecurityContext, the value specified in SecurityContext\ntakes precedence for that container.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "level": { + "description": "Level is SELinux level label that applies to the container.", + "type": "string" + }, + "role": { + "description": "Role is a SELinux role label that applies to the container.", + "type": "string" + }, + "type": { + "description": "Type is a SELinux type label that applies to the container.", + "type": "string" + }, + "user": { + "description": "User is a SELinux user label that applies to the container.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "seccompProfile": { + "description": "The seccomp options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + "type": "string" + }, + "type": { + "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "supplementalGroups": { + "description": "A list of groups applied to the first process run in each container, in\naddition to the container's primary GID and fsGroup (if specified). If\nthe SupplementalGroupsPolicy feature is enabled, the\nsupplementalGroupsPolicy field determines whether these are in addition\nto or instead of any group memberships defined in the container image.\nIf unspecified, no additional groups are added, though group memberships\ndefined in the container image may still be used, depending on the\nsupplementalGroupsPolicy field.\nNote that this field cannot be set when spec.os.name is windows.", + "items": { + "format": "int64", + "type": "integer" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "supplementalGroupsPolicy": { + "description": "Defines how supplemental groups of the first container processes are calculated.\nValid values are \"Merge\" and \"Strict\". If not specified, \"Merge\" is used.\n(Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled\nand the container runtime must implement support for this feature.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "sysctls": { + "description": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", + "items": { + "description": "Sysctl defines a kernel parameter to be set", + "properties": { + "name": { + "description": "Name of a property to set", + "type": "string" + }, + "value": { + "description": "Value of a property to set", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "windowsOptions": { + "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options within a container's SecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + "properties": { + "gmsaCredentialSpec": { + "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + "type": "string" + }, + "gmsaCredentialSpecName": { + "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + "type": "string" + }, + "hostProcess": { + "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + "type": "boolean" + }, + "runAsUserName": { + "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "serviceAccount": { + "description": "DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.\nDeprecated: Use serviceAccountName instead.", + "type": "string" + }, + "serviceAccountName": { + "description": "ServiceAccountName is the name of the ServiceAccount to use to run this pod.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/", + "type": "string" + }, + "setHostnameAsFQDN": { + "description": "If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default).\nIn Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname).\nIn Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters to FQDN.\nIf a pod does not have FQDN, this has no effect.\nDefault to false.", + "type": "boolean" + }, + "shareProcessNamespace": { + "description": "Share a single process namespace between all of the containers in a pod.\nWhen this is set containers will be able to view and signal processes from other containers\nin the same pod, and the first process in each container will not be assigned PID 1.\nHostPID and ShareProcessNamespace cannot both be set.\nOptional: Default to false.", + "type": "boolean" + }, + "subdomain": { + "description": "If specified, the fully qualified Pod hostname will be \"...svc.\".\nIf not specified, the pod will not have a domainname at all.", + "type": "string" + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nIf this value is nil, the default grace period will be used instead.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nDefaults to 30 seconds.", + "format": "int64", + "type": "integer" + }, + "tolerations": { + "description": "If specified, the pod's tolerations.", + "items": { + "description": "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + "properties": { + "effect": { + "description": "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + "type": "string" + }, + "key": { + "description": "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + "type": "string" + }, + "operator": { + "description": "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + "type": "string" + }, + "tolerationSeconds": { + "description": "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologySpreadConstraints": { + "description": "TopologySpreadConstraints describes how a group of pods ought to spread across topology\ndomains. Scheduler will schedule pods in a way which abides by the constraints.\nAll topologySpreadConstraints are ANDed.", + "items": { + "description": "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", + "properties": { + "labelSelector": { + "description": "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "maxSkew": { + "description": "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", + "format": "int32", + "type": "integer" + }, + "minDomains": { + "description": "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", + "format": "int32", + "type": "integer" + }, + "nodeAffinityPolicy": { + "description": "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", + "type": "string" + }, + "nodeTaintsPolicy": { + "description": "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", + "type": "string" + }, + "topologyKey": { + "description": "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", + "type": "string" + }, + "whenUnsatisfiable": { + "description": "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", + "type": "string" + } + }, + "required": [ + "maxSkew", + "topologyKey", + "whenUnsatisfiable" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "topologyKey", + "whenUnsatisfiable" + ], + "x-kubernetes-list-type": "map" + }, + "volumes": { + "description": "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes", + "items": { + "description": "Volume represents a named volume in a pod that may be accessed by any container in the pod.", + "properties": { + "awsElasticBlockStore": { + "description": "awsElasticBlockStore represents an AWS Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nDeprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree\nawsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", + "properties": { + "fsType": { + "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", + "type": "string" + }, + "partition": { + "description": "partition is the partition in the volume that you want to mount.\nIf omitted, the default is to mount by volume name.\nExamples: For volume /dev/sda1, you specify the partition as \"1\".\nSimilarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).", + "format": "int32", + "type": "integer" + }, + "readOnly": { + "description": "readOnly value true will force the readOnly setting in VolumeMounts.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", + "type": "boolean" + }, + "volumeID": { + "description": "volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume).\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", + "type": "string" + } + }, + "required": [ + "volumeID" + ], + "type": "object", + "additionalProperties": false + }, + "azureDisk": { + "description": "azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.\nDeprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type\nare redirected to the disk.csi.azure.com CSI driver.", + "properties": { + "cachingMode": { + "description": "cachingMode is the Host Caching mode: None, Read Only, Read Write.", + "type": "string" + }, + "diskName": { + "description": "diskName is the Name of the data disk in the blob storage", + "type": "string" + }, + "diskURI": { + "description": "diskURI is the URI of data disk in the blob storage", + "type": "string" + }, + "fsType": { + "default": "ext4", + "description": "fsType is Filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "kind": { + "description": "kind expected values are Shared: multiple blob disks per storage account Dedicated: single blob disk per storage account Managed: azure managed data disk (only in managed availability set). defaults to shared", + "type": "string" + }, + "readOnly": { + "default": false, + "description": "readOnly Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + } + }, + "required": [ + "diskName", + "diskURI" + ], + "type": "object", + "additionalProperties": false + }, + "azureFile": { + "description": "azureFile represents an Azure File Service mount on the host and bind mount to the pod.\nDeprecated: AzureFile is deprecated. All operations for the in-tree azureFile type\nare redirected to the file.csi.azure.com CSI driver.", + "properties": { + "readOnly": { + "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "secretName": { + "description": "secretName is the name of secret that contains Azure Storage Account Name and Key", + "type": "string" + }, + "shareName": { + "description": "shareName is the azure share Name", + "type": "string" + } + }, + "required": [ + "secretName", + "shareName" + ], + "type": "object", + "additionalProperties": false + }, + "cephfs": { + "description": "cephFS represents a Ceph FS mount on the host that shares a pod's lifetime.\nDeprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported.", + "properties": { + "monitors": { + "description": "monitors is Required: Monitors is a collection of Ceph monitors\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "path is Optional: Used as the mounted root, rather than the full Ceph tree, default is /", + "type": "string" + }, + "readOnly": { + "description": "readOnly is Optional: Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "type": "boolean" + }, + "secretFile": { + "description": "secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "type": "string" + }, + "secretRef": { + "description": "secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty.\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "user": { + "description": "user is optional: User is the rados user name, default is admin\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "type": "string" + } + }, + "required": [ + "monitors" + ], + "type": "object", + "additionalProperties": false + }, + "cinder": { + "description": "cinder represents a cinder volume attached and mounted on kubelets host machine.\nDeprecated: Cinder is deprecated. All operations for the in-tree cinder type\nare redirected to the cinder.csi.openstack.org CSI driver.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", + "properties": { + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", + "type": "string" + }, + "readOnly": { + "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef is optional: points to a secret object containing parameters used to connect\nto OpenStack.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "volumeID": { + "description": "volumeID used to identify the volume in cinder.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", + "type": "string" + } + }, + "required": [ + "volumeID" + ], + "type": "object", + "additionalProperties": false + }, + "configMap": { + "description": "configMap represents a configMap that should populate this volume", + "properties": { + "defaultMode": { + "description": "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "defaultUser": { + "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "items": { + "description": "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + "items": { + "description": "Maps a string key to a path within a volume.", + "properties": { + "key": { + "description": "key is the key to project.", + "type": "string" + }, + "mode": { + "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "key", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "optional specify whether the ConfigMap or its keys must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "csi": { + "description": "csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.", + "properties": { + "driver": { + "description": "driver is the name of the CSI driver that handles this volume.\nConsult with your admin for the correct name as registered in the cluster.", + "type": "string" + }, + "fsType": { + "description": "fsType to mount. Ex. \"ext4\", \"xfs\", \"ntfs\".\nIf not provided, the empty value is passed to the associated CSI driver\nwhich will determine the default filesystem to apply.", + "type": "string" + }, + "nodePublishSecretRef": { + "description": "nodePublishSecretRef is a reference to the secret object containing\nsensitive information to pass to the CSI driver to complete the CSI\nNodePublishVolume and NodeUnpublishVolume calls.\nThis field is optional, and may be empty if no secret is required. If the\nsecret object contains more than one secret, all secret references are passed.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "readOnly": { + "description": "readOnly specifies a read-only configuration for the volume.\nDefaults to false (read/write).", + "type": "boolean" + }, + "volumeAttributes": { + "additionalProperties": { + "type": "string" + }, + "description": "volumeAttributes stores driver-specific properties that are passed to the CSI\ndriver. Consult your driver's documentation for supported values.", + "type": "object" + } + }, + "required": [ + "driver" + ], + "type": "object", + "additionalProperties": false + }, + "downwardAPI": { + "description": "downwardAPI represents downward API about the pod that should populate this volume", + "properties": { + "defaultMode": { + "description": "Optional: mode bits to use on created files by default. Must be a\nOptional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "defaultUser": { + "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "items": { + "description": "Items is a list of downward API volume file", + "items": { + "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field", + "properties": { + "fieldRef": { + "description": "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "mode": { + "description": "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + "type": "string" + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "emptyDir": { + "description": "emptyDir represents a temporary directory that shares a pod's lifetime.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + "properties": { + "medium": { + "description": "medium represents what type of storage medium should back this directory.\nThe default is \"\" which means to use the node's default medium.\nMust be an empty string (default) or Memory.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + "type": "string" + }, + "mode": { + "description": "mode specifies the permission bits for the emptyDir directory, in numeric\nnotation (e.g., 0755, 01777). Must be a value between 0000 and 01777.\nIf not specified, defaults to 0777.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup. If fsGroup is specified, the fsGroup permissions\nwill override the mode specified here.\nThis field has no effect on Windows.\nThis field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.", + "format": "int32", + "type": "integer" + }, + "sizeLimit": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "sizeLimit is the total amount of local storage required for this EmptyDir volume.\nThe size limit is also applicable for memory medium.\nThe maximum usage on memory medium EmptyDir would be the minimum value between\nthe SizeLimit specified here and the sum of memory limits of all containers in a pod.\nThe default is nil which means that the limit is undefined.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "type": "object", + "additionalProperties": false + }, + "ephemeral": { + "description": "ephemeral represents a volume that is handled by a cluster storage driver.\nThe volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,\nand deleted when the pod is removed.\n\nUse this if:\na) the volume is only needed while the pod runs,\nb) features of normal volumes like restoring from snapshot or capacity\n tracking are needed,\nc) the storage driver is specified through a storage class, and\nd) the storage driver supports dynamic volume provisioning through\n a PersistentVolumeClaim (see EphemeralVolumeSource for more\n information on the connection between this volume type\n and PersistentVolumeClaim).\n\nUse PersistentVolumeClaim or one of the vendor-specific\nAPIs for volumes that persist for longer than the lifecycle\nof an individual pod.\n\nUse CSI for light-weight local ephemeral volumes if the CSI driver is meant to\nbe used that way - see the documentation of the driver for\nmore information.\n\nA pod can use both types of ephemeral volumes and\npersistent volumes at the same time.", + "properties": { + "volumeClaimTemplate": { + "description": "Will be used to create a stand-alone PVC to provision the volume.\nThe pod in which this EphemeralVolumeSource is embedded will be the\nowner of the PVC, i.e. the PVC will be deleted together with the\npod. The name of the PVC will be `-` where\n`` is the name from the `PodSpec.Volumes` array\nentry. Pod validation will reject the pod if the concatenated name\nis not valid for a PVC (for example, too long).\n\nAn existing PVC with that name that is not owned by the pod\nwill *not* be used for the pod to avoid using an unrelated\nvolume by mistake. Starting the pod is then blocked until\nthe unrelated PVC is removed. If such a pre-created PVC is\nmeant to be used by the pod, the PVC has to updated with an\nowner reference to the pod once the pod exists. Normally\nthis should not be necessary, but it may be useful when\nmanually reconstructing a broken cluster.\n\nThis field is read-only and no changes will be made by Kubernetes\nto the PVC after it has been created.\n\nRequired, must not be nil.", + "properties": { + "metadata": { + "description": "May contain labels and annotations that will be copied into the PVC\nwhen creating it. No other fields are allowed and will be rejected during\nvalidation.", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "finalizers": { + "items": { + "type": "string" + }, + "type": "array" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "spec": { + "description": "The specification for the PersistentVolumeClaim. The entire content is\ncopied unchanged into the PVC that gets created from this\ntemplate. The same fields as in a PersistentVolumeClaim\nare also valid here.", + "properties": { + "accessModes": { + "description": "accessModes contains the desired access modes the volume should have.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "dataSource": { + "description": "dataSource field can be used to specify either:\n* An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)\n* An existing PVC (PersistentVolumeClaim)\nIf the provisioner or an external controller can support the specified data source,\nit will create a new volume based on the contents of the specified data source.\ndataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be\ncopied to dataSource when dataSourceRef.namespace is not specified.\nIf the namespace is specified, then dataSourceRef will not be copied to dataSource.", + "properties": { + "apiGroup": { + "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", + "type": "string" + }, + "kind": { + "description": "Kind is the type of resource being referenced", + "type": "string" + }, + "name": { + "description": "Name is the name of resource being referenced", + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "dataSourceRef": { + "description": "dataSourceRef specifies the object from which to populate the volume with data, if a non-empty\nvolume is desired. This may be any object from a non-empty API group (non\ncore object) or a PersistentVolumeClaim object.\nWhen this field is specified, volume binding will only succeed if the type of\nthe specified object matches some installed volume populator or dynamic\nprovisioner.\nThis field will replace the functionality of the dataSource field and as such\nif both fields are non-empty, they must have the same value. For backwards\ncompatibility, when namespace isn't specified in dataSourceRef,\nboth fields (dataSource and dataSourceRef) will be set to the same\nvalue automatically if one of them is empty and the other is non-empty.\nWhen namespace is specified in dataSourceRef,\ndataSource isn't set to the same value and must be empty.\nThere are three important differences between dataSource and dataSourceRef:\n* While dataSource only allows two specific types of objects, dataSourceRef\n allows any non-core object, as well as PersistentVolumeClaim objects.\n* While dataSource ignores disallowed values (dropping them), dataSourceRef\n preserves all values, and generates an error if a disallowed value is\n specified.\n* While dataSource only allows local objects, dataSourceRef allows objects\n in any namespaces.\n(Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", + "properties": { + "apiGroup": { + "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", + "type": "string" + }, + "kind": { + "description": "Kind is the type of resource being referenced", + "type": "string" + }, + "name": { + "description": "Name is the name of resource being referenced", + "type": "string" + }, + "namespace": { + "description": "Namespace is the namespace of resource being referenced\nNote that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n(Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "resources": { + "description": "resources represents the minimum resources the volume should have.\nUsers are allowed to specify resource requirements\nthat are lower than previous value but must still be higher than capacity recorded in the\nstatus field of the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources", + "properties": { + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "selector": { + "description": "selector is a label query over volumes to consider for binding.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "storageClassName": { + "description": "storageClassName is the name of the StorageClass required by the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1", + "type": "string" + }, + "volumeAttributesClassName": { + "description": "volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.\nIf specified, the CSI driver will create or update the volume with the attributes defined\nin the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,\nit can be changed after the claim is created. An empty string or nil value indicates that no\nVolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,\nthis field can be reset to its previous value (including nil) to cancel the modification.\nIf the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be\nset to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource\nexists.\nMore info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/", + "type": "string" + }, + "volumeMode": { + "description": "volumeMode defines what type of volume is required by the claim.\nValue of Filesystem is implied when not included in claim spec.", + "type": "string" + }, + "volumeName": { + "description": "volumeName is the binding reference to the PersistentVolume backing this claim.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "spec" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "fc": { + "description": "fc represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.", + "properties": { + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "lun": { + "description": "lun is Optional: FC target lun number", + "format": "int32", + "type": "integer" + }, + "readOnly": { + "description": "readOnly is Optional: Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "targetWWNs": { + "description": "targetWWNs is Optional: FC target worldwide names (WWNs)", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "wwids": { + "description": "wwids Optional: FC volume world wide identifiers (wwids)\nEither wwids or combination of targetWWNs and lun must be set, but not both simultaneously.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "flexVolume": { + "description": "flexVolume represents a generic volume resource that is\nprovisioned/attached using an exec based plugin.\nDeprecated: FlexVolume is deprecated. Consider using a CSIDriver instead.", + "properties": { + "driver": { + "description": "driver is the name of the driver to use for this volume.", + "type": "string" + }, + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". The default filesystem depends on FlexVolume script.", + "type": "string" + }, + "options": { + "additionalProperties": { + "type": "string" + }, + "description": "options is Optional: this field holds extra command options if any.", + "type": "object" + }, + "readOnly": { + "description": "readOnly is Optional: defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef is Optional: secretRef is reference to the secret object containing\nsensitive information to pass to the plugin scripts. This may be\nempty if no secret object is specified. If the secret object\ncontains more than one secret, all secrets are passed to the plugin\nscripts.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "required": [ + "driver" + ], + "type": "object", + "additionalProperties": false + }, + "flocker": { + "description": "flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running.\nDeprecated: Flocker is deprecated and the in-tree flocker type is no longer supported.", + "properties": { + "datasetName": { + "description": "datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker\nshould be considered as deprecated", + "type": "string" + }, + "datasetUUID": { + "description": "datasetUUID is the UUID of the dataset. This is unique identifier of a Flocker dataset", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "gcePersistentDisk": { + "description": "gcePersistentDisk represents a GCE Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nDeprecated: GCEPersistentDisk is deprecated. All operations for the in-tree\ngcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "properties": { + "fsType": { + "description": "fsType is filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "type": "string" + }, + "partition": { + "description": "partition is the partition in the volume that you want to mount.\nIf omitted, the default is to mount by volume name.\nExamples: For volume /dev/sda1, you specify the partition as \"1\".\nSimilarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "format": "int32", + "type": "integer" + }, + "pdName": { + "description": "pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "type": "boolean" + } + }, + "required": [ + "pdName" + ], + "type": "object", + "additionalProperties": false + }, + "gitRepo": { + "description": "gitRepo represents a git repository at a particular revision.\nDeprecated: GitRepo is deprecated. To provision a container with a git repo, mount an\nEmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir\ninto the Pod's container.", + "properties": { + "directory": { + "description": "directory is the target directory name.\nMust not contain or start with '..'. If '.' is supplied, the volume directory will be the\ngit repository. Otherwise, if specified, the volume will contain the git repository in\nthe subdirectory with the given name.", + "type": "string" + }, + "repository": { + "description": "repository is the URL", + "type": "string" + }, + "revision": { + "description": "revision is the commit hash for the specified revision.", + "type": "string" + } + }, + "required": [ + "repository" + ], + "type": "object", + "additionalProperties": false + }, + "glusterfs": { + "description": "glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.\nDeprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.", + "properties": { + "endpoints": { + "description": "endpoints is the endpoint name that details Glusterfs topology.", + "type": "string" + }, + "path": { + "description": "path is the Glusterfs volume path.\nMore info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the Glusterfs volume to be mounted with read-only permissions.\nDefaults to false.\nMore info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod", + "type": "boolean" + } + }, + "required": [ + "endpoints", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "hostPath": { + "description": "hostPath represents a pre-existing file or directory on the host\nmachine that is directly exposed to the container. This is generally\nused for system agents or other privileged things that are allowed\nto see the host machine. Most containers will NOT need this.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", + "properties": { + "path": { + "description": "path of the directory on the host.\nIf the path is a symlink, it will follow the link to the real path.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", + "type": "string" + }, + "type": { + "description": "type for HostPath Volume\nDefaults to \"\"\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", + "type": "string" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + }, + "image": { + "description": "image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.\nThe volume is resolved at pod startup depending on which PullPolicy value is provided:\n\n- Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\n- Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\n- IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\n\nThe volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.\nA failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.\nThe types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.\nThe OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.\nThe volume will be mounted read-only (ro).\nSub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.\nThe field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.", + "properties": { + "pullPolicy": { + "description": "Policy for pulling OCI objects. Possible values are:\nAlways: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\nNever: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\nIfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.", + "type": "string" + }, + "reference": { + "description": "Required: Image or artifact reference to be used.\nBehaves in the same way as pod.spec.containers[*].image.\nPull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "iscsi": { + "description": "iscsi represents an ISCSI Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi", + "properties": { + "chapAuthDiscovery": { + "description": "chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication", + "type": "boolean" + }, + "chapAuthSession": { + "description": "chapAuthSession defines whether support iSCSI Session CHAP authentication", + "type": "boolean" + }, + "fsType": { + "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi", + "type": "string" + }, + "initiatorName": { + "description": "initiatorName is the custom iSCSI Initiator Name.\nIf initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface\n: will be created for the connection.", + "type": "string" + }, + "iqn": { + "description": "iqn is the target iSCSI Qualified Name.", + "type": "string" + }, + "iscsiInterface": { + "default": "default", + "description": "iscsiInterface is the interface Name that uses an iSCSI transport.\nDefaults to 'default' (tcp).", + "type": "string" + }, + "lun": { + "description": "lun represents iSCSI Target Lun number.", + "format": "int32", + "type": "integer" + }, + "portals": { + "description": "portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port\nis other than default (typically TCP ports 860 and 3260).", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "readOnly": { + "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef is the CHAP Secret for iSCSI target and initiator authentication", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "targetPortal": { + "description": "targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port\nis other than default (typically TCP ports 860 and 3260).", + "type": "string" + } + }, + "required": [ + "iqn", + "lun", + "targetPortal" + ], + "type": "object", + "additionalProperties": false + }, + "name": { + "description": "name of the volume.\nMust be a DNS_LABEL and unique within the pod.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "nfs": { + "description": "nfs represents an NFS mount on the host that shares a pod's lifetime\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", + "properties": { + "path": { + "description": "path that is exported by the NFS server.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the NFS export to be mounted with read-only permissions.\nDefaults to false.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", + "type": "boolean" + }, + "server": { + "description": "server is the hostname or IP address of the NFS server.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", + "type": "string" + } + }, + "required": [ + "path", + "server" + ], + "type": "object", + "additionalProperties": false + }, + "persistentVolumeClaim": { + "description": "persistentVolumeClaimVolumeSource represents a reference to a\nPersistentVolumeClaim in the same namespace.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + "properties": { + "claimName": { + "description": "claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + "type": "string" + }, + "readOnly": { + "description": "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.", + "type": "boolean" + } + }, + "required": [ + "claimName" + ], + "type": "object", + "additionalProperties": false + }, + "photonPersistentDisk": { + "description": "photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine.\nDeprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported.", + "properties": { + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "pdID": { + "description": "pdID is the ID that identifies Photon Controller persistent disk", + "type": "string" + } + }, + "required": [ + "pdID" + ], + "type": "object", + "additionalProperties": false + }, + "portworxVolume": { + "description": "portworxVolume represents a portworx volume attached and mounted on kubelets host machine.\nDeprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type\nare redirected to the pxd.portworx.com CSI driver.", + "properties": { + "fsType": { + "description": "fSType represents the filesystem type to mount\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "readOnly": { + "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "volumeID": { + "description": "volumeID uniquely identifies a Portworx volume", + "type": "string" + } + }, + "required": [ + "volumeID" + ], + "type": "object", + "additionalProperties": false + }, + "projected": { + "description": "projected items for all in one resources secrets, configmaps, and downward API", + "properties": { + "defaultMode": { + "description": "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "defaultUser": { + "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "sources": { + "description": "sources is the list of volume projections. Each entry in this list\nhandles one source.", + "items": { + "description": "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + "properties": { + "clusterTrustBundle": { + "description": "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field\nof ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the\ncombination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written\ninto the pod filesystem. Esoteric PEM features such as inter-block\ncomments and block headers are stripped. Certificates are deduplicated.\nThe ordering of certificates within the file is arbitrary, and Kubelet\nmay change the order over time.", + "properties": { + "labelSelector": { + "description": "Select all ClusterTrustBundles that match this label selector. Only has\neffect if signerName is set. Mutually-exclusive with name. If unset,\ninterpreted as \"match nothing\". If set but empty, interpreted as \"match\neverything\".", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "name": { + "description": "Select a single ClusterTrustBundle by object name. Mutually-exclusive\nwith signerName and labelSelector.", + "type": "string" + }, + "optional": { + "description": "If true, don't block pod startup if the referenced ClusterTrustBundle(s)\naren't available. If using name, then the named ClusterTrustBundle is\nallowed not to exist. If using signerName, then the combination of\nsignerName and labelSelector is allowed to match zero\nClusterTrustBundles.", + "type": "boolean" + }, + "path": { + "description": "Relative path from the volume root to write the bundle.", + "type": "string" + }, + "signerName": { + "description": "Select all ClusterTrustBundles that match this signer name.\nMutually-exclusive with name. The contents of all selected\nClusterTrustBundles will be unified and deduplicated.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + }, + "configMap": { + "description": "configMap information about the configMap data to project", + "properties": { + "items": { + "description": "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + "items": { + "description": "Maps a string key to a path within a volume.", + "properties": { + "key": { + "description": "key is the key to project.", + "type": "string" + }, + "mode": { + "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "key", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "optional specify whether the ConfigMap or its keys must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "downwardAPI": { + "description": "downwardAPI information about the downwardAPI data to project", + "properties": { + "items": { + "description": "Items is a list of DownwardAPIVolume file", + "items": { + "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field", + "properties": { + "fieldRef": { + "description": "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "mode": { + "description": "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + "type": "string" + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "podCertificate": { + "description": "Projects an auto-rotating credential bundle (private key and certificate\nchain) that the pod can use either as a TLS client or server.\n\nKubelet generates a private key and uses it to send a\nPodCertificateRequest to the named signer. Once the signer approves the\nrequest and issues a certificate chain, Kubelet writes the key and\ncertificate chain to the pod filesystem. The pod does not start until\ncertificates have been issued for each podCertificate projected volume\nsource in its spec.\n\nKubelet will begin trying to rotate the certificate at the time indicated\nby the signer using the PodCertificateRequest.Status.BeginRefreshAt\ntimestamp.\n\nKubelet can write a single file, indicated by the credentialBundlePath\nfield, or separate files, indicated by the keyPath and\ncertificateChainPath fields.\n\nThe credential bundle is a single file in PEM format. The first PEM\nentry is the private key (in PKCS#8 format), and the remaining PEM\nentries are the certificate chain issued by the signer (typically,\nsigners will return their certificate chain in leaf-to-root order).\n\nPrefer using the credential bundle format, since your application code\ncan read it atomically. If you use keyPath and certificateChainPath,\nyour application must make two separate file reads. If these coincide\nwith a certificate rotation, it is possible that the private key and leaf\ncertificate you read may not correspond to each other. Your application\nwill need to check for this condition, and re-read until they are\nconsistent.\n\nThe named signer controls chooses the format of the certificate it\nissues; consult the signer implementation's documentation to learn how to\nuse the certificates it issues.", + "properties": { + "certificateChainPath": { + "description": "Write the certificate chain at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + "type": "string" + }, + "credentialBundlePath": { + "description": "Write the credential bundle at this path in the projected volume.\n\nThe credential bundle is a single file that contains multiple PEM blocks.\nThe first PEM block is a PRIVATE KEY block, containing a PKCS#8 private\nkey.\n\nThe remaining blocks are CERTIFICATE blocks, containing the issued\ncertificate chain from the signer (leaf and any intermediates).\n\nUsing credentialBundlePath lets your Pod's application code make a single\natomic read that retrieves a consistent key and certificate chain. If you\nproject them to separate files, your application code will need to\nadditionally check that the leaf certificate was issued to the key.", + "type": "string" + }, + "keyPath": { + "description": "Write the key at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + "type": "string" + }, + "keyType": { + "description": "The type of keypair Kubelet will generate for the pod.\n\nValid values are \"RSA3072\", \"RSA4096\", \"ECDSAP256\", \"ECDSAP384\",\n\"ECDSAP521\", and \"ED25519\".", + "type": "string" + }, + "maxExpirationSeconds": { + "description": "maxExpirationSeconds is the maximum lifetime permitted for the\ncertificate.\n\nKubelet copies this value verbatim into the PodCertificateRequests it\ngenerates for this projection.\n\nIf omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver\nwill reject values shorter than 3600 (1 hour). The maximum allowable\nvalue is 7862400 (91 days).\n\nThe signer implementation is then free to issue a certificate with any\nlifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600\nseconds (1 hour). This constraint is enforced by kube-apiserver.\n`kubernetes.io` signers will never issue certificates with a lifetime\nlonger than 24 hours.", + "format": "int32", + "type": "integer" + }, + "signerName": { + "description": "Kubelet's generated CSRs will be addressed to this signer.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "userAnnotations": { + "additionalProperties": { + "type": "string" + }, + "description": "userAnnotations allow pod authors to pass additional information to\nthe signer implementation. Kubernetes does not restrict or validate this\nmetadata in any way.\n\nThese values are copied verbatim into the `spec.unverifiedUserAnnotations` field of\nthe PodCertificateRequest objects that Kubelet creates.\n\nEntries are subject to the same validation as object metadata annotations,\nwith the addition that all keys must be domain-prefixed. No restrictions\nare placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support. Signers should\ndeny requests that contain keys they do not recognize.", + "type": "object" + } + }, + "required": [ + "keyType", + "signerName" + ], + "type": "object", + "additionalProperties": false + }, + "secret": { + "description": "secret information about the secret data to project", + "properties": { + "items": { + "description": "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + "items": { + "description": "Maps a string key to a path within a volume.", + "properties": { + "key": { + "description": "key is the key to project.", + "type": "string" + }, + "mode": { + "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "key", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "optional field specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "serviceAccountToken": { + "description": "serviceAccountToken is information about the serviceAccountToken data to project", + "properties": { + "audience": { + "description": "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + "type": "string" + }, + "expirationSeconds": { + "description": "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + "format": "int64", + "type": "integer" + }, + "path": { + "description": "path is the path relative to the mount point of the file to project the\ntoken into.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "quobyte": { + "description": "quobyte represents a Quobyte mount on the host that shares a pod's lifetime.\nDeprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported.", + "properties": { + "group": { + "description": "group to map volume access to\nDefault is no group", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the Quobyte volume to be mounted with read-only permissions.\nDefaults to false.", + "type": "boolean" + }, + "registry": { + "description": "registry represents a single or multiple Quobyte Registry services\nspecified as a string as host:port pair (multiple entries are separated with commas)\nwhich acts as the central registry for volumes", + "type": "string" + }, + "tenant": { + "description": "tenant owning the given Quobyte volume in the Backend\nUsed with dynamically provisioned Quobyte volumes, value is set by the plugin", + "type": "string" + }, + "user": { + "description": "user to map volume access to\nDefaults to serivceaccount user", + "type": "string" + }, + "volume": { + "description": "volume is a string that references an already created Quobyte volume by name.", + "type": "string" + } + }, + "required": [ + "registry", + "volume" + ], + "type": "object", + "additionalProperties": false + }, + "rbd": { + "description": "rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.\nDeprecated: RBD is deprecated and the in-tree rbd type is no longer supported.", + "properties": { + "fsType": { + "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#rbd", + "type": "string" + }, + "image": { + "description": "image is the rados image name.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "string" + }, + "keyring": { + "default": "/etc/ceph/keyring", + "description": "keyring is the path to key ring for RBDUser.\nDefault is /etc/ceph/keyring.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "string" + }, + "monitors": { + "description": "monitors is a collection of Ceph monitors.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "pool": { + "default": "rbd", + "description": "pool is the rados pool name.\nDefault is rbd.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef is name of the authentication secret for RBDUser. If provided\noverrides keyring.\nDefault is nil.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "user": { + "default": "admin", + "description": "user is the rados user name.\nDefault is admin.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "string" + } + }, + "required": [ + "image", + "monitors" + ], + "type": "object", + "additionalProperties": false + }, + "scaleIO": { + "description": "scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.\nDeprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported.", + "properties": { + "fsType": { + "default": "xfs", + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\".\nDefault is \"xfs\".", + "type": "string" + }, + "gateway": { + "description": "gateway is the host address of the ScaleIO API Gateway.", + "type": "string" + }, + "protectionDomain": { + "description": "protectionDomain is the name of the ScaleIO Protection Domain for the configured storage.", + "type": "string" + }, + "readOnly": { + "description": "readOnly Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef references to the secret for ScaleIO user and other\nsensitive information. If this is not provided, Login operation will fail.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "sslEnabled": { + "description": "sslEnabled Flag enable/disable SSL communication with Gateway, default false", + "type": "boolean" + }, + "storageMode": { + "default": "ThinProvisioned", + "description": "storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.\nDefault is ThinProvisioned.", + "type": "string" + }, + "storagePool": { + "description": "storagePool is the ScaleIO Storage Pool associated with the protection domain.", + "type": "string" + }, + "system": { + "description": "system is the name of the storage system as configured in ScaleIO.", + "type": "string" + }, + "volumeName": { + "description": "volumeName is the name of a volume already created in the ScaleIO system\nthat is associated with this volume source.", + "type": "string" + } + }, + "required": [ + "gateway", + "secretRef", + "system" + ], + "type": "object", + "additionalProperties": false + }, + "secret": { + "description": "secret represents a secret that should populate this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + "properties": { + "defaultMode": { + "description": "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "defaultUser": { + "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "items": { + "description": "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + "items": { + "description": "Maps a string key to a path within a volume.", + "properties": { + "key": { + "description": "key is the key to project.", + "type": "string" + }, + "mode": { + "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "key", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "optional": { + "description": "optional field specify whether the Secret or its keys must be defined", + "type": "boolean" + }, + "secretName": { + "description": "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "storageos": { + "description": "storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.\nDeprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported.", + "properties": { + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "readOnly": { + "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef specifies the secret to use for obtaining the StorageOS API\ncredentials. If not specified, default values will be attempted.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "volumeName": { + "description": "volumeName is the human-readable name of the StorageOS volume. Volume\nnames are only unique within a namespace.", + "type": "string" + }, + "volumeNamespace": { + "description": "volumeNamespace specifies the scope of the volume within StorageOS. If no\nnamespace is specified then the Pod's namespace will be used. This allows the\nKubernetes name scoping to be mirrored within StorageOS for tighter integration.\nSet VolumeName to any name to override the default behaviour.\nSet to \"default\" if you are not using namespaces within StorageOS.\nNamespaces that do not pre-exist within StorageOS will be created.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "vsphereVolume": { + "description": "vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine.\nDeprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type\nare redirected to the csi.vsphere.vmware.com CSI driver.", + "properties": { + "fsType": { + "description": "fsType is filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "storagePolicyID": { + "description": "storagePolicyID is the storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName.", + "type": "string" + }, + "storagePolicyName": { + "description": "storagePolicyName is the storage Policy Based Management (SPBM) profile name.", + "type": "string" + }, + "volumePath": { + "description": "volumePath is the path that identifies vSphere volume vmdk", + "type": "string" + } + }, + "required": [ + "volumePath" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + } + }, + "required": [ + "containers" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "maxGroupRestarts": { + "description": "maxGroupRestarts bounds how many times the controller can recreate a group\nunder RecreateGroupOnPodRestart or RecreateGroupAfterStart. Once exhausted,\nthe controller terminates the group, retains Pod API objects that can still\nreceive finalizers, and stops automatic group recreation. Setting\nleaderworkerset.sigs.k8s.io/recover=true on the retained leader Pod resets\nthat revision/group's budget and allows recovery. Changing this value does\nnot resume an exhausted group. It is opt-in: when unset (nil), group\nrecreation is unlimited.\nBudget exhaustion handling requires Kubernetes 1.27 or later because it\nrelies on deleted Pods reaching a terminal phase while finalizers retain\ntheir API objects.", + "format": "int32", + "minimum": 0, + "type": "integer" + }, + "persistentVolumeClaimRetentionPolicy": { + "description": "persistentVolumeClaimRetentionPolicy describes the policy used for PVCs created from\nthe VolumeClaimTemplates.", + "properties": { + "whenDeleted": { + "description": "WhenDeleted specifies what happens to PVCs created from StatefulSet\nVolumeClaimTemplates when the StatefulSet is deleted. The default policy\nof `Retain` causes PVCs to not be affected by StatefulSet deletion. The\n`Delete` policy causes those PVCs to be deleted.", + "type": "string" + }, + "whenScaled": { + "description": "WhenScaled specifies what happens to PVCs created from StatefulSet\nVolumeClaimTemplates when the StatefulSet is scaled down. The default\npolicy of `Retain` causes PVCs to not be affected by a scaledown. The\n`Delete` policy causes the associated PVCs for any excess pods above\nthe replica count to be deleted.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "restartPolicy": { + "default": "RecreateGroupOnPodRestart", + "description": "restartPolicy defines the restart policy when pod failures happen.\nThe former named Default policy is deprecated, will be removed in the future,\nreplace with None policy for the same behavior.", + "enum": [ + "Default", + "RecreateGroupOnPodRestart", + "RecreateGroupAfterStart", + "None" + ], + "type": "string" + }, + "size": { + "default": 1, + "description": "size is the number of pods to create. It is the total number of pods in each group.\nThe minimum is 1 which represent the leader. When set to 1, the leader\npod is created for each group as well as a 0-replica StatefulSet for the workers.\nDefault to 1.", + "format": "int32", + "type": "integer" + }, + "subGroupPolicy": { + "description": "subGroupPolicy describes the policy that will be applied when creating subgroups\nin each replica.", + "properties": { + "subGroupPolicyType": { + "default": "LeaderWorker", + "description": "subGroupPolicyType defines what type of Subgroups to create. Defaults to\nLeaderWorker", + "enum": [ + "LeaderWorker", + "LeaderExcluded" + ], + "type": "string" + }, + "subGroupSize": { + "description": "subGroupSize is the number of pods per subgroup. This value is immutable,\nand must not be greater than LeaderWorkerSet.Spec.Size.\nSize must be divisible by subGroupSize in which case the\nsubgroups will be of equal size. Or size - 1 is divisible\nby subGroupSize, in which case the leader is considered as\nthe extra pod, and will be part of the first subgroup.", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "volumeClaimTemplates": { + "description": "volumeClaimTemplates is a list of claims that pods are allowed to reference.\nEvery claim in this list must have at least one matching (by name) volumeMount\nin one container in the template. A claim in this list takes precedence over\nany volumes in the template, with the same name.", + "items": { + "description": "PersistentVolumeClaim is a user's request for and claim to a persistent volume", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "description": "Standard object's metadata.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "finalizers": { + "items": { + "type": "string" + }, + "type": "array" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "spec": { + "description": "spec defines the desired characteristics of a volume requested by a pod author.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + "properties": { + "accessModes": { + "description": "accessModes contains the desired access modes the volume should have.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "dataSource": { + "description": "dataSource field can be used to specify either:\n* An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)\n* An existing PVC (PersistentVolumeClaim)\nIf the provisioner or an external controller can support the specified data source,\nit will create a new volume based on the contents of the specified data source.\ndataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be\ncopied to dataSource when dataSourceRef.namespace is not specified.\nIf the namespace is specified, then dataSourceRef will not be copied to dataSource.", + "properties": { + "apiGroup": { + "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", + "type": "string" + }, + "kind": { + "description": "Kind is the type of resource being referenced", + "type": "string" + }, + "name": { + "description": "Name is the name of resource being referenced", + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "dataSourceRef": { + "description": "dataSourceRef specifies the object from which to populate the volume with data, if a non-empty\nvolume is desired. This may be any object from a non-empty API group (non\ncore object) or a PersistentVolumeClaim object.\nWhen this field is specified, volume binding will only succeed if the type of\nthe specified object matches some installed volume populator or dynamic\nprovisioner.\nThis field will replace the functionality of the dataSource field and as such\nif both fields are non-empty, they must have the same value. For backwards\ncompatibility, when namespace isn't specified in dataSourceRef,\nboth fields (dataSource and dataSourceRef) will be set to the same\nvalue automatically if one of them is empty and the other is non-empty.\nWhen namespace is specified in dataSourceRef,\ndataSource isn't set to the same value and must be empty.\nThere are three important differences between dataSource and dataSourceRef:\n* While dataSource only allows two specific types of objects, dataSourceRef\n allows any non-core object, as well as PersistentVolumeClaim objects.\n* While dataSource ignores disallowed values (dropping them), dataSourceRef\n preserves all values, and generates an error if a disallowed value is\n specified.\n* While dataSource only allows local objects, dataSourceRef allows objects\n in any namespaces.\n(Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", + "properties": { + "apiGroup": { + "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", + "type": "string" + }, + "kind": { + "description": "Kind is the type of resource being referenced", + "type": "string" + }, + "name": { + "description": "Name is the name of resource being referenced", + "type": "string" + }, + "namespace": { + "description": "Namespace is the namespace of resource being referenced\nNote that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n(Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "resources": { + "description": "resources represents the minimum resources the volume should have.\nUsers are allowed to specify resource requirements\nthat are lower than previous value but must still be higher than capacity recorded in the\nstatus field of the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources", + "properties": { + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "selector": { + "description": "selector is a label query over volumes to consider for binding.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "storageClassName": { + "description": "storageClassName is the name of the StorageClass required by the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1", + "type": "string" + }, + "volumeAttributesClassName": { + "description": "volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.\nIf specified, the CSI driver will create or update the volume with the attributes defined\nin the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,\nit can be changed after the claim is created. An empty string or nil value indicates that no\nVolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,\nthis field can be reset to its previous value (including nil) to cancel the modification.\nIf the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be\nset to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource\nexists.\nMore info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/", + "type": "string" + }, + "volumeMode": { + "description": "volumeMode defines what type of volume is required by the claim.\nValue of Filesystem is implied when not included in claim spec.", + "type": "string" + }, + "volumeName": { + "description": "volumeName is the binding reference to the PersistentVolume backing this claim.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "status": { + "description": "status represents the current information/status of a persistent volume claim.\nRead-only.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + "properties": { + "accessModes": { + "description": "accessModes contains the actual access modes the volume backing the PVC has.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "allocatedResourceStatuses": { + "additionalProperties": { + "description": "When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource\nthat it does not recognizes, then it should ignore that update and let other controllers\nhandle it.", + "type": "string" + }, + "description": "allocatedResourceStatuses stores status of resource being resized for the given PVC.\nKey names follow standard Kubernetes label syntax. Valid values are either:\n\t* Un-prefixed keys:\n\t\t- storage - the capacity of the volume.\n\t* Custom resources must use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart from above values - keys that are unprefixed or have kubernetes.io prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState set when resize controller starts resizing the volume in control-plane.\n\t- ControllerResizeFailed:\n\t\tState set when resize has failed in resize controller with a terminal error.\n\t- NodeResizePending:\n\t\tState set when resize controller has finished resizing the volume but further resizing of\n\t\tvolume is needed on the node.\n\t- NodeResizeInProgress:\n\t\tState set when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState set when resizing has failed in kubelet with a terminal error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor example: if expanding a PVC for more capacity - this field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizeFailed\"\nWhen this field is not set, it means that no resize operation is in progress for the given PVC.\n\nA controller that receives PVC update with previously unknown resourceName or ClaimResourceStatus\nshould ignore the update for the purpose it was designed. For example - a controller that\nonly is responsible for resizing capacity of the volume, should ignore PVC updates that change other valid\nresources associated with PVC.", + "type": "object", + "x-kubernetes-map-type": "granular" + }, + "allocatedResources": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "allocatedResources tracks the resources allocated to a PVC including its capacity.\nKey names follow standard Kubernetes label syntax. Valid values are either:\n\t* Un-prefixed keys:\n\t\t- storage - the capacity of the volume.\n\t* Custom resources must use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart from above values - keys that are unprefixed or have kubernetes.io prefix are considered\nreserved and hence may not be used.\n\nCapacity reported here may be larger than the actual capacity when a volume expansion operation\nis requested.\nFor storage quota, the larger value from allocatedResources and PVC.spec.resources is used.\nIf allocatedResources is not set, PVC.spec.resources alone is used for quota calculation.\nIf a volume expansion capacity request is lowered, allocatedResources is only\nlowered if there are no expansion operations in progress and if the actual volume capacity\nis equal or lower than the requested capacity.\n\nA controller that receives PVC update with previously unknown resourceName\nshould ignore the update for the purpose it was designed. For example - a controller that\nonly is responsible for resizing capacity of the volume, should ignore PVC updates that change other valid\nresources associated with PVC.", + "type": "object" + }, + "capacity": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "capacity represents the actual resources of the underlying volume.", + "type": "object" + }, + "conditions": { + "description": "conditions is the current Condition of persistent volume claim. If underlying persistent volume is being\nresized then the Condition will be set to 'Resizing'.", + "items": { + "description": "PersistentVolumeClaimCondition contains details about state of pvc", + "properties": { + "lastProbeTime": { + "description": "lastProbeTime is the time we probed the condition.", + "format": "date-time", + "type": "string" + }, + "lastTransitionTime": { + "description": "lastTransitionTime is the time the condition transitioned from one status to another.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is the human-readable message indicating details about last transition.", + "type": "string" + }, + "reason": { + "description": "reason is a unique, this should be a short, machine understandable string that gives the reason\nfor condition's last transition. If it reports \"Resizing\" that means the underlying\npersistent volume is being resized.", + "type": "string" + }, + "status": { + "description": "Status is the status of the condition.\nCan be True, False, Unknown.\nMore info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required", + "type": "string" + }, + "type": { + "description": "Type is the type of the condition.\nMore info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about", + "type": "string" + } + }, + "required": [ + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "type" + ], + "x-kubernetes-list-type": "map" + }, + "currentVolumeAttributesClassName": { + "description": "currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.\nWhen unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim", + "type": "string" + }, + "healthStatus": { + "description": "healthStatus contains the latest controller-reported health information\nfor the volume bound to this claim.", + "properties": { + "healthConditions": { + "description": "conditions is the set of adverse conditions reported by\nthe CSI controller plugin. An empty list means no adverse condition.\nAt most 16 conditions may be reported.", + "items": { + "description": "VolumeHealthCondition represents an adverse health condition reported for a volume.", + "properties": { + "message": { + "description": "message is a human-readable description.\nMaximum permitted length of a message is 1024 bytes.", + "type": "string" + }, + "reason": { + "description": "reason is a brief CamelCase machine-parseable reason.\nTogether with status it forms the unique identity of a condition entry.\nMaximum permitted length of a reason is 256 bytes.", + "type": "string" + }, + "status": { + "description": "status is the machine-parseable health category.\nPossible values:\n- \"Inaccessible\": the volume cannot be accessed.\n- \"DataLoss\": data loss has been detected on the volume.\n- \"Degraded\": the volume is functioning with reduced capability.", + "enum": [ + "DataLoss", + "Degraded", + "Inaccessible" + ], + "type": "string" + } + }, + "required": [ + "reason", + "status" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "status", + "reason" + ], + "x-kubernetes-list-type": "map" + }, + "lastTransitionTime": { + "description": "lastTransitionTime is when the current set of conditions first appeared.", + "format": "date-time", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "modifyVolumeStatus": { + "description": "ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.\nWhen this is unset, there is no ModifyVolume operation being attempted.", + "properties": { + "status": { + "description": "status is the status of the ControllerModifyVolume operation. It can be in any of following states:\n - Pending\n Pending indicates that the PersistentVolumeClaim cannot be modified due to unmet requirements, such as\n the specified VolumeAttributesClass not existing.\n - InProgress\n InProgress indicates that the volume is being modified.\n - Infeasible\n Infeasible indicates that the request has been rejected as invalid by the CSI driver. To\n\t resolve the error, a valid VolumeAttributesClass needs to be specified.\nNote: New statuses can be added in the future. Consumers should check for unknown statuses and fail appropriately.", + "type": "string" + }, + "targetVolumeAttributesClassName": { + "description": "targetVolumeAttributesClassName is the name of the VolumeAttributesClass the PVC currently being reconciled", + "type": "string" + } + }, + "required": [ + "status" + ], + "type": "object", + "additionalProperties": false + }, + "phase": { + "description": "phase represents the current phase of PersistentVolumeClaim.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "workerTemplate": { + "description": "workerTemplate defines the pod template for worker pods.", + "properties": { + "metadata": { + "description": "Standard object's metadata.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "finalizers": { + "items": { + "type": "string" + }, + "type": "array" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "spec": { + "description": "Specification of the desired behavior of the pod.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + "properties": { + "activeDeadlineSeconds": { + "description": "Optional duration in seconds the pod may be active on the node relative to\nStartTime before the system will actively try to mark it failed and kill associated containers.\nValue must be a positive integer.", + "format": "int64", + "type": "integer" + }, + "affinity": { + "description": "If specified, the pod's scheduling constraints", + "properties": { + "nodeAffinity": { + "description": "Describes node affinity scheduling rules for the pod.", + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node matches the corresponding matchExpressions; the\nnode(s) with the highest sum are the most preferred.", + "items": { + "description": "An empty preferred scheduling term matches all objects with implicit weight 0\n(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).", + "properties": { + "preference": { + "description": "A node selector term, associated with the corresponding weight.", + "properties": { + "matchExpressions": { + "description": "A list of node selector requirements by node's labels.", + "items": { + "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + "properties": { + "key": { + "description": "The label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + "type": "string" + }, + "values": { + "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchFields": { + "description": "A list of node selector requirements by node's fields.", + "items": { + "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + "properties": { + "key": { + "description": "The label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + "type": "string" + }, + "values": { + "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "weight": { + "description": "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.", + "format": "int32", + "type": "integer" + } + }, + "required": [ + "preference", + "weight" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to an update), the system\nmay or may not try to eventually evict the pod from its node.", + "properties": { + "nodeSelectorTerms": { + "description": "Required. A list of node selector terms. The terms are ORed.", + "items": { + "description": "A null or empty node selector term matches no objects. The requirements of\nthem are ANDed.\nThe TopologySelectorTerm type implements a subset of the NodeSelectorTerm.", + "properties": { + "matchExpressions": { + "description": "A list of node selector requirements by node's labels.", + "items": { + "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + "properties": { + "key": { + "description": "The label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + "type": "string" + }, + "values": { + "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchFields": { + "description": "A list of node selector requirements by node's fields.", + "items": { + "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + "properties": { + "key": { + "description": "The label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + "type": "string" + }, + "values": { + "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "nodeSelectorTerms" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "podAffinity": { + "description": "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).", + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + "items": { + "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", + "properties": { + "podAffinityTerm": { + "description": "Required. A pod affinity term, associated with the corresponding weight.", + "properties": { + "labelSelector": { + "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "mismatchLabelKeys": { + "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "namespaceSelector": { + "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "namespaces": { + "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologyKey": { + "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + "type": "string" + } + }, + "required": [ + "topologyKey" + ], + "type": "object", + "additionalProperties": false + }, + "weight": { + "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", + "format": "int32", + "type": "integer" + } + }, + "required": [ + "podAffinityTerm", + "weight" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", + "items": { + "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", + "properties": { + "labelSelector": { + "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "mismatchLabelKeys": { + "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "namespaceSelector": { + "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "namespaces": { + "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologyKey": { + "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + "type": "string" + } + }, + "required": [ + "topologyKey" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "podAntiAffinity": { + "description": "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + "items": { + "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", + "properties": { + "podAffinityTerm": { + "description": "Required. A pod affinity term, associated with the corresponding weight.", + "properties": { + "labelSelector": { + "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "mismatchLabelKeys": { + "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "namespaceSelector": { + "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "namespaces": { + "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologyKey": { + "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + "type": "string" + } + }, + "required": [ + "topologyKey" + ], + "type": "object", + "additionalProperties": false + }, + "weight": { + "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", + "format": "int32", + "type": "integer" + } + }, + "required": [ + "podAffinityTerm", + "weight" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "description": "If the anti-affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the anti-affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", + "items": { + "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", + "properties": { + "labelSelector": { + "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "mismatchLabelKeys": { + "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "namespaceSelector": { + "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "namespaces": { + "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologyKey": { + "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + "type": "string" + } + }, + "required": [ + "topologyKey" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "automountServiceAccountToken": { + "description": "AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.", + "type": "boolean" + }, + "containers": { + "description": "List of containers belonging to the pod.\nContainers cannot currently be added or removed.\nThere must be at least one container in a Pod.\nCannot be updated.", + "items": { + "description": "A single application container that you want to run within a pod.", + "properties": { + "args": { + "description": "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "command": { + "description": "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "env": { + "description": "List of environment variables to set in the container.\nCannot be updated.", + "items": { + "description": "EnvVar represents an environment variable present in a Container.", + "properties": { + "name": { + "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "value": { + "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + "type": "string" + }, + "valueFrom": { + "description": "Source for the environment variable's value. Cannot be used if value is not empty.", + "properties": { + "configMapKeyRef": { + "description": "Selects a key of a ConfigMap.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fieldRef": { + "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fileKeyRef": { + "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + "properties": { + "key": { + "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + "type": "string" + }, + "optional": { + "default": false, + "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + "type": "boolean" + }, + "path": { + "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + "type": "string" + }, + "volumeName": { + "description": "The name of the volume mount containing the env file.", + "type": "string" + } + }, + "required": [ + "key", + "path", + "volumeName" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secretKeyRef": { + "description": "Selects a key of a secret in the pod's namespace", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "envFrom": { + "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + "items": { + "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + "properties": { + "configMapRef": { + "description": "The ConfigMap to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "prefix": { + "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "secretRef": { + "description": "The Secret to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "image": { + "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", + "type": "string" + }, + "imagePullPolicy": { + "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + "type": "string" + }, + "lifecycle": { + "description": "Actions that the management system should take in response to container lifecycle events.\nCannot be updated.", + "properties": { + "postStart": { + "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "preStop": { + "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "stopSignal": { + "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "livenessProbe": { + "description": "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "name": { + "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", + "type": "string" + }, + "ports": { + "description": "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", + "items": { + "description": "ContainerPort represents a network port in a single container.", + "properties": { + "containerPort": { + "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + "format": "int32", + "type": "integer" + }, + "hostIP": { + "description": "What host IP to bind the external port to.", + "type": "string" + }, + "hostPort": { + "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + "format": "int32", + "type": "integer" + }, + "name": { + "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + "type": "string" + }, + "protocol": { + "default": "TCP", + "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + "type": "string" + } + }, + "required": [ + "containerPort" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "containerPort", + "protocol" + ], + "x-kubernetes-list-type": "map" + }, + "readinessProbe": { + "description": "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "resizePolicy": { + "description": "Resources resize policy for the container.\nThis field cannot be set on ephemeral containers.", + "items": { + "description": "ContainerResizePolicy represents resource resize policy for the container.", + "properties": { + "resourceName": { + "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", + "type": "string" + }, + "restartPolicy": { + "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", + "type": "string" + } + }, + "required": [ + "resourceName", + "restartPolicy" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "resources": { + "description": "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "properties": { + "claims": { + "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + "items": { + "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", + "properties": { + "name": { + "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + "type": "string" + }, + "request": { + "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "restartPolicy": { + "description": "RestartPolicy defines the restart behavior of individual containers in a pod.\nThis overrides the pod-level restart policy. When this field is not specified,\nthe restart behavior is defined by the Pod's restart policy and the container type.\nAdditionally, setting the RestartPolicy as \"Always\" for the init container will\nhave the following effect:\nthis init container will be continually restarted on\nexit until all regular containers have terminated. Once all regular\ncontainers have completed, all init containers with restartPolicy \"Always\"\nwill be shut down. This lifecycle differs from normal init containers and\nis often referred to as a \"sidecar\" container. Although this init\ncontainer still starts in the init container sequence, it does not wait\nfor the container to complete before proceeding to the next init\ncontainer. Instead, the next init container starts immediately after this\ninit container is started, or after any startupProbe has successfully\ncompleted.", + "type": "string" + }, + "restartPolicyRules": { + "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. The rules are evaluated in\norder. Once a rule matches a container exit condition, the remaining\nrules are ignored. If no rule matches the container exit condition,\nthe Container-level restart policy determines the whether the container\nis restarted or not. Constraints on the rules:\n- At most 20 rules are allowed.\n- Rules can have the same action.\n- Identical rules are not forbidden in validations.\nWhen rules are specified, container MUST set RestartPolicy explicitly\neven it if matches the Pod's RestartPolicy.", + "items": { + "description": "ContainerRestartRule describes how a container exit is handled.", + "properties": { + "action": { + "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", + "type": "string" + }, + "exitCodes": { + "description": "Represents the exit codes to check on container exits.", + "properties": { + "operator": { + "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", + "type": "string" + }, + "values": { + "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", + "items": { + "format": "int32", + "type": "integer" + }, + "type": "array", + "x-kubernetes-list-type": "set" + } + }, + "required": [ + "operator" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "action" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "securityContext": { + "description": "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + "properties": { + "allowPrivilegeEscalation": { + "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "appArmorProfile": { + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "capabilities": { + "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "add": { + "description": "Added capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "drop": { + "description": "Removed capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "privileged": { + "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "procMount": { + "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "readOnlyRootFilesystem": { + "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "runAsGroup": { + "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "runAsNonRoot": { + "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "boolean" + }, + "runAsUser": { + "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "seLinuxOptions": { + "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "level": { + "description": "Level is SELinux level label that applies to the container.", + "type": "string" + }, + "role": { + "description": "Role is a SELinux role label that applies to the container.", + "type": "string" + }, + "type": { + "description": "Type is a SELinux type label that applies to the container.", + "type": "string" + }, + "user": { + "description": "User is a SELinux user label that applies to the container.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "seccompProfile": { + "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + "type": "string" + }, + "type": { + "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "windowsOptions": { + "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + "properties": { + "gmsaCredentialSpec": { + "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + "type": "string" + }, + "gmsaCredentialSpecName": { + "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + "type": "string" + }, + "hostProcess": { + "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + "type": "boolean" + }, + "runAsUserName": { + "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "startupProbe": { + "description": "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "stdin": { + "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", + "type": "boolean" + }, + "stdinOnce": { + "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", + "type": "boolean" + }, + "terminationMessagePath": { + "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + "type": "string" + }, + "terminationMessagePolicy": { + "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + "type": "string" + }, + "tty": { + "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", + "type": "boolean" + }, + "volumeDevices": { + "description": "volumeDevices is the list of block devices to be used by the container.", + "items": { + "description": "volumeDevice describes a mapping of a raw block device within a container.", + "properties": { + "devicePath": { + "description": "devicePath is the path inside of the container that the device will be mapped to.", + "type": "string" + }, + "name": { + "description": "name must match the name of a persistentVolumeClaim in the pod", + "type": "string" + } + }, + "required": [ + "devicePath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "devicePath" + ], + "x-kubernetes-list-type": "map" + }, + "volumeMounts": { + "description": "Pod volumes to mount into the container's filesystem.\nCannot be updated.", + "items": { + "description": "VolumeMount describes a mounting of a Volume within a container.", + "properties": { + "bindMountOptions": { + "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "mountPath": { + "description": "Path within the container at which the volume should be mounted.", + "type": "string" + }, + "mountPropagation": { + "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + "type": "string" + }, + "name": { + "description": "This must match the Name of a Volume.", + "type": "string" + }, + "readOnly": { + "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + "type": "boolean" + }, + "recursiveReadOnly": { + "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + "type": "string" + }, + "subPath": { + "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + "type": "string" + }, + "subPathExpr": { + "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + "type": "string" + } + }, + "required": [ + "mountPath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "mountPath" + ], + "x-kubernetes-list-type": "map" + }, + "workingDir": { + "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "dnsConfig": { + "description": "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", + "properties": { + "nameservers": { + "description": "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "options": { + "description": "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", + "items": { + "description": "PodDNSConfigOption defines DNS resolver options of a pod.", + "properties": { + "name": { + "description": "Name is this DNS resolver option's name.\nRequired.", + "type": "string" + }, + "value": { + "description": "Value is this DNS resolver option's value.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "searches": { + "description": "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "dnsPolicy": { + "description": "Set DNS policy for the pod.\nDefaults to \"ClusterFirst\".\nValid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'.\nDNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy.\nTo have DNS options set along with hostNetwork, you have to specify DNS policy\nexplicitly to 'ClusterFirstWithHostNet'.", + "type": "string" + }, + "enableServiceLinks": { + "description": "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", + "type": "boolean" + }, + "ephemeralContainers": { + "description": "List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing\npod to perform user-initiated actions such as debugging. This list cannot be specified when\ncreating a pod, and it cannot be modified by updating the pod spec. In order to add an\nephemeral container to an existing pod, use the pod's ephemeralcontainers subresource.", + "items": { + "description": "An EphemeralContainer is a temporary container that you may add to an existing Pod for\nuser-initiated activities such as debugging. Ephemeral containers have no resource or\nscheduling guarantees, and they will not be restarted when they exit or when a Pod is\nremoved or restarted. The kubelet may evict a Pod if an ephemeral container causes the\nPod to exceed its resource allocation.\n\nTo add an ephemeral container, use the ephemeralcontainers subresource of an existing\nPod. Ephemeral containers may not be removed or restarted.", + "properties": { + "args": { + "description": "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "command": { + "description": "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "env": { + "description": "List of environment variables to set in the container.\nCannot be updated.", + "items": { + "description": "EnvVar represents an environment variable present in a Container.", + "properties": { + "name": { + "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "value": { + "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + "type": "string" + }, + "valueFrom": { + "description": "Source for the environment variable's value. Cannot be used if value is not empty.", + "properties": { + "configMapKeyRef": { + "description": "Selects a key of a ConfigMap.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fieldRef": { + "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fileKeyRef": { + "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + "properties": { + "key": { + "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + "type": "string" + }, + "optional": { + "default": false, + "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + "type": "boolean" + }, + "path": { + "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + "type": "string" + }, + "volumeName": { + "description": "The name of the volume mount containing the env file.", + "type": "string" + } + }, + "required": [ + "key", + "path", + "volumeName" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secretKeyRef": { + "description": "Selects a key of a secret in the pod's namespace", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "envFrom": { + "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + "items": { + "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + "properties": { + "configMapRef": { + "description": "The ConfigMap to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "prefix": { + "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "secretRef": { + "description": "The Secret to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "image": { + "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", + "type": "string" + }, + "imagePullPolicy": { + "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + "type": "string" + }, + "lifecycle": { + "description": "Lifecycle is not allowed for ephemeral containers.", + "properties": { + "postStart": { + "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "preStop": { + "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "stopSignal": { + "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "livenessProbe": { + "description": "Probes are not allowed for ephemeral containers.", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "name": { + "description": "Name of the ephemeral container specified as a DNS_LABEL.\nThis name must be unique among all containers, init containers and ephemeral containers.", + "type": "string" + }, + "ports": { + "description": "Ports are not allowed for ephemeral containers.", + "items": { + "description": "ContainerPort represents a network port in a single container.", + "properties": { + "containerPort": { + "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + "format": "int32", + "type": "integer" + }, + "hostIP": { + "description": "What host IP to bind the external port to.", + "type": "string" + }, + "hostPort": { + "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + "format": "int32", + "type": "integer" + }, + "name": { + "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + "type": "string" + }, + "protocol": { + "default": "TCP", + "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + "type": "string" + } + }, + "required": [ + "containerPort" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "containerPort", + "protocol" + ], + "x-kubernetes-list-type": "map" + }, + "readinessProbe": { + "description": "Probes are not allowed for ephemeral containers.", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "resizePolicy": { + "description": "Resources resize policy for the container.", + "items": { + "description": "ContainerResizePolicy represents resource resize policy for the container.", + "properties": { + "resourceName": { + "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", + "type": "string" + }, + "restartPolicy": { + "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", + "type": "string" + } + }, + "required": [ + "resourceName", + "restartPolicy" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "resources": { + "description": "Resources are not allowed for ephemeral containers. Ephemeral containers use spare resources\nalready allocated to the pod.", + "properties": { + "claims": { + "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + "items": { + "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", + "properties": { + "name": { + "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + "type": "string" + }, + "request": { + "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "restartPolicy": { + "description": "Restart policy for the container to manage the restart behavior of each\ncontainer within a pod.\nYou cannot set this field on ephemeral containers.", + "type": "string" + }, + "restartPolicyRules": { + "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. You cannot set this field on\nephemeral containers.", + "items": { + "description": "ContainerRestartRule describes how a container exit is handled.", + "properties": { + "action": { + "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", + "type": "string" + }, + "exitCodes": { + "description": "Represents the exit codes to check on container exits.", + "properties": { + "operator": { + "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", + "type": "string" + }, + "values": { + "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", + "items": { + "format": "int32", + "type": "integer" + }, + "type": "array", + "x-kubernetes-list-type": "set" + } + }, + "required": [ + "operator" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "action" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "securityContext": { + "description": "Optional: SecurityContext defines the security options the ephemeral container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.", + "properties": { + "allowPrivilegeEscalation": { + "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "appArmorProfile": { + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "capabilities": { + "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "add": { + "description": "Added capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "drop": { + "description": "Removed capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "privileged": { + "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "procMount": { + "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "readOnlyRootFilesystem": { + "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "runAsGroup": { + "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "runAsNonRoot": { + "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "boolean" + }, + "runAsUser": { + "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "seLinuxOptions": { + "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "level": { + "description": "Level is SELinux level label that applies to the container.", + "type": "string" + }, + "role": { + "description": "Role is a SELinux role label that applies to the container.", + "type": "string" + }, + "type": { + "description": "Type is a SELinux type label that applies to the container.", + "type": "string" + }, + "user": { + "description": "User is a SELinux user label that applies to the container.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "seccompProfile": { + "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + "type": "string" + }, + "type": { + "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "windowsOptions": { + "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + "properties": { + "gmsaCredentialSpec": { + "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + "type": "string" + }, + "gmsaCredentialSpecName": { + "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + "type": "string" + }, + "hostProcess": { + "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + "type": "boolean" + }, + "runAsUserName": { + "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "startupProbe": { + "description": "Probes are not allowed for ephemeral containers.", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "stdin": { + "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", + "type": "boolean" + }, + "stdinOnce": { + "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", + "type": "boolean" + }, + "targetContainerName": { + "description": "If set, the name of the container from PodSpec that this ephemeral container targets.\nThe ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.\nIf not set then the ephemeral container uses the namespaces configured in the Pod spec.\n\nThe container runtime must implement support for this feature. If the runtime does not\nsupport namespace targeting then the result of setting this field is undefined.", + "type": "string" + }, + "terminationMessagePath": { + "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + "type": "string" + }, + "terminationMessagePolicy": { + "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + "type": "string" + }, + "tty": { + "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", + "type": "boolean" + }, + "volumeDevices": { + "description": "volumeDevices is the list of block devices to be used by the container.", + "items": { + "description": "volumeDevice describes a mapping of a raw block device within a container.", + "properties": { + "devicePath": { + "description": "devicePath is the path inside of the container that the device will be mapped to.", + "type": "string" + }, + "name": { + "description": "name must match the name of a persistentVolumeClaim in the pod", + "type": "string" + } + }, + "required": [ + "devicePath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "devicePath" + ], + "x-kubernetes-list-type": "map" + }, + "volumeMounts": { + "description": "Pod volumes to mount into the container's filesystem. Subpath mounts are not allowed for ephemeral containers.\nCannot be updated.", + "items": { + "description": "VolumeMount describes a mounting of a Volume within a container.", + "properties": { + "bindMountOptions": { + "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "mountPath": { + "description": "Path within the container at which the volume should be mounted.", + "type": "string" + }, + "mountPropagation": { + "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + "type": "string" + }, + "name": { + "description": "This must match the Name of a Volume.", + "type": "string" + }, + "readOnly": { + "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + "type": "boolean" + }, + "recursiveReadOnly": { + "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + "type": "string" + }, + "subPath": { + "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + "type": "string" + }, + "subPathExpr": { + "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + "type": "string" + } + }, + "required": [ + "mountPath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "mountPath" + ], + "x-kubernetes-list-type": "map" + }, + "workingDir": { + "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "evictionResponders": { + "description": "evictionResponders reference responders that react to Evictions based on EvictionRequests.\nResponders should observe and communicate through the Eviction Resource API to help with\nthe graceful termination of a pod. The responders are selected sequentially, according to\ntheir specified priority.\n\nResponders should periodically report on an eviction progress by updating the\n.status.responders[].heartbeatTime field of the Eviction object. If this field is not updated\nwithin the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction\nis passed over to the next responder with a lower priority. If there is no other responder,\nthe last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will\nevict the pod using the imperative Eviction API (pods//eviction subresource).\n\nThe maximum length of the responders list is 10.\nResponders are not supported when the pod is part of a PodGroup (.spec.schedulingGroup is set).\nThis field can only be set on creation and is immutable afterwards.", + "items": { + "description": "EvictionResponder allows you to specify the responder reacting to an Eviction.\nResponders should observe and communicate through the Eviction Resource API to help with\nthe graceful eviction of a target (e.g. termination of a pod).", + "properties": { + "name": { + "description": "name allows you to identify the responder responding to the Eviction.\n\nIt must be a valid domain-prefixed key (such as \"acme.io/foo\").\nDomain names *.k8s.io and *.kubernetes.io are reserved.\nThis field must be unique for each responder.\nThis field is required.", + "type": "string" + }, + "priority": { + "description": "priority for this responder. Higher priorities are selected first by the evictionrequest-controller.\nIf there are responders with the same priority, the responder whose domain name comes first in the\nalphabetical higher domain order, will be picked. This means that the top domain labels are compared\nalphabetically first, followed by the lower domain labels. The key is compared last.\n\nThe responder that is the managing controller of the pod should set the value of\nthis field to 10000 to allow both for preemption or fallback registration by other\nresponders.\n\nThe minimum value is 0 and the maximum value is 100000.\nThe interval 0-999 is reserved for responders with *.k8s.io suffix.\nThis field is required.", + "format": "int32", + "type": "integer" + } + }, + "required": [ + "name", + "priority" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "hostAliases": { + "description": "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified.", + "items": { + "description": "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", + "properties": { + "hostnames": { + "description": "Hostnames for the above IP address.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "ip": { + "description": "IP address of the host file entry.", + "type": "string" + } + }, + "required": [ + "ip" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "ip" + ], + "x-kubernetes-list-type": "map" + }, + "hostIPC": { + "description": "Use the host's ipc namespace.\nOptional: Default to false.", + "type": "boolean" + }, + "hostNetwork": { + "description": "Host networking requested for this pod. Use the host's network namespace.\nWhen using HostNetwork you should specify ports so the scheduler is aware.\nWhen `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,\nand unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.\nDefault to false.", + "type": "boolean" + }, + "hostPID": { + "description": "Use the host's pid namespace.\nOptional: Default to false.", + "type": "boolean" + }, + "hostUsers": { + "description": "Use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new userns is created for the pod. Setting false is useful for\nmitigating container breakout vulnerabilities even allowing users to run their\ncontainers as root without actually having root privileges on the host.", + "type": "boolean" + }, + "hostname": { + "description": "Specifies the hostname of the Pod\nIf not specified, the pod's hostname will be set to a system-defined value.", + "type": "string" + }, + "hostnameOverride": { + "description": "HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.\nThis field only specifies the pod's hostname and does not affect its DNS records.\nWhen this field is set to a non-empty string:\n- It takes precedence over the values set in `hostname` and `subdomain`.\n- The Pod's hostname will be set to this value.\n- `setHostnameAsFQDN` must be nil or set to false.\n- `hostNetwork` must be set to false.\n\nThis field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.", + "type": "string" + }, + "imagePullSecrets": { + "description": "ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.\nIf specified, these secrets will be passed to individual puller implementations for them to use.\nMore info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod", + "items": { + "description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "initContainers": { + "description": "List of initialization containers belonging to the pod.\nInit containers are executed in order prior to containers being started. If any\ninit container fails, the pod is considered to have failed and is handled according\nto its restartPolicy. The name for an init container or normal container must be\nunique among all containers.\nInit containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.\nThe resourceRequirements of an init container are taken into account during scheduling\nby finding the highest request/limit for each resource type, and then using the max of\nthat value or the sum of the normal containers. Limits are applied to init containers\nin a similar fashion.\nInit containers cannot currently be added or removed.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/", + "items": { + "description": "A single application container that you want to run within a pod.", + "properties": { + "args": { + "description": "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "command": { + "description": "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "env": { + "description": "List of environment variables to set in the container.\nCannot be updated.", + "items": { + "description": "EnvVar represents an environment variable present in a Container.", + "properties": { + "name": { + "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "value": { + "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + "type": "string" + }, + "valueFrom": { + "description": "Source for the environment variable's value. Cannot be used if value is not empty.", + "properties": { + "configMapKeyRef": { + "description": "Selects a key of a ConfigMap.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fieldRef": { + "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "fileKeyRef": { + "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + "properties": { + "key": { + "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + "type": "string" + }, + "optional": { + "default": false, + "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + "type": "boolean" + }, + "path": { + "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + "type": "string" + }, + "volumeName": { + "description": "The name of the volume mount containing the env file.", + "type": "string" + } + }, + "required": [ + "key", + "path", + "volumeName" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secretKeyRef": { + "description": "Selects a key of a secret in the pod's namespace", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "envFrom": { + "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + "items": { + "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + "properties": { + "configMapRef": { + "description": "The ConfigMap to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "prefix": { + "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + "type": "string" + }, + "secretRef": { + "description": "The Secret to select from", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "image": { + "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", + "type": "string" + }, + "imagePullPolicy": { + "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + "type": "string" + }, + "lifecycle": { + "description": "Actions that the management system should take in response to container lifecycle events.\nCannot be updated.", + "properties": { + "postStart": { + "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "preStop": { + "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "sleep": { + "description": "Sleep represents a duration that the container should sleep.", + "properties": { + "seconds": { + "description": "Seconds is the number of seconds to sleep.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "seconds" + ], + "type": "object", + "additionalProperties": false + }, + "tcpSocket": { + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "stopSignal": { + "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "livenessProbe": { + "description": "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "name": { + "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", + "type": "string" + }, + "ports": { + "description": "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", + "items": { + "description": "ContainerPort represents a network port in a single container.", + "properties": { + "containerPort": { + "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + "format": "int32", + "type": "integer" + }, + "hostIP": { + "description": "What host IP to bind the external port to.", + "type": "string" + }, + "hostPort": { + "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + "format": "int32", + "type": "integer" + }, + "name": { + "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + "type": "string" + }, + "protocol": { + "default": "TCP", + "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + "type": "string" + } + }, + "required": [ + "containerPort" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "containerPort", + "protocol" + ], + "x-kubernetes-list-type": "map" + }, + "readinessProbe": { + "description": "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "resizePolicy": { + "description": "Resources resize policy for the container.\nThis field cannot be set on ephemeral containers.", + "items": { + "description": "ContainerResizePolicy represents resource resize policy for the container.", + "properties": { + "resourceName": { + "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", + "type": "string" + }, + "restartPolicy": { + "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", + "type": "string" + } + }, + "required": [ + "resourceName", + "restartPolicy" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "resources": { + "description": "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "properties": { + "claims": { + "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + "items": { + "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", + "properties": { + "name": { + "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + "type": "string" + }, + "request": { + "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "restartPolicy": { + "description": "RestartPolicy defines the restart behavior of individual containers in a pod.\nThis overrides the pod-level restart policy. When this field is not specified,\nthe restart behavior is defined by the Pod's restart policy and the container type.\nAdditionally, setting the RestartPolicy as \"Always\" for the init container will\nhave the following effect:\nthis init container will be continually restarted on\nexit until all regular containers have terminated. Once all regular\ncontainers have completed, all init containers with restartPolicy \"Always\"\nwill be shut down. This lifecycle differs from normal init containers and\nis often referred to as a \"sidecar\" container. Although this init\ncontainer still starts in the init container sequence, it does not wait\nfor the container to complete before proceeding to the next init\ncontainer. Instead, the next init container starts immediately after this\ninit container is started, or after any startupProbe has successfully\ncompleted.", + "type": "string" + }, + "restartPolicyRules": { + "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. The rules are evaluated in\norder. Once a rule matches a container exit condition, the remaining\nrules are ignored. If no rule matches the container exit condition,\nthe Container-level restart policy determines the whether the container\nis restarted or not. Constraints on the rules:\n- At most 20 rules are allowed.\n- Rules can have the same action.\n- Identical rules are not forbidden in validations.\nWhen rules are specified, container MUST set RestartPolicy explicitly\neven it if matches the Pod's RestartPolicy.", + "items": { + "description": "ContainerRestartRule describes how a container exit is handled.", + "properties": { + "action": { + "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", + "type": "string" + }, + "exitCodes": { + "description": "Represents the exit codes to check on container exits.", + "properties": { + "operator": { + "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", + "type": "string" + }, + "values": { + "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", + "items": { + "format": "int32", + "type": "integer" + }, + "type": "array", + "x-kubernetes-list-type": "set" + } + }, + "required": [ + "operator" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "action" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "securityContext": { + "description": "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + "properties": { + "allowPrivilegeEscalation": { + "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "appArmorProfile": { + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "capabilities": { + "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "add": { + "description": "Added capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "drop": { + "description": "Removed capabilities", + "items": { + "description": "Capability represent POSIX capabilities type", + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "privileged": { + "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "procMount": { + "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "readOnlyRootFilesystem": { + "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "boolean" + }, + "runAsGroup": { + "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "runAsNonRoot": { + "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "boolean" + }, + "runAsUser": { + "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "seLinuxOptions": { + "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "level": { + "description": "Level is SELinux level label that applies to the container.", + "type": "string" + }, + "role": { + "description": "Role is a SELinux role label that applies to the container.", + "type": "string" + }, + "type": { + "description": "Type is a SELinux type label that applies to the container.", + "type": "string" + }, + "user": { + "description": "User is a SELinux user label that applies to the container.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "seccompProfile": { + "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + "type": "string" + }, + "type": { + "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "windowsOptions": { + "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + "properties": { + "gmsaCredentialSpec": { + "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + "type": "string" + }, + "gmsaCredentialSpecName": { + "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + "type": "string" + }, + "hostProcess": { + "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + "type": "boolean" + }, + "runAsUserName": { + "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "startupProbe": { + "description": "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "properties": { + "exec": { + "description": "Exec specifies a command to execute in the container.", + "properties": { + "command": { + "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "failureThreshold": { + "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "grpc": { + "description": "GRPC specifies a GRPC HealthCheckRequest.", + "properties": { + "mode": { + "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", + "type": "string" + }, + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "default": "", + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "httpGet": { + "description": "HTTPGet specifies an HTTP GET request to perform.", + "properties": { + "host": { + "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + "type": "string" + }, + "httpHeaders": { + "description": "Custom headers to set in the request. HTTP allows repeated headers.", + "items": { + "description": "HTTPHeader describes a custom header to be used in HTTP probes", + "properties": { + "name": { + "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + "type": "string" + }, + "value": { + "description": "The header field value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "Path to access on the HTTP server.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "protocol": { + "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", + "type": "string" + }, + "scheme": { + "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "initialDelaySeconds": { + "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + }, + "periodSeconds": { + "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "successThreshold": { + "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + "format": "int32", + "type": "integer" + }, + "tcpSocket": { + "description": "TCPSocket specifies a connection to a TCP port.", + "properties": { + "host": { + "description": "Optional: Host name to connect to, defaults to the pod IP.", + "type": "string" + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "required": [ + "port" + ], + "type": "object", + "additionalProperties": false + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + "format": "int64", + "type": "integer" + }, + "timeoutSeconds": { + "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "stdin": { + "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", + "type": "boolean" + }, + "stdinOnce": { + "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", + "type": "boolean" + }, + "terminationMessagePath": { + "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + "type": "string" + }, + "terminationMessagePolicy": { + "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + "type": "string" + }, + "tty": { + "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", + "type": "boolean" + }, + "volumeDevices": { + "description": "volumeDevices is the list of block devices to be used by the container.", + "items": { + "description": "volumeDevice describes a mapping of a raw block device within a container.", + "properties": { + "devicePath": { + "description": "devicePath is the path inside of the container that the device will be mapped to.", + "type": "string" + }, + "name": { + "description": "name must match the name of a persistentVolumeClaim in the pod", + "type": "string" + } + }, + "required": [ + "devicePath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "devicePath" + ], + "x-kubernetes-list-type": "map" + }, + "volumeMounts": { + "description": "Pod volumes to mount into the container's filesystem.\nCannot be updated.", + "items": { + "description": "VolumeMount describes a mounting of a Volume within a container.", + "properties": { + "bindMountOptions": { + "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "mountPath": { + "description": "Path within the container at which the volume should be mounted.", + "type": "string" + }, + "mountPropagation": { + "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + "type": "string" + }, + "name": { + "description": "This must match the Name of a Volume.", + "type": "string" + }, + "readOnly": { + "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + "type": "boolean" + }, + "recursiveReadOnly": { + "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + "type": "string" + }, + "subPath": { + "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + "type": "string" + }, + "subPathExpr": { + "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + "type": "string" + } + }, + "required": [ + "mountPath", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "mountPath" + ], + "x-kubernetes-list-type": "map" + }, + "workingDir": { + "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "nodeName": { + "description": "NodeName indicates in which node this pod is scheduled.\nIf empty, this pod is a candidate for scheduling by the scheduler defined in schedulerName.\nOnce this field is set, the kubelet for this node becomes responsible for the lifecycle of this pod.\nThis field should not be used to express a desire for the pod to be scheduled on a specific node.\nhttps://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodename", + "type": "string" + }, + "nodeSelector": { + "additionalProperties": { + "type": "string" + }, + "description": "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + "type": "object", + "x-kubernetes-map-type": "atomic" + }, + "os": { + "description": "Specifies the OS of the containers in the pod.\nSome pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset:\n-securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset:\n- spec.hostPID\n- spec.hostIPC\n- spec.hostUsers\n- spec.resources\n- spec.securityContext.appArmorProfile\n- spec.securityContext.seLinuxOptions\n- spec.securityContext.seccompProfile\n- spec.securityContext.fsGroup\n- spec.securityContext.fsGroupChangePolicy\n- spec.securityContext.sysctls\n- spec.shareProcessNamespace\n- spec.securityContext.runAsUser\n- spec.securityContext.runAsGroup\n- spec.securityContext.supplementalGroups\n- spec.securityContext.supplementalGroupsPolicy\n- spec.containers[*].securityContext.appArmorProfile\n- spec.containers[*].securityContext.seLinuxOptions\n- spec.containers[*].securityContext.seccompProfile\n- spec.containers[*].securityContext.capabilities\n- spec.containers[*].securityContext.readOnlyRootFilesystem\n- spec.containers[*].securityContext.privileged\n- spec.containers[*].securityContext.allowPrivilegeEscalation\n- spec.containers[*].securityContext.procMount\n- spec.containers[*].securityContext.runAsUser\n- spec.containers[*].securityContext.runAsGroup", + "properties": { + "name": { + "description": "Name is the name of the operating system. The currently supported values are linux and windows.\nAdditional value may be defined in future and can be one of:\nhttps://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration\nClients should expect to handle additional values and treat unrecognized values in this field as os: null", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "overhead": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Overhead represents the resource overhead associated with running a pod for a given RuntimeClass.\nThis field will be autopopulated at admission time by the RuntimeClass admission controller. If\nthe RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests.\nThe RuntimeClass admission controller will reject Pod create requests which have the overhead already\nset. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value\ndefined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md", + "type": "object" + }, + "preemptionPolicy": { + "description": "PreemptionPolicy is the Policy for preempting pods with lower priority.\nOne of Never, PreemptLowerPriority.\nWhen Priority Admission Controller is enabled, it prevents users from setting\nthis field. The admission controller populates this field from PriorityClassName.\nDefaults to PreemptLowerPriority if unset.", + "type": "string" + }, + "priority": { + "description": "The priority value. Various system components use this field to find the\npriority of the pod. When Priority Admission Controller is enabled, it\nprevents users from setting this field. The admission controller populates\nthis field from PriorityClassName.\nThe higher the value, the higher the priority.", + "format": "int32", + "type": "integer" + }, + "priorityClassName": { + "description": "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", + "type": "string" + }, + "readinessGates": { + "description": "If specified, all readiness gates will be evaluated for pod readiness.\nA pod is ready when all its containers are ready AND\nall conditions specified in the readiness gates have status equal to \"True\"\nMore info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates", + "items": { + "description": "PodReadinessGate contains the reference to a pod condition", + "properties": { + "conditionType": { + "description": "ConditionType refers to a condition in the pod's condition list with matching type.", + "type": "string" + } + }, + "required": [ + "conditionType" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "resourceClaims": { + "description": "ResourceClaims defines which ResourceClaims must be allocated\nand reserved before the Pod is allowed to start. The resources\nwill be made available to those containers which consume them\nby name.\n\nThis is a stable field but requires that the\nDynamicResourceAllocation feature gate is enabled.\n\nThis field is immutable.", + "items": { + "description": "PodResourceClaim references exactly one ResourceClaim, either directly\nor by naming a ResourceClaimTemplate which is then turned into a ResourceClaim\nfor the pod.\n\nIt adds a name to it that uniquely identifies the ResourceClaim inside the Pod.\nContainers that need access to the ResourceClaim reference it with this name.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and this Pod\nbelongs to a PodGroup, a PodResourceClaim is matched to a\nPodGroupResourceClaim if all of their fields are equal (Name,\nResourceClaimName, and ResourceClaimTemplateName). A matched claim references\na single ResourceClaim shared across all Pods in the PodGroup, reserved for\nthe PodGroup in ResourceClaimStatus.ReservedFor rather than for individual\nPods.", + "properties": { + "name": { + "description": "Name uniquely identifies this resource claim inside the pod.\nThis must be a DNS_LABEL.", + "type": "string" + }, + "resourceClaimName": { + "description": "ResourceClaimName is the name of a ResourceClaim object in the same\nnamespace as this pod.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.", + "type": "string" + }, + "resourceClaimTemplateName": { + "description": "ResourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace as this pod.\n\nThe template will be used to create a new ResourceClaim, which will\nbe bound to this pod. When this pod is deleted, the ResourceClaim\nwill also be deleted. The pod name and resource name, along with a\ngenerated component, will be used to form a unique name for the\nResourceClaim, which will be recorded in pod.status.resourceClaimStatuses.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and the pod\nbelongs to a PodGroup that defines a PodGroupResourceClaim with the same\nName and ResourceClaimTemplateName, this PodResourceClaim resolves to the\nResourceClaim generated for the PodGroup. All pods in the group that\ndefine an equivalent PodResourceClaim matching the\nPodGroupResourceClaim's Name and ResourceClaimTemplateName share the same\ngenerated ResourceClaim. ResourceClaims generated for a PodGroup are\nowned by the PodGroup and their lifecycles are tied to the PodGroup\ninstead of any individual pod.\n\nThis field is immutable and no changes will be made to the\ncorresponding ResourceClaim by the control plane after creating the\nResourceClaim.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "resources": { + "description": "Resources is the total amount of CPU and Memory resources required by all\ncontainers in the pod. It supports specifying Requests and Limits for\n\"cpu\", \"memory\" and \"hugepages-\" resource names only. ResourceClaims are not supported.\n\nThis field enables fine-grained control over resource allocation for the\nentire pod, allowing resource sharing among containers in a pod.\n\nThis is an alpha field and requires enabling the PodLevelResources feature\ngate.", + "properties": { + "claims": { + "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + "items": { + "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", + "properties": { + "name": { + "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + "type": "string" + }, + "request": { + "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "restartPolicy": { + "description": "Restart policy for all containers within the pod.\nOne of Always, OnFailure, Never. In some contexts, only a subset of those values may be permitted.\nDefault to Always.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy", + "type": "string" + }, + "runtimeClassName": { + "description": "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used\nto run this pod. If no RuntimeClass resource matches the named class, the pod will not be run.\nIf unset or empty, the \"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class", + "type": "string" + }, + "schedulerName": { + "description": "If specified, the pod will be dispatched by specified scheduler.\nIf not specified, the pod will be dispatched by default scheduler.", + "type": "string" + }, + "schedulingGates": { + "description": "SchedulingGates is an opaque list of values that if specified will block scheduling the pod.\nIf schedulingGates is not empty, the pod will stay in the SchedulingGated state and the\nscheduler will not attempt to schedule the pod.\n\nSchedulingGates can only be set at pod creation time, and be removed only afterwards.", + "items": { + "description": "PodSchedulingGate is associated to a Pod to guard its scheduling.", + "properties": { + "name": { + "description": "Name of the scheduling gate.\nEach scheduling gate must have a unique name field.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "schedulingGroup": { + "description": "SchedulingGroup provides a reference to the immediate scheduling runtime\ngrouping object that this Pod belongs to.\nThis field is used by the scheduler to identify the group and apply the\ncorrect group scheduling policies. The association with a group also\nimpacts other lifecycle aspects of a Pod that are relevant in a wider context\nof scheduling like preemption, resource attachment, etc. If not specified,\nthe Pod is treated as a single unit in all of these aspects.\nThe group object referenced by this field may not exist at the time the\nPod is created.\nThis field is immutable, but a group object with the same name may be\nrecreated with different policies. Doing this during pod scheduling\nmay result in the placement not conforming to the expected policies.", + "properties": { + "podGroupName": { + "description": "PodGroupName specifies the name of the standalone PodGroup object\nthat represents the runtime instance of this group.\nMust be a DNS subdomain.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "securityContext": { + "description": "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.", + "properties": { + "appArmorProfile": { + "description": "appArmorProfile is the AppArmor options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "fsGroup": { + "description": "A special supplemental group that applies to all containers in a pod.\nSome volume types allow the Kubelet to change the ownership of that volume\nto be owned by the pod:\n\n1. The owning GID will be the FSGroup\n2. The setgid bit is set (new files created in the volume will be owned by FSGroup)\n3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "fsGroupChangePolicy": { + "description": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume\nbefore being exposed inside Pod. This field will only apply to\nvolume types which support fsGroup based ownership(and permissions).\nIt will have no effect on ephemeral volume types such as: secret, configmaps\nand emptydir.\nValid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "runAsGroup": { + "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "runAsNonRoot": { + "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "boolean" + }, + "runAsUser": { + "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", + "format": "int64", + "type": "integer" + }, + "seLinuxChangePolicy": { + "description": "seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.\nIt has no effect on nodes that do not support SELinux or to volumes does not support SELinux.\nValid values are \"MountOption\" and \"Recursive\".\n\n\"Recursive\" means relabeling of all files on all Pod volumes by the container runtime.\nThis may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.\n\n\"MountOption\" mounts all eligible Pod volumes with `-o context` mount option.\nThis requires all Pods that share the same volume to use the same SELinux label.\nIt is not possible to share the same volume among privileged and unprivileged Pods.\nEligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes\nwhose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their\nCSIDriver instance. Other volumes are always re-labelled recursively.\n\nIf not specified, \"MountOption\" is used.\n\nThis field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.\n\nAll Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "seLinuxOptions": { + "description": "The SELinux context to be applied to all containers.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in SecurityContext. If set in\nboth SecurityContext and PodSecurityContext, the value specified in SecurityContext\ntakes precedence for that container.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "level": { + "description": "Level is SELinux level label that applies to the container.", + "type": "string" + }, + "role": { + "description": "Role is a SELinux role label that applies to the container.", + "type": "string" + }, + "type": { + "description": "Type is a SELinux type label that applies to the container.", + "type": "string" + }, + "user": { + "description": "User is a SELinux user label that applies to the container.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "seccompProfile": { + "description": "The seccomp options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + "type": "string" + }, + "type": { + "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "supplementalGroups": { + "description": "A list of groups applied to the first process run in each container, in\naddition to the container's primary GID and fsGroup (if specified). If\nthe SupplementalGroupsPolicy feature is enabled, the\nsupplementalGroupsPolicy field determines whether these are in addition\nto or instead of any group memberships defined in the container image.\nIf unspecified, no additional groups are added, though group memberships\ndefined in the container image may still be used, depending on the\nsupplementalGroupsPolicy field.\nNote that this field cannot be set when spec.os.name is windows.", + "items": { + "format": "int64", + "type": "integer" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "supplementalGroupsPolicy": { + "description": "Defines how supplemental groups of the first container processes are calculated.\nValid values are \"Merge\" and \"Strict\". If not specified, \"Merge\" is used.\n(Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled\nand the container runtime must implement support for this feature.\nNote that this field cannot be set when spec.os.name is windows.", + "type": "string" + }, + "sysctls": { + "description": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", + "items": { + "description": "Sysctl defines a kernel parameter to be set", + "properties": { + "name": { + "description": "Name of a property to set", + "type": "string" + }, + "value": { + "description": "Value of a property to set", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "windowsOptions": { + "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options within a container's SecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + "properties": { + "gmsaCredentialSpec": { + "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + "type": "string" + }, + "gmsaCredentialSpecName": { + "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + "type": "string" + }, + "hostProcess": { + "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + "type": "boolean" + }, + "runAsUserName": { + "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "serviceAccount": { + "description": "DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.\nDeprecated: Use serviceAccountName instead.", + "type": "string" + }, + "serviceAccountName": { + "description": "ServiceAccountName is the name of the ServiceAccount to use to run this pod.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/", + "type": "string" + }, + "setHostnameAsFQDN": { + "description": "If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default).\nIn Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname).\nIn Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters to FQDN.\nIf a pod does not have FQDN, this has no effect.\nDefault to false.", + "type": "boolean" + }, + "shareProcessNamespace": { + "description": "Share a single process namespace between all of the containers in a pod.\nWhen this is set containers will be able to view and signal processes from other containers\nin the same pod, and the first process in each container will not be assigned PID 1.\nHostPID and ShareProcessNamespace cannot both be set.\nOptional: Default to false.", + "type": "boolean" + }, + "subdomain": { + "description": "If specified, the fully qualified Pod hostname will be \"...svc.\".\nIf not specified, the pod will not have a domainname at all.", + "type": "string" + }, + "terminationGracePeriodSeconds": { + "description": "Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nIf this value is nil, the default grace period will be used instead.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nDefaults to 30 seconds.", + "format": "int64", + "type": "integer" + }, + "tolerations": { + "description": "If specified, the pod's tolerations.", + "items": { + "description": "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + "properties": { + "effect": { + "description": "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + "type": "string" + }, + "key": { + "description": "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + "type": "string" + }, + "operator": { + "description": "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + "type": "string" + }, + "tolerationSeconds": { + "description": "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "topologySpreadConstraints": { + "description": "TopologySpreadConstraints describes how a group of pods ought to spread across topology\ndomains. Scheduler will schedule pods in a way which abides by the constraints.\nAll topologySpreadConstraints are ANDed.", + "items": { + "description": "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", + "properties": { + "labelSelector": { + "description": "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "matchLabelKeys": { + "description": "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "maxSkew": { + "description": "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", + "format": "int32", + "type": "integer" + }, + "minDomains": { + "description": "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", + "format": "int32", + "type": "integer" + }, + "nodeAffinityPolicy": { + "description": "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", + "type": "string" + }, + "nodeTaintsPolicy": { + "description": "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", + "type": "string" + }, + "topologyKey": { + "description": "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", + "type": "string" + }, + "whenUnsatisfiable": { + "description": "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", + "type": "string" + } + }, + "required": [ + "maxSkew", + "topologyKey", + "whenUnsatisfiable" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "topologyKey", + "whenUnsatisfiable" + ], + "x-kubernetes-list-type": "map" + }, + "volumes": { + "description": "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes", + "items": { + "description": "Volume represents a named volume in a pod that may be accessed by any container in the pod.", + "properties": { + "awsElasticBlockStore": { + "description": "awsElasticBlockStore represents an AWS Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nDeprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree\nawsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", + "properties": { + "fsType": { + "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", + "type": "string" + }, + "partition": { + "description": "partition is the partition in the volume that you want to mount.\nIf omitted, the default is to mount by volume name.\nExamples: For volume /dev/sda1, you specify the partition as \"1\".\nSimilarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).", + "format": "int32", + "type": "integer" + }, + "readOnly": { + "description": "readOnly value true will force the readOnly setting in VolumeMounts.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", + "type": "boolean" + }, + "volumeID": { + "description": "volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume).\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", + "type": "string" + } + }, + "required": [ + "volumeID" + ], + "type": "object", + "additionalProperties": false + }, + "azureDisk": { + "description": "azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.\nDeprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type\nare redirected to the disk.csi.azure.com CSI driver.", + "properties": { + "cachingMode": { + "description": "cachingMode is the Host Caching mode: None, Read Only, Read Write.", + "type": "string" + }, + "diskName": { + "description": "diskName is the Name of the data disk in the blob storage", + "type": "string" + }, + "diskURI": { + "description": "diskURI is the URI of data disk in the blob storage", + "type": "string" + }, + "fsType": { + "default": "ext4", + "description": "fsType is Filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "kind": { + "description": "kind expected values are Shared: multiple blob disks per storage account Dedicated: single blob disk per storage account Managed: azure managed data disk (only in managed availability set). defaults to shared", + "type": "string" + }, + "readOnly": { + "default": false, + "description": "readOnly Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + } + }, + "required": [ + "diskName", + "diskURI" + ], + "type": "object", + "additionalProperties": false + }, + "azureFile": { + "description": "azureFile represents an Azure File Service mount on the host and bind mount to the pod.\nDeprecated: AzureFile is deprecated. All operations for the in-tree azureFile type\nare redirected to the file.csi.azure.com CSI driver.", + "properties": { + "readOnly": { + "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "secretName": { + "description": "secretName is the name of secret that contains Azure Storage Account Name and Key", + "type": "string" + }, + "shareName": { + "description": "shareName is the azure share Name", + "type": "string" + } + }, + "required": [ + "secretName", + "shareName" + ], + "type": "object", + "additionalProperties": false + }, + "cephfs": { + "description": "cephFS represents a Ceph FS mount on the host that shares a pod's lifetime.\nDeprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported.", + "properties": { + "monitors": { + "description": "monitors is Required: Monitors is a collection of Ceph monitors\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "path": { + "description": "path is Optional: Used as the mounted root, rather than the full Ceph tree, default is /", + "type": "string" + }, + "readOnly": { + "description": "readOnly is Optional: Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "type": "boolean" + }, + "secretFile": { + "description": "secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "type": "string" + }, + "secretRef": { + "description": "secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty.\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "user": { + "description": "user is optional: User is the rados user name, default is admin\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", + "type": "string" + } + }, + "required": [ + "monitors" + ], + "type": "object", + "additionalProperties": false + }, + "cinder": { + "description": "cinder represents a cinder volume attached and mounted on kubelets host machine.\nDeprecated: Cinder is deprecated. All operations for the in-tree cinder type\nare redirected to the cinder.csi.openstack.org CSI driver.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", + "properties": { + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", + "type": "string" + }, + "readOnly": { + "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef is optional: points to a secret object containing parameters used to connect\nto OpenStack.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "volumeID": { + "description": "volumeID used to identify the volume in cinder.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", + "type": "string" + } + }, + "required": [ + "volumeID" + ], + "type": "object", + "additionalProperties": false + }, + "configMap": { + "description": "configMap represents a configMap that should populate this volume", + "properties": { + "defaultMode": { + "description": "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "defaultUser": { + "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "items": { + "description": "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + "items": { + "description": "Maps a string key to a path within a volume.", + "properties": { + "key": { + "description": "key is the key to project.", + "type": "string" + }, + "mode": { + "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "key", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "optional specify whether the ConfigMap or its keys must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "csi": { + "description": "csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.", + "properties": { + "driver": { + "description": "driver is the name of the CSI driver that handles this volume.\nConsult with your admin for the correct name as registered in the cluster.", + "type": "string" + }, + "fsType": { + "description": "fsType to mount. Ex. \"ext4\", \"xfs\", \"ntfs\".\nIf not provided, the empty value is passed to the associated CSI driver\nwhich will determine the default filesystem to apply.", + "type": "string" + }, + "nodePublishSecretRef": { + "description": "nodePublishSecretRef is a reference to the secret object containing\nsensitive information to pass to the CSI driver to complete the CSI\nNodePublishVolume and NodeUnpublishVolume calls.\nThis field is optional, and may be empty if no secret is required. If the\nsecret object contains more than one secret, all secret references are passed.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "readOnly": { + "description": "readOnly specifies a read-only configuration for the volume.\nDefaults to false (read/write).", + "type": "boolean" + }, + "volumeAttributes": { + "additionalProperties": { + "type": "string" + }, + "description": "volumeAttributes stores driver-specific properties that are passed to the CSI\ndriver. Consult your driver's documentation for supported values.", + "type": "object" + } + }, + "required": [ + "driver" + ], + "type": "object", + "additionalProperties": false + }, + "downwardAPI": { + "description": "downwardAPI represents downward API about the pod that should populate this volume", + "properties": { + "defaultMode": { + "description": "Optional: mode bits to use on created files by default. Must be a\nOptional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "defaultUser": { + "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "items": { + "description": "Items is a list of downward API volume file", + "items": { + "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field", + "properties": { + "fieldRef": { + "description": "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "mode": { + "description": "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + "type": "string" + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "emptyDir": { + "description": "emptyDir represents a temporary directory that shares a pod's lifetime.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + "properties": { + "medium": { + "description": "medium represents what type of storage medium should back this directory.\nThe default is \"\" which means to use the node's default medium.\nMust be an empty string (default) or Memory.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + "type": "string" + }, + "mode": { + "description": "mode specifies the permission bits for the emptyDir directory, in numeric\nnotation (e.g., 0755, 01777). Must be a value between 0000 and 01777.\nIf not specified, defaults to 0777.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup. If fsGroup is specified, the fsGroup permissions\nwill override the mode specified here.\nThis field has no effect on Windows.\nThis field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.", + "format": "int32", + "type": "integer" + }, + "sizeLimit": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "sizeLimit is the total amount of local storage required for this EmptyDir volume.\nThe size limit is also applicable for memory medium.\nThe maximum usage on memory medium EmptyDir would be the minimum value between\nthe SizeLimit specified here and the sum of memory limits of all containers in a pod.\nThe default is nil which means that the limit is undefined.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + } + }, + "type": "object", + "additionalProperties": false + }, + "ephemeral": { + "description": "ephemeral represents a volume that is handled by a cluster storage driver.\nThe volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,\nand deleted when the pod is removed.\n\nUse this if:\na) the volume is only needed while the pod runs,\nb) features of normal volumes like restoring from snapshot or capacity\n tracking are needed,\nc) the storage driver is specified through a storage class, and\nd) the storage driver supports dynamic volume provisioning through\n a PersistentVolumeClaim (see EphemeralVolumeSource for more\n information on the connection between this volume type\n and PersistentVolumeClaim).\n\nUse PersistentVolumeClaim or one of the vendor-specific\nAPIs for volumes that persist for longer than the lifecycle\nof an individual pod.\n\nUse CSI for light-weight local ephemeral volumes if the CSI driver is meant to\nbe used that way - see the documentation of the driver for\nmore information.\n\nA pod can use both types of ephemeral volumes and\npersistent volumes at the same time.", + "properties": { + "volumeClaimTemplate": { + "description": "Will be used to create a stand-alone PVC to provision the volume.\nThe pod in which this EphemeralVolumeSource is embedded will be the\nowner of the PVC, i.e. the PVC will be deleted together with the\npod. The name of the PVC will be `-` where\n`` is the name from the `PodSpec.Volumes` array\nentry. Pod validation will reject the pod if the concatenated name\nis not valid for a PVC (for example, too long).\n\nAn existing PVC with that name that is not owned by the pod\nwill *not* be used for the pod to avoid using an unrelated\nvolume by mistake. Starting the pod is then blocked until\nthe unrelated PVC is removed. If such a pre-created PVC is\nmeant to be used by the pod, the PVC has to updated with an\nowner reference to the pod once the pod exists. Normally\nthis should not be necessary, but it may be useful when\nmanually reconstructing a broken cluster.\n\nThis field is read-only and no changes will be made by Kubernetes\nto the PVC after it has been created.\n\nRequired, must not be nil.", + "properties": { + "metadata": { + "description": "May contain labels and annotations that will be copied into the PVC\nwhen creating it. No other fields are allowed and will be rejected during\nvalidation.", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "finalizers": { + "items": { + "type": "string" + }, + "type": "array" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "spec": { + "description": "The specification for the PersistentVolumeClaim. The entire content is\ncopied unchanged into the PVC that gets created from this\ntemplate. The same fields as in a PersistentVolumeClaim\nare also valid here.", + "properties": { + "accessModes": { + "description": "accessModes contains the desired access modes the volume should have.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "dataSource": { + "description": "dataSource field can be used to specify either:\n* An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)\n* An existing PVC (PersistentVolumeClaim)\nIf the provisioner or an external controller can support the specified data source,\nit will create a new volume based on the contents of the specified data source.\ndataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be\ncopied to dataSource when dataSourceRef.namespace is not specified.\nIf the namespace is specified, then dataSourceRef will not be copied to dataSource.", + "properties": { + "apiGroup": { + "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", + "type": "string" + }, + "kind": { + "description": "Kind is the type of resource being referenced", + "type": "string" + }, + "name": { + "description": "Name is the name of resource being referenced", + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "dataSourceRef": { + "description": "dataSourceRef specifies the object from which to populate the volume with data, if a non-empty\nvolume is desired. This may be any object from a non-empty API group (non\ncore object) or a PersistentVolumeClaim object.\nWhen this field is specified, volume binding will only succeed if the type of\nthe specified object matches some installed volume populator or dynamic\nprovisioner.\nThis field will replace the functionality of the dataSource field and as such\nif both fields are non-empty, they must have the same value. For backwards\ncompatibility, when namespace isn't specified in dataSourceRef,\nboth fields (dataSource and dataSourceRef) will be set to the same\nvalue automatically if one of them is empty and the other is non-empty.\nWhen namespace is specified in dataSourceRef,\ndataSource isn't set to the same value and must be empty.\nThere are three important differences between dataSource and dataSourceRef:\n* While dataSource only allows two specific types of objects, dataSourceRef\n allows any non-core object, as well as PersistentVolumeClaim objects.\n* While dataSource ignores disallowed values (dropping them), dataSourceRef\n preserves all values, and generates an error if a disallowed value is\n specified.\n* While dataSource only allows local objects, dataSourceRef allows objects\n in any namespaces.\n(Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", + "properties": { + "apiGroup": { + "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", + "type": "string" + }, + "kind": { + "description": "Kind is the type of resource being referenced", + "type": "string" + }, + "name": { + "description": "Name is the name of resource being referenced", + "type": "string" + }, + "namespace": { + "description": "Namespace is the namespace of resource being referenced\nNote that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n(Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "resources": { + "description": "resources represents the minimum resources the volume should have.\nUsers are allowed to specify resource requirements\nthat are lower than previous value but must still be higher than capacity recorded in the\nstatus field of the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources", + "properties": { + "limits": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + }, + "requests": { + "additionalProperties": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "selector": { + "description": "selector is a label query over volumes to consider for binding.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "storageClassName": { + "description": "storageClassName is the name of the StorageClass required by the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1", + "type": "string" + }, + "volumeAttributesClassName": { + "description": "volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.\nIf specified, the CSI driver will create or update the volume with the attributes defined\nin the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,\nit can be changed after the claim is created. An empty string or nil value indicates that no\nVolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,\nthis field can be reset to its previous value (including nil) to cancel the modification.\nIf the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be\nset to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource\nexists.\nMore info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/", + "type": "string" + }, + "volumeMode": { + "description": "volumeMode defines what type of volume is required by the claim.\nValue of Filesystem is implied when not included in claim spec.", + "type": "string" + }, + "volumeName": { + "description": "volumeName is the binding reference to the PersistentVolume backing this claim.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "spec" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "fc": { + "description": "fc represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.", + "properties": { + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "lun": { + "description": "lun is Optional: FC target lun number", + "format": "int32", + "type": "integer" + }, + "readOnly": { + "description": "readOnly is Optional: Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "targetWWNs": { + "description": "targetWWNs is Optional: FC target worldwide names (WWNs)", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "wwids": { + "description": "wwids Optional: FC volume world wide identifiers (wwids)\nEither wwids or combination of targetWWNs and lun must be set, but not both simultaneously.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "flexVolume": { + "description": "flexVolume represents a generic volume resource that is\nprovisioned/attached using an exec based plugin.\nDeprecated: FlexVolume is deprecated. Consider using a CSIDriver instead.", + "properties": { + "driver": { + "description": "driver is the name of the driver to use for this volume.", + "type": "string" + }, + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". The default filesystem depends on FlexVolume script.", + "type": "string" + }, + "options": { + "additionalProperties": { + "type": "string" + }, + "description": "options is Optional: this field holds extra command options if any.", + "type": "object" + }, + "readOnly": { + "description": "readOnly is Optional: defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef is Optional: secretRef is reference to the secret object containing\nsensitive information to pass to the plugin scripts. This may be\nempty if no secret object is specified. If the secret object\ncontains more than one secret, all secrets are passed to the plugin\nscripts.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "required": [ + "driver" + ], + "type": "object", + "additionalProperties": false + }, + "flocker": { + "description": "flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running.\nDeprecated: Flocker is deprecated and the in-tree flocker type is no longer supported.", + "properties": { + "datasetName": { + "description": "datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker\nshould be considered as deprecated", + "type": "string" + }, + "datasetUUID": { + "description": "datasetUUID is the UUID of the dataset. This is unique identifier of a Flocker dataset", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "gcePersistentDisk": { + "description": "gcePersistentDisk represents a GCE Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nDeprecated: GCEPersistentDisk is deprecated. All operations for the in-tree\ngcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "properties": { + "fsType": { + "description": "fsType is filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "type": "string" + }, + "partition": { + "description": "partition is the partition in the volume that you want to mount.\nIf omitted, the default is to mount by volume name.\nExamples: For volume /dev/sda1, you specify the partition as \"1\".\nSimilarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "format": "int32", + "type": "integer" + }, + "pdName": { + "description": "pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", + "type": "boolean" + } + }, + "required": [ + "pdName" + ], + "type": "object", + "additionalProperties": false + }, + "gitRepo": { + "description": "gitRepo represents a git repository at a particular revision.\nDeprecated: GitRepo is deprecated. To provision a container with a git repo, mount an\nEmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir\ninto the Pod's container.", + "properties": { + "directory": { + "description": "directory is the target directory name.\nMust not contain or start with '..'. If '.' is supplied, the volume directory will be the\ngit repository. Otherwise, if specified, the volume will contain the git repository in\nthe subdirectory with the given name.", + "type": "string" + }, + "repository": { + "description": "repository is the URL", + "type": "string" + }, + "revision": { + "description": "revision is the commit hash for the specified revision.", + "type": "string" + } + }, + "required": [ + "repository" + ], + "type": "object", + "additionalProperties": false + }, + "glusterfs": { + "description": "glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.\nDeprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.", + "properties": { + "endpoints": { + "description": "endpoints is the endpoint name that details Glusterfs topology.", + "type": "string" + }, + "path": { + "description": "path is the Glusterfs volume path.\nMore info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the Glusterfs volume to be mounted with read-only permissions.\nDefaults to false.\nMore info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod", + "type": "boolean" + } + }, + "required": [ + "endpoints", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "hostPath": { + "description": "hostPath represents a pre-existing file or directory on the host\nmachine that is directly exposed to the container. This is generally\nused for system agents or other privileged things that are allowed\nto see the host machine. Most containers will NOT need this.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", + "properties": { + "path": { + "description": "path of the directory on the host.\nIf the path is a symlink, it will follow the link to the real path.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", + "type": "string" + }, + "type": { + "description": "type for HostPath Volume\nDefaults to \"\"\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", + "type": "string" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + }, + "image": { + "description": "image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.\nThe volume is resolved at pod startup depending on which PullPolicy value is provided:\n\n- Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\n- Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\n- IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\n\nThe volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.\nA failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.\nThe types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.\nThe OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.\nThe volume will be mounted read-only (ro).\nSub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.\nThe field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.", + "properties": { + "pullPolicy": { + "description": "Policy for pulling OCI objects. Possible values are:\nAlways: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\nNever: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\nIfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.", + "type": "string" + }, + "reference": { + "description": "Required: Image or artifact reference to be used.\nBehaves in the same way as pod.spec.containers[*].image.\nPull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "iscsi": { + "description": "iscsi represents an ISCSI Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi", + "properties": { + "chapAuthDiscovery": { + "description": "chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication", + "type": "boolean" + }, + "chapAuthSession": { + "description": "chapAuthSession defines whether support iSCSI Session CHAP authentication", + "type": "boolean" + }, + "fsType": { + "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi", + "type": "string" + }, + "initiatorName": { + "description": "initiatorName is the custom iSCSI Initiator Name.\nIf initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface\n: will be created for the connection.", + "type": "string" + }, + "iqn": { + "description": "iqn is the target iSCSI Qualified Name.", + "type": "string" + }, + "iscsiInterface": { + "default": "default", + "description": "iscsiInterface is the interface Name that uses an iSCSI transport.\nDefaults to 'default' (tcp).", + "type": "string" + }, + "lun": { + "description": "lun represents iSCSI Target Lun number.", + "format": "int32", + "type": "integer" + }, + "portals": { + "description": "portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port\nis other than default (typically TCP ports 860 and 3260).", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "readOnly": { + "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef is the CHAP Secret for iSCSI target and initiator authentication", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "targetPortal": { + "description": "targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port\nis other than default (typically TCP ports 860 and 3260).", + "type": "string" + } + }, + "required": [ + "iqn", + "lun", + "targetPortal" + ], + "type": "object", + "additionalProperties": false + }, + "name": { + "description": "name of the volume.\nMust be a DNS_LABEL and unique within the pod.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "nfs": { + "description": "nfs represents an NFS mount on the host that shares a pod's lifetime\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", + "properties": { + "path": { + "description": "path that is exported by the NFS server.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the NFS export to be mounted with read-only permissions.\nDefaults to false.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", + "type": "boolean" + }, + "server": { + "description": "server is the hostname or IP address of the NFS server.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", + "type": "string" + } + }, + "required": [ + "path", + "server" + ], + "type": "object", + "additionalProperties": false + }, + "persistentVolumeClaim": { + "description": "persistentVolumeClaimVolumeSource represents a reference to a\nPersistentVolumeClaim in the same namespace.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + "properties": { + "claimName": { + "description": "claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + "type": "string" + }, + "readOnly": { + "description": "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.", + "type": "boolean" + } + }, + "required": [ + "claimName" + ], + "type": "object", + "additionalProperties": false + }, + "photonPersistentDisk": { + "description": "photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine.\nDeprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported.", + "properties": { + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "pdID": { + "description": "pdID is the ID that identifies Photon Controller persistent disk", + "type": "string" + } + }, + "required": [ + "pdID" + ], + "type": "object", + "additionalProperties": false + }, + "portworxVolume": { + "description": "portworxVolume represents a portworx volume attached and mounted on kubelets host machine.\nDeprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type\nare redirected to the pxd.portworx.com CSI driver.", + "properties": { + "fsType": { + "description": "fSType represents the filesystem type to mount\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "readOnly": { + "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "volumeID": { + "description": "volumeID uniquely identifies a Portworx volume", + "type": "string" + } + }, + "required": [ + "volumeID" + ], + "type": "object", + "additionalProperties": false + }, + "projected": { + "description": "projected items for all in one resources secrets, configmaps, and downward API", + "properties": { + "defaultMode": { + "description": "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "defaultUser": { + "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "sources": { + "description": "sources is the list of volume projections. Each entry in this list\nhandles one source.", + "items": { + "description": "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + "properties": { + "clusterTrustBundle": { + "description": "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field\nof ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the\ncombination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written\ninto the pod filesystem. Esoteric PEM features such as inter-block\ncomments and block headers are stripped. Certificates are deduplicated.\nThe ordering of certificates within the file is arbitrary, and Kubelet\nmay change the order over time.", + "properties": { + "labelSelector": { + "description": "Select all ClusterTrustBundles that match this label selector. Only has\neffect if signerName is set. Mutually-exclusive with name. If unset,\ninterpreted as \"match nothing\". If set but empty, interpreted as \"match\neverything\".", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "name": { + "description": "Select a single ClusterTrustBundle by object name. Mutually-exclusive\nwith signerName and labelSelector.", + "type": "string" + }, + "optional": { + "description": "If true, don't block pod startup if the referenced ClusterTrustBundle(s)\naren't available. If using name, then the named ClusterTrustBundle is\nallowed not to exist. If using signerName, then the combination of\nsignerName and labelSelector is allowed to match zero\nClusterTrustBundles.", + "type": "boolean" + }, + "path": { + "description": "Relative path from the volume root to write the bundle.", + "type": "string" + }, + "signerName": { + "description": "Select all ClusterTrustBundles that match this signer name.\nMutually-exclusive with name. The contents of all selected\nClusterTrustBundles will be unified and deduplicated.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + }, + "configMap": { + "description": "configMap information about the configMap data to project", + "properties": { + "items": { + "description": "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + "items": { + "description": "Maps a string key to a path within a volume.", + "properties": { + "key": { + "description": "key is the key to project.", + "type": "string" + }, + "mode": { + "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "key", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "optional specify whether the ConfigMap or its keys must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "downwardAPI": { + "description": "downwardAPI information about the downwardAPI data to project", + "properties": { + "items": { + "description": "Items is a list of DownwardAPIVolume file", + "items": { + "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field", + "properties": { + "fieldRef": { + "description": "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + "properties": { + "apiVersion": { + "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + "type": "string" + }, + "fieldPath": { + "description": "Path of the field to select in the specified API version.", + "type": "string" + } + }, + "required": [ + "fieldPath" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "mode": { + "description": "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + "type": "string" + }, + "resourceFieldRef": { + "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + "properties": { + "containerName": { + "description": "Container name: required for volumes, optional for env vars", + "type": "string" + }, + "divisor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Specifies the output format of the exposed resources, defaults to \"1\"", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "resource": { + "description": "Required: resource to select", + "type": "string" + } + }, + "required": [ + "resource" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "podCertificate": { + "description": "Projects an auto-rotating credential bundle (private key and certificate\nchain) that the pod can use either as a TLS client or server.\n\nKubelet generates a private key and uses it to send a\nPodCertificateRequest to the named signer. Once the signer approves the\nrequest and issues a certificate chain, Kubelet writes the key and\ncertificate chain to the pod filesystem. The pod does not start until\ncertificates have been issued for each podCertificate projected volume\nsource in its spec.\n\nKubelet will begin trying to rotate the certificate at the time indicated\nby the signer using the PodCertificateRequest.Status.BeginRefreshAt\ntimestamp.\n\nKubelet can write a single file, indicated by the credentialBundlePath\nfield, or separate files, indicated by the keyPath and\ncertificateChainPath fields.\n\nThe credential bundle is a single file in PEM format. The first PEM\nentry is the private key (in PKCS#8 format), and the remaining PEM\nentries are the certificate chain issued by the signer (typically,\nsigners will return their certificate chain in leaf-to-root order).\n\nPrefer using the credential bundle format, since your application code\ncan read it atomically. If you use keyPath and certificateChainPath,\nyour application must make two separate file reads. If these coincide\nwith a certificate rotation, it is possible that the private key and leaf\ncertificate you read may not correspond to each other. Your application\nwill need to check for this condition, and re-read until they are\nconsistent.\n\nThe named signer controls chooses the format of the certificate it\nissues; consult the signer implementation's documentation to learn how to\nuse the certificates it issues.", + "properties": { + "certificateChainPath": { + "description": "Write the certificate chain at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + "type": "string" + }, + "credentialBundlePath": { + "description": "Write the credential bundle at this path in the projected volume.\n\nThe credential bundle is a single file that contains multiple PEM blocks.\nThe first PEM block is a PRIVATE KEY block, containing a PKCS#8 private\nkey.\n\nThe remaining blocks are CERTIFICATE blocks, containing the issued\ncertificate chain from the signer (leaf and any intermediates).\n\nUsing credentialBundlePath lets your Pod's application code make a single\natomic read that retrieves a consistent key and certificate chain. If you\nproject them to separate files, your application code will need to\nadditionally check that the leaf certificate was issued to the key.", + "type": "string" + }, + "keyPath": { + "description": "Write the key at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + "type": "string" + }, + "keyType": { + "description": "The type of keypair Kubelet will generate for the pod.\n\nValid values are \"RSA3072\", \"RSA4096\", \"ECDSAP256\", \"ECDSAP384\",\n\"ECDSAP521\", and \"ED25519\".", + "type": "string" + }, + "maxExpirationSeconds": { + "description": "maxExpirationSeconds is the maximum lifetime permitted for the\ncertificate.\n\nKubelet copies this value verbatim into the PodCertificateRequests it\ngenerates for this projection.\n\nIf omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver\nwill reject values shorter than 3600 (1 hour). The maximum allowable\nvalue is 7862400 (91 days).\n\nThe signer implementation is then free to issue a certificate with any\nlifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600\nseconds (1 hour). This constraint is enforced by kube-apiserver.\n`kubernetes.io` signers will never issue certificates with a lifetime\nlonger than 24 hours.", + "format": "int32", + "type": "integer" + }, + "signerName": { + "description": "Kubelet's generated CSRs will be addressed to this signer.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "userAnnotations": { + "additionalProperties": { + "type": "string" + }, + "description": "userAnnotations allow pod authors to pass additional information to\nthe signer implementation. Kubernetes does not restrict or validate this\nmetadata in any way.\n\nThese values are copied verbatim into the `spec.unverifiedUserAnnotations` field of\nthe PodCertificateRequest objects that Kubelet creates.\n\nEntries are subject to the same validation as object metadata annotations,\nwith the addition that all keys must be domain-prefixed. No restrictions\nare placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support. Signers should\ndeny requests that contain keys they do not recognize.", + "type": "object" + } + }, + "required": [ + "keyType", + "signerName" + ], + "type": "object", + "additionalProperties": false + }, + "secret": { + "description": "secret information about the secret data to project", + "properties": { + "items": { + "description": "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + "items": { + "description": "Maps a string key to a path within a volume.", + "properties": { + "key": { + "description": "key is the key to project.", + "type": "string" + }, + "mode": { + "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "key", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "optional field specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "serviceAccountToken": { + "description": "serviceAccountToken is information about the serviceAccountToken data to project", + "properties": { + "audience": { + "description": "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + "type": "string" + }, + "expirationSeconds": { + "description": "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + "format": "int64", + "type": "integer" + }, + "path": { + "description": "path is the path relative to the mount point of the file to project the\ntoken into.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "path" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "quobyte": { + "description": "quobyte represents a Quobyte mount on the host that shares a pod's lifetime.\nDeprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported.", + "properties": { + "group": { + "description": "group to map volume access to\nDefault is no group", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the Quobyte volume to be mounted with read-only permissions.\nDefaults to false.", + "type": "boolean" + }, + "registry": { + "description": "registry represents a single or multiple Quobyte Registry services\nspecified as a string as host:port pair (multiple entries are separated with commas)\nwhich acts as the central registry for volumes", + "type": "string" + }, + "tenant": { + "description": "tenant owning the given Quobyte volume in the Backend\nUsed with dynamically provisioned Quobyte volumes, value is set by the plugin", + "type": "string" + }, + "user": { + "description": "user to map volume access to\nDefaults to serivceaccount user", + "type": "string" + }, + "volume": { + "description": "volume is a string that references an already created Quobyte volume by name.", + "type": "string" + } + }, + "required": [ + "registry", + "volume" + ], + "type": "object", + "additionalProperties": false + }, + "rbd": { + "description": "rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.\nDeprecated: RBD is deprecated and the in-tree rbd type is no longer supported.", + "properties": { + "fsType": { + "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#rbd", + "type": "string" + }, + "image": { + "description": "image is the rados image name.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "string" + }, + "keyring": { + "default": "/etc/ceph/keyring", + "description": "keyring is the path to key ring for RBDUser.\nDefault is /etc/ceph/keyring.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "string" + }, + "monitors": { + "description": "monitors is a collection of Ceph monitors.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "pool": { + "default": "rbd", + "description": "pool is the rados pool name.\nDefault is rbd.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "string" + }, + "readOnly": { + "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef is name of the authentication secret for RBDUser. If provided\noverrides keyring.\nDefault is nil.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "user": { + "default": "admin", + "description": "user is the rados user name.\nDefault is admin.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", + "type": "string" + } + }, + "required": [ + "image", + "monitors" + ], + "type": "object", + "additionalProperties": false + }, + "scaleIO": { + "description": "scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.\nDeprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported.", + "properties": { + "fsType": { + "default": "xfs", + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\".\nDefault is \"xfs\".", + "type": "string" + }, + "gateway": { + "description": "gateway is the host address of the ScaleIO API Gateway.", + "type": "string" + }, + "protectionDomain": { + "description": "protectionDomain is the name of the ScaleIO Protection Domain for the configured storage.", + "type": "string" + }, + "readOnly": { + "description": "readOnly Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef references to the secret for ScaleIO user and other\nsensitive information. If this is not provided, Login operation will fail.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "sslEnabled": { + "description": "sslEnabled Flag enable/disable SSL communication with Gateway, default false", + "type": "boolean" + }, + "storageMode": { + "default": "ThinProvisioned", + "description": "storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.\nDefault is ThinProvisioned.", + "type": "string" + }, + "storagePool": { + "description": "storagePool is the ScaleIO Storage Pool associated with the protection domain.", + "type": "string" + }, + "system": { + "description": "system is the name of the storage system as configured in ScaleIO.", + "type": "string" + }, + "volumeName": { + "description": "volumeName is the name of a volume already created in the ScaleIO system\nthat is associated with this volume source.", + "type": "string" + } + }, + "required": [ + "gateway", + "secretRef", + "system" + ], + "type": "object", + "additionalProperties": false + }, + "secret": { + "description": "secret represents a secret that should populate this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + "properties": { + "defaultMode": { + "description": "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "defaultUser": { + "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + }, + "items": { + "description": "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + "items": { + "description": "Maps a string key to a path within a volume.", + "properties": { + "key": { + "description": "key is the key to project.", + "type": "string" + }, + "mode": { + "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + "format": "int32", + "type": "integer" + }, + "path": { + "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + "type": "string" + }, + "user": { + "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "key", + "path" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "optional": { + "description": "optional field specify whether the Secret or its keys must be defined", + "type": "boolean" + }, + "secretName": { + "description": "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "storageos": { + "description": "storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.\nDeprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported.", + "properties": { + "fsType": { + "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "readOnly": { + "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", + "type": "boolean" + }, + "secretRef": { + "description": "secretRef specifies the secret to use for obtaining the StorageOS API\ncredentials. If not specified, default values will be attempted.", + "properties": { + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "volumeName": { + "description": "volumeName is the human-readable name of the StorageOS volume. Volume\nnames are only unique within a namespace.", + "type": "string" + }, + "volumeNamespace": { + "description": "volumeNamespace specifies the scope of the volume within StorageOS. If no\nnamespace is specified then the Pod's namespace will be used. This allows the\nKubernetes name scoping to be mirrored within StorageOS for tighter integration.\nSet VolumeName to any name to override the default behaviour.\nSet to \"default\" if you are not using namespaces within StorageOS.\nNamespaces that do not pre-exist within StorageOS will be created.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "vsphereVolume": { + "description": "vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine.\nDeprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type\nare redirected to the csi.vsphere.vmware.com CSI driver.", + "properties": { + "fsType": { + "description": "fsType is filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", + "type": "string" + }, + "storagePolicyID": { + "description": "storagePolicyID is the storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName.", + "type": "string" + }, + "storagePolicyName": { + "description": "storagePolicyName is the storage Policy Based Management (SPBM) profile name.", + "type": "string" + }, + "volumePath": { + "description": "volumePath is the path that identifies vSphere volume vmdk", + "type": "string" + } + }, + "required": [ + "volumePath" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + } + }, + "required": [ + "containers" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "workerTemplate" + ], + "type": "object", + "additionalProperties": false + }, + "networkConfig": { + "description": "networkConfig defines the network configuration of the group", + "properties": { + "subdomainPolicy": { + "description": "subdomainPolicy determines the policy that will be used when creating\nthe headless service, defaults to shared", + "enum": [ + "Shared", + "UniquePerReplica" + ], + "type": "string" + } + }, + "required": [ + "subdomainPolicy" + ], + "type": "object", + "additionalProperties": false + }, + "replicas": { + "default": 1, + "description": "replicas is the number of leader-workers groups. A scale subresource is available to enable HPA. The\nselector for HPA will be that of the leader pod, and so practically HPA will be looking up the\nleader pod metrics. Note that the leader pod could aggregate metrics from\nthe rest of the group and expose them as a summary custom metric representing the whole\ngroup.\nOn scale down, the leader pod as well as the workers statefulset will be deleted.\nDefault to 1.", + "format": "int32", + "maximum": 1000000, + "minimum": 0, + "type": "integer" + }, + "rolloutStrategy": { + "description": "rolloutStrategy defines the strategy that will be applied to update replicas\nwhen a revision is made to the leaderWorkerTemplate.", + "properties": { + "rollingUpdateConfiguration": { + "description": "rollingUpdateConfiguration defines the parameters to be used when type is RollingUpdateStrategyType.", + "properties": { + "maxSurge": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "default": 0, + "description": "maxSurge is the maximum number of replicas that can be scheduled above the original number of\nreplicas.\nValue can be an absolute number (ex: 5) or a percentage of total replicas at\nthe start of the update (ex: 10%).\nAbsolute number is calculated from percentage by rounding up.\nBy default, a value of 0 is used.\nExample: when this is set to 30%, the new replicas can be scaled up by 30%\nimmediately when the rolling update starts. Once old replicas have been deleted,\nnew replicas can be scaled up further, ensuring that total number of replicas running\nat any time during the update is at most 130% of original replicas.\nWhen rolling update completes, replicas will fall back to the original replicas.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "maxUnavailable": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "default": 1, + "description": "maxUnavailable is the maximum number of replicas that can be unavailable during the update.\nValue can be an absolute number (ex: 5) or a percentage of total replicas at the start of update (ex: 10%).\nAbsolute number is calculated from percentage by rounding down.\nThis can not be 0 if MaxSurge is 0.\nBy default, a fixed value of 1 is used.\nExample: when this is set to 30%, the old replicas can be scaled down by 30%\nimmediately when the rolling update starts. Once new replicas are ready, old replicas\ncan be scaled down further, followed by scaling up the new replicas, ensuring\nthat at least 70% of original number of replicas are available at all times\nduring the update.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "partition": { + "default": 0, + "description": "partition indicates the ordinal at which the lws should be partitioned for updates.\nDuring a rolling update, all the groups from ordinal Partition to Replicas-1 will be updated.\nThe groups from 0 to Partition-1 will not be updated.\nThis is helpful in incremental rollout strategies like canary deployments\nor interactive rollout strategies for multiple replicas like xPyD deployments.\nOnce partition field and maxSurge field both set, the bursted replicas will keep remaining\nuntil the rolling update is completely done and the partition field is reset to 0.\nThis is as expected to reduce the reconciling complexity.\nThe default value is 0.", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "type": { + "default": "RollingUpdate", + "description": "type defines the rollout strategy, it can only be “RollingUpdate” for now.", + "enum": [ + "RollingUpdate" + ], + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "additionalProperties": false + }, + "scheduling": { + "description": "scheduling defines Workload-Aware Scheduling for this LeaderWorkerSet.\nThis field is immutable.", + "properties": { + "disruptionMode": { + "description": "disruptionMode defines how replica groups may be disrupted.", + "properties": { + "all": { + "description": "all specifies that all child groups must be disrupted together.", + "type": "object" + }, + "single": { + "description": "single specifies that child groups can be disrupted independently from\neach other.", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "replica": { + "description": "replica defines scheduling for each replica.", + "properties": { + "disruptionMode": { + "description": "disruptionMode defines how the leader and worker groups may be disrupted.", + "properties": { + "all": { + "description": "all specifies that all child groups must be disrupted together.", + "type": "object" + }, + "single": { + "description": "single specifies that child groups can be disrupted independently from\neach other.", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "leader": { + "description": "leader defines scheduling for the leader PodGroup.", + "properties": { + "disruptionMode": { + "description": "disruptionMode defines how leader pods may be disrupted.", + "properties": { + "all": { + "description": "all specifies that all pods in the group must be disrupted together.", + "type": "object" + }, + "single": { + "description": "single specifies that pods can be disrupted independently from each other.", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "resourceClaims": { + "description": "resourceClaims lists dynamic resource claims shared by leader pods.", + "items": { + "description": "WorkloadPodGroupResourceClaim references a dynamic resource claim\nthat is shared across pods in the group.\n", + "properties": { + "name": { + "description": "name uniquely identifies this resource claim inside the group.\nThis field is required. It must be a DNS_LABEL.", + "type": "string" + }, + "resourceClaimName": { + "description": "resourceClaimName is the name of a ResourceClaim object in the same\nnamespace.\nThis field is optional. If it is not specified, no resource claim\nis used. If set, it must be a DNS subdomain.", + "type": "string" + }, + "resourceClaimTemplateName": { + "description": "resourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace.\nThis field is optional. If it is not specified, no resource claim\ntemplate is used. If set, it must be a DNS subdomain.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "maxItems": 4, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "schedulingConstraints": { + "description": "schedulingConstraints defines placement constraints for the leader PodGroup.", + "properties": { + "topology": { + "description": "topology specifies desired topological placements for all pods\nwithin the pod group.\nIf unset, no topology placement is requested.", + "items": { + "description": "TopologyConstraint defines a topology constraint for a PodGroup.", + "properties": { + "key": { + "description": "key specifies the key of the node label representing the topology domain.\nAll pods within the PodGroup must be colocated within the same domain instance.\nDifferent PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.\nExamples: \"topology.kubernetes.io/rack\"", + "type": "string" + } + }, + "required": [ + "key" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "schedulingPolicy": { + "description": "schedulingPolicy defines scheduling for the leader PodGroup.", + "properties": { + "basic": { + "description": "basic specifies that standard, pod-by-pod Kubernetes scheduling\nbehavior should be used.", + "type": "object" + }, + "gang": { + "description": "gang specifies all-or-nothing scheduling semantics.", + "properties": { + "minCount": { + "description": "minCount is the minimum number of pods that must be scheduled\nat the same time for the scheduler to admit the entire group.\nThis field is optional. If it is not specified, the controller\nshould inject a context-specific sane default (e.g.,\nparallelism for a Job).\nIf set, it must be a positive integer.", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "schedulingConstraints": { + "description": "schedulingConstraints defines placement constraints for a replica.", + "properties": { + "topology": { + "description": "topology specifies desired topological placements for all child groups\nwithin the composite group.\nIf unset, no topology placement is requested.", + "items": { + "description": "TopologyConstraint defines a topology constraint for a PodGroup.", + "properties": { + "key": { + "description": "key specifies the key of the node label representing the topology domain.\nAll pods within the PodGroup must be colocated within the same domain instance.\nDifferent PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.\nExamples: \"topology.kubernetes.io/rack\"", + "type": "string" + } + }, + "required": [ + "key" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "schedulingPolicy": { + "description": "schedulingPolicy defines scheduling for a leader and its workers.", + "properties": { + "basic": { + "description": "basic specifies that the child groups of this composite group should be\nscheduled independently.", + "type": "object" + }, + "gang": { + "description": "gang specifies that the child groups of this composite group should be\nscheduled using all-or-nothing semantics.", + "properties": { + "minGroupCount": { + "description": "minGroupCount is the minimum number of child groups that must be\nschedulable at the same time for the scheduler to admit the entire\ncomposite group.\nThis field is optional. If it is not specified, the controller\nshould inject a context-specific sane default (e.g., the number of\nchild groups).\nIf set, it must be a positive integer.", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "worker": { + "description": "worker defines scheduling for the worker PodGroup.", + "properties": { + "disruptionMode": { + "description": "disruptionMode defines how worker pods may be disrupted.", + "properties": { + "all": { + "description": "all specifies that all pods in the group must be disrupted together.", + "type": "object" + }, + "single": { + "description": "single specifies that pods can be disrupted independently from each other.", + "type": "object" + } + }, + "type": "object", + "additionalProperties": false + }, + "resourceClaims": { + "description": "resourceClaims lists dynamic resource claims shared by worker pods.", + "items": { + "description": "WorkloadPodGroupResourceClaim references a dynamic resource claim\nthat is shared across pods in the group.\n", + "properties": { + "name": { + "description": "name uniquely identifies this resource claim inside the group.\nThis field is required. It must be a DNS_LABEL.", + "type": "string" + }, + "resourceClaimName": { + "description": "resourceClaimName is the name of a ResourceClaim object in the same\nnamespace.\nThis field is optional. If it is not specified, no resource claim\nis used. If set, it must be a DNS subdomain.", + "type": "string" + }, + "resourceClaimTemplateName": { + "description": "resourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace.\nThis field is optional. If it is not specified, no resource claim\ntemplate is used. If set, it must be a DNS subdomain.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "maxItems": 4, + "type": "array", + "x-kubernetes-list-map-keys": [ + "name" + ], + "x-kubernetes-list-type": "map" + }, + "schedulingConstraints": { + "description": "schedulingConstraints defines placement constraints for the worker PodGroup.", + "properties": { + "topology": { + "description": "topology specifies desired topological placements for all pods\nwithin the pod group.\nIf unset, no topology placement is requested.", + "items": { + "description": "TopologyConstraint defines a topology constraint for a PodGroup.", + "properties": { + "key": { + "description": "key specifies the key of the node label representing the topology domain.\nAll pods within the PodGroup must be colocated within the same domain instance.\nDifferent PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.\nExamples: \"topology.kubernetes.io/rack\"", + "type": "string" + } + }, + "required": [ + "key" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "schedulingPolicy": { + "description": "schedulingPolicy defines scheduling for the worker PodGroup.", + "properties": { + "basic": { + "description": "basic specifies that standard, pod-by-pod Kubernetes scheduling\nbehavior should be used.", + "type": "object" + }, + "gang": { + "description": "gang specifies all-or-nothing scheduling semantics.", + "properties": { + "minCount": { + "description": "minCount is the minimum number of pods that must be scheduled\nat the same time for the scheduler to admit the entire group.\nThis field is optional. If it is not specified, the controller\nshould inject a context-specific sane default (e.g.,\nparallelism for a Job).\nIf set, it must be a positive integer.", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "schedulingConstraints": { + "description": "schedulingConstraints defines placement constraints for all replicas.", + "properties": { + "topology": { + "description": "topology specifies desired topological placements for all child groups\nwithin the composite group.\nIf unset, no topology placement is requested.", + "items": { + "description": "TopologyConstraint defines a topology constraint for a PodGroup.", + "properties": { + "key": { + "description": "key specifies the key of the node label representing the topology domain.\nAll pods within the PodGroup must be colocated within the same domain instance.\nDifferent PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.\nExamples: \"topology.kubernetes.io/rack\"", + "type": "string" + } + }, + "required": [ + "key" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "type": "object", + "additionalProperties": false + }, + "schedulingPolicy": { + "description": "schedulingPolicy defines scheduling for all replicas.", + "properties": { + "basic": { + "description": "basic specifies that the child groups of this composite group should be\nscheduled independently.", + "type": "object" + }, + "gang": { + "description": "gang specifies that the child groups of this composite group should be\nscheduled using all-or-nothing semantics.", + "properties": { + "minGroupCount": { + "description": "minGroupCount is the minimum number of child groups that must be\nschedulable at the same time for the scheduler to admit the entire\ncomposite group.\nThis field is optional. If it is not specified, the controller\nshould inject a context-specific sane default (e.g., the number of\nchild groups).\nIf set, it must be a positive integer.", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "startupPolicy": { + "default": "LeaderCreated", + "description": "startupPolicy determines the startup policy for the worker statefulset.", + "enum": [ + "LeaderCreated", + "LeaderReady" + ], + "type": "string" + } + }, + "required": [ + "leaderWorkerTemplate" + ], + "type": "object", + "additionalProperties": false + }, + "status": { + "description": "status represents the current status of LeaderWorkerSet.", + "properties": { + "conditions": { + "description": "conditions track the condition of the leaderworkerset.", + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "type" + ], + "x-kubernetes-list-type": "map" + }, + "hpaPodSelector": { + "description": "hpaPodSelector for pods that belong to the LeaderWorkerSet object, this is\nneeded for HPA to know what pods belong to the LeaderWorkerSet object. Here\nwe only select the leader pods.", + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration is the most recent generation observed for this LeaderWorkerSet.", + "format": "int64", + "type": "integer" + }, + "readyReplicas": { + "description": "readyReplicas track the number of groups that are in ready state (updated or not).", + "format": "int32", + "type": "integer" + }, + "replicas": { + "description": "replicas track the total number of groups that have been created (updated or not, ready or not)", + "format": "int32", + "type": "integer" + }, + "updatedReplicas": { + "description": "updatedReplicas track the number of groups that have been updated (ready or not).", + "format": "int32", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false, + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { + "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", + "type": "object" + }, + "creationTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "deletionGracePeriodSeconds": { + "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", + "format": "int64", + "type": "integer" + }, + "deletionTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "finalizers": { + "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set", + "x-kubernetes-patch-strategy": "merge" + }, + "generateName": { + "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", + "type": "string" + }, + "generation": { + "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", + "format": "int64", + "type": "integer" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", + "type": "object" + }, + "managedFields": { + "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", + "type": "string" + }, + "ownerReferences": { + "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "uid" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "uid", + "x-kubernetes-patch-strategy": "merge" + }, + "resourceVersion": { + "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", + "type": "string" + }, + "selfLink": { + "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", + "type": "string" + }, + "uid": { + "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { + "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", + "format": "date-time", + "type": "string" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { + "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", + "type": "string" + }, + "fieldsType": { + "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", + "type": "string" + }, + "fieldsV1": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", + "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." + }, + "manager": { + "description": "Manager is an identifier of the workflow managing these fields.", + "type": "string" + }, + "operation": { + "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", + "type": "string" + }, + "subresource": { + "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", + "type": "string" + }, + "time": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { + "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", + "type": "object" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { + "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", + "properties": { + "apiVersion": { + "description": "API version of the referent.", + "type": "string" + }, + "blockOwnerDeletion": { + "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", + "type": "boolean" + }, + "controller": { + "description": "If true, this reference points to the managing controller.", + "type": "boolean" + }, + "kind": { + "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "name": { + "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "uid": { + "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "required": [ + "apiVersion", + "kind", + "name", + "uid" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ] +} diff --git a/schema/helm/crds/monitoring.coreos.com/servicemonitor_v1.json b/schema/helm/crds/monitoring.coreos.com/servicemonitor_v1.json new file mode 100644 index 0000000..21f847e --- /dev/null +++ b/schema/helm/crds/monitoring.coreos.com/servicemonitor_v1.json @@ -0,0 +1,1441 @@ +{ + "description": "The `ServiceMonitor` custom resource definition (CRD) defines how `Prometheus` and `PrometheusAgent` can scrape metrics from a group of services.\nAmong other things, it allows to specify:\n* The services to scrape via label selectors.\n* The container ports to scrape.\n* Authentication credentials to use.\n* Target and metric relabeling.\n\n`Prometheus` and `PrometheusAgent` objects select `ServiceMonitor` objects using label and namespace selectors.", + "properties": { + "apiVersion": { + "type": "string", + "enum": [ + "monitoring.coreos.com/v1" + ] + }, + "kind": { + "type": "string", + "enum": [ + "ServiceMonitor" + ] + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" + }, + "spec": { + "description": "spec defines the specification of desired Service selection for target discovery by\nPrometheus.", + "properties": { + "attachMetadata": { + "description": "attachMetadata defines additional metadata which is added to the\ndiscovered targets.\n\nIt requires Prometheus >= v2.37.0.", + "properties": { + "node": { + "description": "node when set to true, Prometheus attaches node metadata to the discovered\ntargets.\n\nThe Prometheus service account must have the `list` and `watch`\npermissions on the `Nodes` objects.\n\nNode metadata labels are not automatically added to scraped metrics. They are\nexposed as `__meta_kubernetes_node_*` labels and can be copied to timeseries\nwith relabeling configuration.", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + }, + "bodySizeLimit": { + "description": "bodySizeLimit when defined, bodySizeLimit specifies a job level limit on the size\nof uncompressed response body that will be accepted by Prometheus.\n\nIt requires Prometheus >= v2.28.0.", + "pattern": "(^0|([0-9]*[.])?[0-9]+((K|M|G|T|E|P)i?)?B)$", + "type": "string" + }, + "convertClassicHistogramsToNHCB": { + "description": "convertClassicHistogramsToNHCB defines whether to convert all scraped classic histograms into a native histogram with custom buckets.\nIt requires Prometheus >= v3.0.0.", + "type": "boolean" + }, + "endpoints": { + "description": "endpoints defines the list of endpoints part of this ServiceMonitor.\nDefines how to scrape metrics from Kubernetes [Endpoints](https://kubernetes.io/docs/concepts/services-networking/service/#endpoints) objects.\nIn most cases, an Endpoints object is backed by a Kubernetes [Service](https://kubernetes.io/docs/concepts/services-networking/service/) object with the same name and labels.", + "items": { + "description": "Endpoint defines an endpoint serving Prometheus metrics to be scraped by\nPrometheus.", + "properties": { + "authorization": { + "description": "authorization configures the Authorization header credentials used by\nthe client.\n\nCannot be set at the same time as `basicAuth`, `bearerTokenSecret` or `oauth2`.", + "properties": { + "credentials": { + "description": "credentials defines a key of a Secret in the namespace that contains the credentials for authentication.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "type": { + "description": "type defines the authentication type. The value is case-insensitive.\n\n\"Basic\" is not a supported value.\n\nDefault: \"Bearer\"", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "basicAuth": { + "description": "basicAuth defines the Basic Authentication credentials used by the\nclient.\n\nCannot be set at the same time as `authorization`, `bearerTokenSecret` or `oauth2`.", + "properties": { + "password": { + "description": "password defines a key of a Secret containing the password for\nauthentication.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "username": { + "description": "username defines a key of a Secret containing the username for\nauthentication.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "bearerTokenFile": { + "description": "bearerTokenFile defines the file to read bearer token for scraping the target.\n\nDeprecated: use `authorization` instead.", + "type": "string" + }, + "bearerTokenSecret": { + "description": "bearerTokenSecret defines a key of a Secret containing the bearer token\nused by the client for authentication. The secret needs to be in the\nsame namespace as the custom resource and readable by the Prometheus\nOperator.\n\nCannot be set at the same time as `authorization`, `basicAuth` or `oauth2`.\n\nDeprecated: use `authorization` instead.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "enableHttp2": { + "description": "enableHttp2 can be used to disable HTTP2.", + "type": "boolean" + }, + "filterRunning": { + "description": "filterRunning when true, the pods which are not running (e.g. either in Failed or\nSucceeded state) are dropped during the target discovery.\n\nIf unset, the filtering is enabled.\n\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase", + "type": "boolean" + }, + "followRedirects": { + "description": "followRedirects defines whether the client should follow HTTP 3xx\nredirects.", + "type": "boolean" + }, + "honorLabels": { + "description": "honorLabels defines when true the metric's labels when they collide\nwith the target's labels.", + "type": "boolean" + }, + "honorTimestamps": { + "description": "honorTimestamps defines whether Prometheus preserves the timestamps\nwhen exposed by the target.", + "type": "boolean" + }, + "interval": { + "description": "interval at which Prometheus scrapes the metrics from the target.\n\nIf empty, Prometheus uses the global scrape interval.", + "pattern": "^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$", + "type": "string" + }, + "metricRelabelings": { + "description": "metricRelabelings defines the relabeling rules to apply to the\nsamples before ingestion.", + "items": { + "description": "RelabelConfig allows dynamic rewriting of the label set for targets, alerts,\nscraped samples and remote write samples.\n\nMore info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config", + "properties": { + "action": { + "default": "replace", + "description": "action to perform based on the regex matching.\n\n`Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0.\n`DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0.\n\nDefault: \"Replace\"", + "enum": [ + "replace", + "Replace", + "keep", + "Keep", + "drop", + "Drop", + "hashmod", + "HashMod", + "labelmap", + "LabelMap", + "labeldrop", + "LabelDrop", + "labelkeep", + "LabelKeep", + "lowercase", + "Lowercase", + "uppercase", + "Uppercase", + "keepequal", + "KeepEqual", + "dropequal", + "DropEqual" + ], + "type": "string" + }, + "modulus": { + "description": "modulus to take of the hash of the source label values.\n\nOnly applicable when the action is `HashMod`.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "regex": { + "description": "regex defines the regular expression against which the extracted value is matched.", + "type": "string" + }, + "replacement": { + "description": "replacement value against which a Replace action is performed if the\nregular expression matches.\n\nRegex capture groups are available.", + "type": "string" + }, + "separator": { + "description": "separator defines the string between concatenated SourceLabels.", + "type": "string" + }, + "sourceLabels": { + "description": "sourceLabels defines the source labels select values from existing labels. Their content is\nconcatenated using the configured Separator and matched against the\nconfigured regular expression.", + "items": { + "description": "LabelName is a valid Prometheus label name.\nFor Prometheus 3.x, a label name is valid if it contains UTF-8 characters.\nFor Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores.", + "type": "string" + }, + "type": "array" + }, + "targetLabel": { + "description": "targetLabel defines the label to which the resulting string is written in a replacement.\n\nIt is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`,\n`KeepEqual` and `DropEqual` actions.\n\nRegex capture groups are available.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "noProxy": { + "description": "noProxy defines a comma-separated string that can contain IPs, CIDR notation, domain names\nthat should be excluded from proxying. IP and domain names can\ncontain port numbers.\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", + "type": "string" + }, + "oauth2": { + "description": "oauth2 defines the OAuth2 settings used by the client.\n\nIt requires Prometheus >= 2.27.0.\n\nCannot be set at the same time as `authorization`, `basicAuth` or `bearerTokenSecret`.", + "properties": { + "clientId": { + "description": "clientId defines a key of a Secret or ConfigMap containing the\nOAuth2 client's ID.", + "properties": { + "configMap": { + "description": "configMap defines the ConfigMap containing data to use for the targets.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secret": { + "description": "secret defines the Secret containing data to use for the targets.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "clientSecret": { + "description": "clientSecret defines a key of a Secret containing the OAuth2\nclient's secret.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "endpointParams": { + "additionalProperties": { + "type": "string" + }, + "description": "endpointParams configures the HTTP parameters to append to the token\nURL.", + "type": "object" + }, + "noProxy": { + "description": "noProxy defines a comma-separated string that can contain IPs, CIDR notation, domain names\nthat should be excluded from proxying. IP and domain names can\ncontain port numbers.\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", + "type": "string" + }, + "proxyConnectHeader": { + "additionalProperties": { + "items": { + "description": "SecretKeySelector selects a key of a Secret.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "type": "array" + }, + "description": "proxyConnectHeader optionally specifies headers to send to\nproxies during CONNECT requests.\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", + "type": "object", + "x-kubernetes-map-type": "atomic" + }, + "proxyFromEnvironment": { + "description": "proxyFromEnvironment defines whether to use the proxy configuration defined by environment variables (HTTP_PROXY, HTTPS_PROXY, and NO_PROXY).\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", + "type": "boolean" + }, + "proxyUrl": { + "description": "proxyUrl defines the HTTP proxy server to use.", + "pattern": "^(http|https|socks5)://.+$", + "type": "string" + }, + "scopes": { + "description": "scopes defines the OAuth2 scopes used for the token request.", + "items": { + "type": "string" + }, + "type": "array" + }, + "tlsConfig": { + "description": "tlsConfig defines the TLS configuration to use when connecting to the OAuth2 server.\nIt requires Prometheus >= v2.43.0.", + "properties": { + "ca": { + "description": "ca defines the Certificate authority used when verifying server certificates.", + "properties": { + "configMap": { + "description": "configMap defines the ConfigMap containing data to use for the targets.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secret": { + "description": "secret defines the Secret containing data to use for the targets.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "cert": { + "description": "cert defines the Client certificate to present when doing client-authentication.", + "properties": { + "configMap": { + "description": "configMap defines the ConfigMap containing data to use for the targets.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secret": { + "description": "secret defines the Secret containing data to use for the targets.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "insecureSkipVerify": { + "description": "insecureSkipVerify defines how to disable target certificate validation.", + "type": "boolean" + }, + "keySecret": { + "description": "keySecret defines the Secret containing the client key file for the targets.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "maxVersion": { + "description": "maxVersion defines the maximum acceptable TLS version.\n\nIt requires Prometheus >= v2.41.0 or Thanos >= v0.31.0.", + "enum": [ + "TLS10", + "TLS11", + "TLS12", + "TLS13" + ], + "type": "string" + }, + "minVersion": { + "description": "minVersion defines the minimum acceptable TLS version.\n\nIt requires Prometheus >= v2.35.0 or Thanos >= v0.28.0.", + "enum": [ + "TLS10", + "TLS11", + "TLS12", + "TLS13" + ], + "type": "string" + }, + "serverName": { + "description": "serverName is used to verify the hostname for the targets.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "tokenUrl": { + "description": "tokenUrl defines the URL to fetch the token from.", + "pattern": "^(http|https)://.+$", + "type": "string" + } + }, + "required": [ + "clientId", + "clientSecret", + "tokenUrl" + ], + "type": "object", + "additionalProperties": false + }, + "params": { + "additionalProperties": { + "items": { + "type": "string" + }, + "type": "array" + }, + "description": "params define optional HTTP URL parameters.", + "type": "object" + }, + "path": { + "description": "path defines the HTTP path from which to scrape for metrics.\n\nIf empty, Prometheus uses the default value (e.g. `/metrics`).", + "type": "string" + }, + "port": { + "description": "port defines the name of the Service port which this endpoint refers to\n(e.g. `.spec.ports[].name`).\n\nIt takes precedence over `targetPort`.", + "type": "string" + }, + "proxyConnectHeader": { + "additionalProperties": { + "items": { + "description": "SecretKeySelector selects a key of a Secret.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "type": "array" + }, + "description": "proxyConnectHeader optionally specifies headers to send to\nproxies during CONNECT requests.\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", + "type": "object", + "x-kubernetes-map-type": "atomic" + }, + "proxyFromEnvironment": { + "description": "proxyFromEnvironment defines whether to use the proxy configuration defined by environment variables (HTTP_PROXY, HTTPS_PROXY, and NO_PROXY).\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", + "type": "boolean" + }, + "proxyUrl": { + "description": "proxyUrl defines the HTTP proxy server to use.", + "pattern": "^(http|https|socks5)://.+$", + "type": "string" + }, + "relabelings": { + "description": "relabelings defines the relabeling rules to apply the target's\nmetadata labels.\n\nThe Operator automatically adds relabelings for a few standard Kubernetes fields.\n\nThe original scrape job's name is available via the `__tmp_prometheus_job_name` label.\n\nMore info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config", + "items": { + "description": "RelabelConfig allows dynamic rewriting of the label set for targets, alerts,\nscraped samples and remote write samples.\n\nMore info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config", + "properties": { + "action": { + "default": "replace", + "description": "action to perform based on the regex matching.\n\n`Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0.\n`DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0.\n\nDefault: \"Replace\"", + "enum": [ + "replace", + "Replace", + "keep", + "Keep", + "drop", + "Drop", + "hashmod", + "HashMod", + "labelmap", + "LabelMap", + "labeldrop", + "LabelDrop", + "labelkeep", + "LabelKeep", + "lowercase", + "Lowercase", + "uppercase", + "Uppercase", + "keepequal", + "KeepEqual", + "dropequal", + "DropEqual" + ], + "type": "string" + }, + "modulus": { + "description": "modulus to take of the hash of the source label values.\n\nOnly applicable when the action is `HashMod`.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "regex": { + "description": "regex defines the regular expression against which the extracted value is matched.", + "type": "string" + }, + "replacement": { + "description": "replacement value against which a Replace action is performed if the\nregular expression matches.\n\nRegex capture groups are available.", + "type": "string" + }, + "separator": { + "description": "separator defines the string between concatenated SourceLabels.", + "type": "string" + }, + "sourceLabels": { + "description": "sourceLabels defines the source labels select values from existing labels. Their content is\nconcatenated using the configured Separator and matched against the\nconfigured regular expression.", + "items": { + "description": "LabelName is a valid Prometheus label name.\nFor Prometheus 3.x, a label name is valid if it contains UTF-8 characters.\nFor Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores.", + "type": "string" + }, + "type": "array" + }, + "targetLabel": { + "description": "targetLabel defines the label to which the resulting string is written in a replacement.\n\nIt is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`,\n`KeepEqual` and `DropEqual` actions.\n\nRegex capture groups are available.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "scheme": { + "description": "scheme defines the HTTP scheme to use when scraping the metrics.", + "enum": [ + "http", + "https", + "HTTP", + "HTTPS" + ], + "type": "string" + }, + "scrapeTimeout": { + "description": "scrapeTimeout defines the timeout after which Prometheus considers the scrape to be failed.\n\nIf empty, Prometheus uses the global scrape timeout unless it is less\nthan the target's scrape interval value in which the latter is used.\nThe value cannot be greater than the scrape interval otherwise the operator will reject the resource.", + "pattern": "^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$", + "type": "string" + }, + "targetPort": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "targetPort defines the name or number of a container port on Pods selected\nby the Service.\nIf a name, it matches against `.spec.containers[].ports[].name` of the Pods.\nIf a number, it matches against `.spec.containers[].ports[].containerPort` of the Pods.", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "tlsConfig": { + "description": "tlsConfig defines TLS configuration used by the client.", + "properties": { + "ca": { + "description": "ca defines the Certificate authority used when verifying server certificates.", + "properties": { + "configMap": { + "description": "configMap defines the ConfigMap containing data to use for the targets.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secret": { + "description": "secret defines the Secret containing data to use for the targets.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "caFile": { + "description": "caFile defines the path to the CA cert in the Prometheus container to use for the targets.", + "type": "string" + }, + "cert": { + "description": "cert defines the Client certificate to present when doing client-authentication.", + "properties": { + "configMap": { + "description": "configMap defines the ConfigMap containing data to use for the targets.", + "properties": { + "key": { + "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the ConfigMap or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "secret": { + "description": "secret defines the Secret containing data to use for the targets.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "certFile": { + "description": "certFile defines the path to the client cert file in the Prometheus container for the targets.", + "type": "string" + }, + "insecureSkipVerify": { + "description": "insecureSkipVerify defines how to disable target certificate validation.", + "type": "boolean" + }, + "keyFile": { + "description": "keyFile defines the path to the client key file in the Prometheus container for the targets.", + "type": "string" + }, + "keySecret": { + "description": "keySecret defines the Secret containing the client key file for the targets.", + "properties": { + "key": { + "description": "The key of the secret to select from. Must be a valid secret key.", + "type": "string" + }, + "name": { + "default": "", + "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + "type": "string" + }, + "optional": { + "description": "Specify whether the Secret or its key must be defined", + "type": "boolean" + } + }, + "required": [ + "key" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "maxVersion": { + "description": "maxVersion defines the maximum acceptable TLS version.\n\nIt requires Prometheus >= v2.41.0 or Thanos >= v0.31.0.", + "enum": [ + "TLS10", + "TLS11", + "TLS12", + "TLS13" + ], + "type": "string" + }, + "minVersion": { + "description": "minVersion defines the minimum acceptable TLS version.\n\nIt requires Prometheus >= v2.35.0 or Thanos >= v0.28.0.", + "enum": [ + "TLS10", + "TLS11", + "TLS12", + "TLS13" + ], + "type": "string" + }, + "serverName": { + "description": "serverName is used to verify the hostname for the targets.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "trackTimestampsStaleness": { + "description": "trackTimestampsStaleness defines whether Prometheus tracks staleness of\nthe metrics that have an explicit timestamp present in scraped data.\nHas no effect if `honorTimestamps` is false.\n\nIt requires Prometheus >= v2.48.0.", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "fallbackScrapeProtocol": { + "description": "fallbackScrapeProtocol defines the protocol to use if a scrape returns blank, unparseable, or otherwise invalid Content-Type.\n\nIt requires Prometheus >= v3.0.0.", + "enum": [ + "PrometheusProto", + "OpenMetricsText0.0.1", + "OpenMetricsText1.0.0", + "PrometheusText0.0.4", + "PrometheusText1.0.0" + ], + "type": "string" + }, + "jobLabel": { + "description": "jobLabel selects the label from the associated Kubernetes `Service`\nobject which will be used as the `job` label for all metrics.\n\nFor example if `jobLabel` is set to `foo` and the Kubernetes `Service`\nobject is labeled with `foo: bar`, then Prometheus adds the `job=\"bar\"`\nlabel to all ingested metrics.\n\nIf the value of this field is empty or if the label doesn't exist for\nthe given Service, the `job` label of the metrics defaults to the name\nof the associated Kubernetes `Service`.", + "type": "string" + }, + "keepDroppedTargets": { + "description": "keepDroppedTargets defines the per-scrape limit on the number of targets dropped by relabeling\nthat will be kept in memory. 0 means no limit.\n\nIt requires Prometheus >= v2.47.0.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "labelLimit": { + "description": "labelLimit defines the per-scrape limit on number of labels that will be accepted for a sample.\n\nIt requires Prometheus >= v2.27.0.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "labelNameLengthLimit": { + "description": "labelNameLengthLimit defines the per-scrape limit on length of labels name that will be accepted for a sample.\n\nIt requires Prometheus >= v2.27.0.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "labelValueLengthLimit": { + "description": "labelValueLengthLimit defines the per-scrape limit on length of labels value that will be accepted for a sample.\n\nIt requires Prometheus >= v2.27.0.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "namespaceSelector": { + "description": "namespaceSelector defines in which namespace(s) Prometheus should discover the services.\nBy default, the services are discovered in the same namespace as the `ServiceMonitor` object but it is possible to select pods across different/all namespaces.", + "properties": { + "any": { + "description": "any defines the boolean describing whether all namespaces are selected in contrast to a\nlist restricting them.", + "type": "boolean" + }, + "matchNames": { + "description": "matchNames defines the list of namespace names to select from.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object", + "additionalProperties": false + }, + "nativeHistogramBucketLimit": { + "description": "nativeHistogramBucketLimit defines ff there are more than this many buckets in a native histogram,\nbuckets will be merged to stay within the limit.\nIt requires Prometheus >= v2.45.0.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "nativeHistogramMinBucketFactor": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "nativeHistogramMinBucketFactor defines if the growth factor of one bucket to the next is smaller than this,\nbuckets will be merged to increase the factor sufficiently.\nIt requires Prometheus >= v2.50.0.", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true, + "type": [ + "integer", + "string" + ] + }, + "podTargetLabels": { + "description": "podTargetLabels defines the labels which are transferred from the\nassociated Kubernetes `Pod` object onto the ingested metrics.", + "items": { + "type": "string" + }, + "type": "array" + }, + "sampleLimit": { + "description": "sampleLimit defines a per-scrape limit on the number of scraped samples\nthat will be accepted.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "scrapeClass": { + "description": "scrapeClass defines the scrape class to apply.", + "minLength": 1, + "type": "string" + }, + "scrapeClassicHistograms": { + "description": "scrapeClassicHistograms defines whether to scrape a classic histogram that is also exposed as a native histogram.\nIt requires Prometheus >= v2.45.0.\n\nNotice: `scrapeClassicHistograms` corresponds to the `always_scrape_classic_histograms` field in the Prometheus configuration.", + "type": "boolean" + }, + "scrapeNativeHistograms": { + "description": "scrapeNativeHistograms defines whether to enable scraping of native histograms.\nIt requires Prometheus >= v3.8.0.", + "type": "boolean" + }, + "scrapeProtocols": { + "description": "scrapeProtocols defines the protocols to negotiate during a scrape. It tells clients the\nprotocols supported by Prometheus in order of preference (from most to least preferred).\n\nIf unset, Prometheus uses its default value.\n\nIt requires Prometheus >= v2.49.0.", + "items": { + "description": "ScrapeProtocol represents a protocol used by Prometheus for scraping metrics.\nSupported values are:\n* `OpenMetricsText0.0.1`\n* `OpenMetricsText1.0.0`\n* `PrometheusProto`\n* `PrometheusText0.0.4`\n* `PrometheusText1.0.0`", + "enum": [ + "PrometheusProto", + "OpenMetricsText0.0.1", + "OpenMetricsText1.0.0", + "PrometheusText0.0.4", + "PrometheusText1.0.0" + ], + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "selector": { + "description": "selector defines the label selector to select the Kubernetes `Endpoints` objects to scrape metrics from.", + "properties": { + "matchExpressions": { + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + "items": { + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + "properties": { + "key": { + "description": "key is the label key that the selector applies to.", + "type": "string" + }, + "operator": { + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + "type": "string" + }, + "values": { + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "key", + "operator" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + "type": "object" + } + }, + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + }, + "selectorMechanism": { + "description": "selectorMechanism defines the mechanism used to select the endpoints to scrape.\nBy default, the selection process relies on relabel configurations to filter the discovered targets.\nAlternatively, you can opt in for role selectors, which may offer better efficiency in large clusters.\nWhich strategy is best for your use case needs to be carefully evaluated.\n\nIt requires Prometheus >= v2.17.0.", + "enum": [ + "RelabelConfig", + "RoleSelector" + ], + "type": "string" + }, + "serviceDiscoveryRole": { + "description": "serviceDiscoveryRole defines the service discovery role used to discover targets.\n\nIf set, the value should be either \"Endpoints\" or \"EndpointSlice\".\nOtherwise it defaults to the value defined in the\nPrometheus/PrometheusAgent resource.", + "enum": [ + "Endpoints", + "EndpointSlice" + ], + "type": "string" + }, + "targetLabels": { + "description": "targetLabels defines the labels which are transferred from the\nassociated Kubernetes `Service` object onto the ingested metrics.", + "items": { + "type": "string" + }, + "type": "array" + }, + "targetLimit": { + "description": "targetLimit defines a limit on the number of scraped targets that will\nbe accepted.", + "format": "int64", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "selector" + ], + "type": "object", + "additionalProperties": false + }, + "status": { + "description": "status defines the status subresource. It is under active development and is updated only when the\n\"StatusForConfigurationResources\" feature gate is enabled.\n\nMost recent observed status of the ServiceMonitor. Read-only.\nMore info:\nhttps://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + "properties": { + "bindings": { + "description": "bindings defines the list of workload resources (Prometheus, PrometheusAgent, ThanosRuler or Alertmanager) which select the configuration resource.", + "items": { + "description": "WorkloadBinding is a link between a configuration resource and a workload resource.", + "properties": { + "conditions": { + "description": "conditions defines the current state of the configuration resource when bound to the referenced Workload object.", + "items": { + "description": "ConfigResourceCondition describes the status of configuration resources linked to Prometheus, PrometheusAgent, Alertmanager or ThanosRuler.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime defines the time of the last update to the current status property.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message defines the human-readable message indicating details for the condition's last transition.", + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration defines the .metadata.generation that the\ncondition was set based upon. For instance, if `.metadata.generation` is\ncurrently 12, but the `.status.conditions[].observedGeneration` is 9, the\ncondition is out of date with respect to the current state of the object.", + "format": "int64", + "type": "integer" + }, + "reason": { + "description": "reason for the condition's last transition.", + "type": "string" + }, + "status": { + "description": "status of the condition.", + "minLength": 1, + "type": "string" + }, + "type": { + "description": "type of the condition being reported.\nCurrently, only \"Accepted\" is supported.", + "enum": [ + "Accepted" + ], + "minLength": 1, + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "type" + ], + "x-kubernetes-list-type": "map" + }, + "group": { + "description": "group defines the group of the referenced resource.", + "enum": [ + "monitoring.coreos.com" + ], + "type": "string" + }, + "name": { + "description": "name defines the name of the referenced object.", + "minLength": 1, + "type": "string" + }, + "namespace": { + "description": "namespace defines the namespace of the referenced object.", + "minLength": 1, + "type": "string" + }, + "resource": { + "description": "resource defines the type of resource being referenced (e.g. Prometheus, PrometheusAgent, ThanosRuler or Alertmanager).", + "enum": [ + "prometheuses", + "prometheusagents", + "thanosrulers", + "alertmanagers" + ], + "type": "string" + } + }, + "required": [ + "group", + "name", + "namespace", + "resource" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "group", + "resource", + "name", + "namespace" + ], + "x-kubernetes-list-type": "map" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "spec", + "apiVersion", + "kind", + "metadata" + ], + "type": "object", + "additionalProperties": false, + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { + "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", + "type": "object" + }, + "creationTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "deletionGracePeriodSeconds": { + "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", + "format": "int64", + "type": "integer" + }, + "deletionTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "finalizers": { + "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set", + "x-kubernetes-patch-strategy": "merge" + }, + "generateName": { + "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", + "type": "string" + }, + "generation": { + "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", + "format": "int64", + "type": "integer" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", + "type": "object" + }, + "managedFields": { + "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", + "type": "string" + }, + "ownerReferences": { + "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "uid" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "uid", + "x-kubernetes-patch-strategy": "merge" + }, + "resourceVersion": { + "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", + "type": "string" + }, + "selfLink": { + "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", + "type": "string" + }, + "uid": { + "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { + "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", + "format": "date-time", + "type": "string" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { + "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", + "type": "string" + }, + "fieldsType": { + "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", + "type": "string" + }, + "fieldsV1": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", + "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." + }, + "manager": { + "description": "Manager is an identifier of the workflow managing these fields.", + "type": "string" + }, + "operation": { + "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", + "type": "string" + }, + "subresource": { + "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", + "type": "string" + }, + "time": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { + "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", + "type": "object" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { + "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", + "properties": { + "apiVersion": { + "description": "API version of the referent.", + "type": "string" + }, + "blockOwnerDeletion": { + "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", + "type": "boolean" + }, + "controller": { + "description": "If true, this reference points to the managing controller.", + "type": "boolean" + }, + "kind": { + "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "name": { + "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "uid": { + "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "required": [ + "apiVersion", + "kind", + "name", + "uid" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + } +} diff --git a/schema/helm/crds/routing.modelsphere.dev/modelroute_v1alpha1.json b/schema/helm/crds/routing.modelsphere.dev/modelroute_v1alpha1.json new file mode 100644 index 0000000..e0babcf --- /dev/null +++ b/schema/helm/crds/routing.modelsphere.dev/modelroute_v1alpha1.json @@ -0,0 +1,541 @@ +{ + "description": "ModelRoute 把「一个模型的后端」自动同步到 openresty 的 peers 与 CART 的 workers。", + "properties": { + "apiVersion": { + "type": "string", + "enum": [ + "routing.modelsphere.dev/v1alpha1" + ] + }, + "kind": { + "type": "string", + "enum": [ + "ModelRoute" + ] + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" + }, + "spec": { + "description": "ModelRouteSpec 是一个模型的完整路由绑定。\n注:spec.slo 还在另一条分支上(feat/llmslo-to-openresty),main 的 schema 里没有这个字段。\nCEL 按 schema 编译,引用不存在的字段会让整个 CRD 被 API server 拒(\"undefined field 'slo'\"),\n所以这里先不写 slo 的规则 —— 那条分支合进来后补上:\n\n\trule: !has(self.modelType) || self.modelType != 'video' || !has(self.slo)\n\tmsg: modelType: video 不支持 slo(TTFT/TPS 是 token 级指标,视频生成没有这些)\n\nmonitor 的 service 行是给 LLM 健康检查用的(它按 /v1/models、TTFT 这类信号判活与告警),\n指向 H3 只会产生假告警。视频服务的可观测走 Prometheus(H3 自己的 /metrics/queue)。\nvideo 只认自己的调优项;LLM 那些(ttft/tps/自适应并发/会话亲和)在纯反代里根本没人读,\n与其静默忽略,不如直接拒 —— 配了以为生效才是最坑的。\n反过来:llm 路由里写 video 的旋钮同样是无效配置(它们只在 video 模板里渲染)。", + "properties": { + "cart": { + "description": "Cart:可选;有 = autoconfig 管这个 CART,无 = nginx 直连后端。", + "properties": { + "maxLoad": { + "description": "MaxLoad:每 worker 的 max_load,默认 20。", + "type": "integer" + }, + "outputConfigMap": { + "description": "OutputConfigMap:autoconfig 写 CART workers 的 ConfigMap(\"ns/name\")。autoconfig 只更新不创建。", + "type": "string" + }, + "outputKey": { + "description": "OutputKey:workers 写进这个 ConfigMap 的哪个 key。省略 = \"config.yaml\"。\n指到一个【只放 workers】的 key(如 \"workers.yaml\"),底稿那个 key 就完全归 chart:\nCART 按 `-c config.yaml -c workers.yaml` 的顺序合并(后者覆盖前者),helm upgrade 与 autoconfig\n各写各的 key,不再抢同一份内容。autoconfig 对这个 key 没有特殊规则 —— 读它现有内容当底稿、\n换掉 workers 再写回,key 还没内容就等于从空文档起写。", + "type": "string" + }, + "port": { + "description": "Port:CART 端口。省略则从 EndpointSlice/containerPort 自动推导(单端口)。", + "type": "integer" + }, + "selector": { + "type": "string" + }, + "service": { + "description": "CART pod 的发现(供 openresty 的 cart source);service/selector 二选一。service 支持 \"ns/name\" 跨 ns。", + "type": "string" + } + }, + "required": [ + "outputConfigMap" + ], + "type": "object", + "x-kubernetes-validations": [ + { + "message": "cart: service 和 selector 必须恰好给一个", + "rule": "has(self.service) != has(self.selector)" + } + ], + "additionalProperties": false + }, + "discovery": { + "description": "Discovery:本模型的后端桶(喂 CART 的 workers、nginx 的 backend 来源、monitor 的 services)。", + "properties": { + "includeNotReady": { + "description": "IncludeNotReady:默认 false 只取 Ready 端点(排空中端点自动排除)。", + "type": "boolean" + }, + "port": { + "description": "Port:后端服务端口(配 pod IP)。省略则自动推导:service 路径从 EndpointSlice 取、selector 路径从 containerPort 取(仅单端口可推)。", + "type": "integer" + }, + "selector": { + "description": "Selector:走 pod label 发现(兜底:没建 Service 的单机/单卡)。", + "type": "string" + }, + "service": { + "description": "Service:走 EndpointSlice 发现(推荐);该 Service 需只选服务端点(LWS Service 配成只选 leader)。\n支持 \"ns/name\" 跨 ns 发现(裸名默认与 ModelRoute 同 ns),让 ModelRoute 可放中心 ns。", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-validations": [ + { + "message": "discovery: service 和 selector 必须恰好给一个", + "rule": "has(self.service) != has(self.selector)" + } + ], + "additionalProperties": false + }, + "modelType": { + "default": "llm", + "description": "ModelType:这条路由服务的是哪类模型,决定各 sink 的渲染方式。默认 llm(向后兼容,\n老的 ModelRoute 不写这个字段,行为完全不变)。\n\n llm 大语言模型(/v1/chat/completions):走 lua 路由引擎 —— 会话亲和、TTFT/TPS 限流、\n 自适应并发、CART 前置。\n video 视频生成(如 MiniMax H3):异步建任务 + 轮询 + 大文件下载。请求体可能是 64MB 的\n base64 图,响应可能是几十 MB 的视频流,LLM 那套(解析 body 取 model、按 token\n 速率限流、会话亲和)不适用甚至有害,所以渲染成纯反向代理:放开超时、关响应缓冲、\n 透传 Range、补齐 X-Forwarded-Host/Proto。\n\n以后再有别的形态(如 embedding / rerank / ASR)在这里加枚举值 + 对应模板即可,\n不用给每种形态另造一个 CRD。", + "enum": [ + "llm", + "video" + ], + "type": "string" + }, + "monitor": { + "description": "Monitor:可选;有 = 把发现的后端也写进 monitor 的 services(monitor 60s 自热加载,无 sidecar)。", + "properties": { + "gpuType": { + "description": "GPUType:monitor service 行的 gpu_type 字段(如 H100 / A100 / H200)。省略 = 从后端所在节点的\nGPU label(nvidia.com/gpu.product,GFD 打)自动推导成短名;推不出(无 label / 无 GFD)则留空。显式配则覆盖。", + "type": "string" + }, + "model": { + "description": "Model:monitor service 行的 model 字段(served-model-name);省略 = metadata.name。", + "type": "string" + }, + "nginx": { + "description": "Nginx:可选,默认 true(当 spec.nginx 配了 service/selector);复用 nginx 入口发现,写 monitor 的 nginx: 行\n(端口用 spec.nginx.listen,每端口 = 一个模型,name = 本模型)。设 false 关闭。", + "type": "boolean" + }, + "outputConfigMap": { + "description": "OutputConfigMap:autoconfig 写 monitor 配置的 ConfigMap(\"ns/name\",多模型共享,每模型一个 key)。", + "type": "string" + }, + "router": { + "description": "Router:可选,默认 true(当配了 spec.cart);复用 spec.cart 发现的 CART pod,写 monitor 的 router: 表(.../workers)。设 false 关闭。", + "type": "boolean" + } + }, + "required": [ + "outputConfigMap" + ], + "type": "object", + "additionalProperties": false + }, + "nginx": { + "description": "Nginx:nginx(openresty)路由。", + "properties": { + "outputConfigMap": { + "description": "OutputConfigMap:输出 ConfigMap(\"ns/name\",多路由共享,每路由一个 key)。", + "type": "string" + }, + "peers": { + "description": "Peers:有序 peer 组(如 cart 优先 + backend 兜底)。", + "items": { + "description": "RoutePeer:openresty 一条 route 的一组 peer 来源(cart 组 / backend 组)。", + "properties": { + "maxConcurrency": { + "description": "MaxConcurrency:该组所有 peer 的并发上限;省略用 values.default_max。", + "type": "integer" + }, + "maxConcurrencyFromBackend": { + "description": "MaxConcurrencyFromBackend:仅 use:cart 有意义。true = cart 的并发上限动态 = 后端单实例并发 × 后端数\n(CART 扇出到 N 个后端,总容量=各后端容量之和,随后端扩缩自动变)。设了它就忽略静态 MaxConcurrency。\n后端单实例并发取 use:backend 组的 maxConcurrency —— CEL 校验强制此时它必须 > 0(见 ModelRouteSpec)。", + "type": "boolean" + }, + "priority": { + "description": "Priority:openresty peer 优先级(CART 优先=1,后端兜底=0)。", + "type": "integer" + }, + "probePath": { + "description": "ProbePath:该层 openresty 健康探测路径覆盖(GET 状态行含 200=健康,否则 ban)。\n省略时:use:cart 默认 \"/health\"(cache_aware_router 的 /v1/models 是缓存端点、worker 全挂也返 200\n不能当健康信号;/health 是 worker-aware 的),其余层默认空=用 route 的 health_probe_path(/v1/models)。\n显式设值(含对 cart 设为 \"/v1/models\")覆盖默认。", + "type": "string" + }, + "use": { + "description": "Use:\"cart\"(CART 上游,走 CART Service 的 ClusterIP)、\"backend\"(discovery 的后端桶,pod IP)、\n或 \"backend-svc\"(后端 Service 的 ClusterIP VIP,作最低优先级【静态兜底】——operator 宕+rollout 时\npod-IP 层全死也不全断,降级走 kube-proxy;需 discovery.service,selector 模式无 VIP 会被跳过)。", + "enum": [ + "cart", + "backend", + "backend-svc" + ], + "type": "string" + } + }, + "required": [ + "use" + ], + "type": "object", + "additionalProperties": false + }, + "minItems": 1, + "type": "array" + }, + "route": { + "description": "Route:路由短名(= conf 文件名 session_route_.conf + openresty dict 名 + unix socket 名 .sock\n**字符集必须 ⊆ [a-z0-9._-]**:它要做 dispatch 的路径捕获正则 `^/(?[a-z0-9._-]+)/`,含大写/其它字符\n→ dispatch 派生不到 .sock → 该模型经 8080 永远打不通。故加 Pattern 强校验。", + "pattern": "^[a-z0-9._-]+$", + "type": "string" + }, + "selector": { + "description": "Selector:可选;nginx 入口的 pod label 发现(没建 Service 时的兜底)。", + "type": "string" + }, + "service": { + "description": "Service:可选;nginx 入口自身的 Service(\"ns/name\")→ 供 monitor 的 nginx: 行 + 入口 pod 扩缩事件驱动。\n端口取 Service 的 dispatch 命名端口(8080,路径路由统一入口)。与 selector 二选一(都配则 service 优先)。", + "type": "string" + }, + "values": { + "additionalProperties": { + "type": "string" + }, + "description": "Values:任意调优项,原样渲染进 lua register_route 返回表(key = value)。nginx 加新调优项无需改代码。\n常用:ttft_limit_ms、tps_limit_tps、adaptive_cc_min、default_max。值按 lua 字面量原样写(数字不加引号)。\n\n⚠️ 这里的值全部走 luaVal:非数字/非布尔会被**加引号当字符串**。所以不能在这里手写\nttft_metrics / tps_metrics 这类**嵌套 table** —— 写了会渲染成字符串,引擎的\nutil.validate_metrics 直接整份丢弃。那两个键由 spec.slo 从 LLMSLORequirement 生成,\n且渲染在本段之后 → **配了 spec.slo 时,这里手写的同名键会被静默覆盖**(实测确认)。\n要调 SLO 阈值请改 LLMSLORequirement,不要在这里写。\nMaxProperties/MaxLength 不只是防呆:CEL 规则的**估算开销**与 map 的可能大小成正比,\n不加上限时 k8s 按\"无限大\"估,白名单一长就超预算被拒\n(estimated rule cost exceeds budget —— 实测加到 9 个键就超了 2.2%)。", + "maxProperties": 32, + "type": "object" + } + }, + "required": [ + "outputConfigMap", + "peers" + ], + "type": "object", + "additionalProperties": false + }, + "slo": { + "description": "SLO:可选;有 = 把同 ns 里匹配本路由的 LLMSLORequirement 翻译成 ttft_metrics / tps_metrics,\n渲染进本路由的 session_route_.conf(与其它调优项同一条通道,reload 生效)。\n没有 = 完全不碰 SLO(openresty 回落 nginx.values 里的静态 ttft_limit_ms / tps_limit_tps)。", + "properties": { + "name": { + "description": "Name:要读哪个 LLMSLORequirement,按 **metadata.name** 取。必填,不做任何推导。\n支持 \"ns/name\" 跨 ns 引用;裸名默认用 ModelRoute 自己的 ns\n(与 discovery.service、nginx.outputConfigMap 同一套写法)。\n\n用 name 而不是 spec.serviceId,有两个原因:\n\n 1. **唯一性由 k8s 保证**。serviceId 只是个自由字符串,同 ns 里两个对象写同一个\n serviceId 完全能 apply,那时\"用哪份\"就由 List 的顺序(informer 缓存,无序保证)\n 决定,阈值会在两份之间漂,而两份 CRD 看上去都正常。按 name 是直接 Get,不存在这问题。\n 2. **不含糊**。一个服务在不同地方叫 glm 和 glm-leader,serviceId 写哪个要靠猜;\n name 是这个对象唯一的、写在 yaml 上的身份。\n\n早先还有一版是从 discovery.service 截掉 \"-leader\" 后缀推 serviceId(LWS 惯例)。\n一并删了:那是按命名规则猜关联,猜错不报错——要么静默回落静态阈值,要么套用别人的 SLO。", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "discovery", + "nginx" + ], + "type": "object", + "x-kubernetes-validations": [ + { + "message": "modelType: video 不支持 cart(CART 是 LLM 的前缀缓存路由器)", + "rule": "!has(self.modelType) || self.modelType != 'video' || !has(self.cart)" + }, + { + "message": "modelType: video 的 nginx.peers 不能用 cart", + "rule": "!has(self.modelType) || self.modelType != 'video' || !self.nginx.peers.exists(s, s.use == 'cart')" + }, + { + "message": "modelType: video 不支持 monitor(它的探活与告警是按 LLM 端点设计的,会产生假告警;视频服务用 Prometheus 抓自己的指标)", + "rule": "!has(self.modelType) || self.modelType != 'video' || !has(self.monitor)" + }, + { + "message": "modelType: video 的 nginx.values 只支持 max_body_size / proxy_timeout / connect_timeout / rate_limit / upload_conn_limit / upload_req_limit / upload_req_burst / upload_limit_key / download_conn_limit / auth / auth_public_paths(TTFT/TPS/自适应并发等是 LLM 引擎的调优项,video 是纯反向代理,配了不会生效;rate_limit_after 已废弃 —— 下载路径现在从第一字节起就限速,不再豁免首段)", + "rule": "!has(self.modelType) || self.modelType != 'video' || !has(self.nginx.values) || self.nginx.values.all(k, k in ['max_body_size','proxy_timeout','connect_timeout','rate_limit','upload_conn_limit','upload_req_limit','upload_req_burst','upload_limit_key','download_conn_limit','auth','auth_public_paths'])" + }, + { + "message": "max_body_size / proxy_timeout / connect_timeout / rate_limit / upload_conn_limit / upload_req_limit / upload_req_burst / upload_limit_key / download_conn_limit / auth / auth_public_paths 只对 modelType: video 生效,llm 路由请用 ttft_limit_ms / tps_limit_tps / adaptive_cc_min 等", + "rule": "(has(self.modelType) && self.modelType == 'video') || !has(self.nginx.values) || self.nginx.values.all(k, !(k in ['max_body_size','proxy_timeout','connect_timeout','rate_limit','upload_conn_limit','upload_req_limit','upload_req_burst','upload_limit_key','download_conn_limit','auth','auth_public_paths']))" + }, + { + "message": "nginx.peers 用了 cart,但没配 spec.cart", + "rule": "!self.nginx.peers.exists(s, s.use == 'cart') || has(self.cart)" + }, + { + "message": "cart 用了 maxConcurrencyFromBackend,必须给 backend 组配 maxConcurrency(> 0)作乘数", + "rule": "!self.nginx.peers.exists(s, s.use == 'cart' && has(s.maxConcurrencyFromBackend) && s.maxConcurrencyFromBackend) || self.nginx.peers.exists(s, s.use == 'backend' && has(s.maxConcurrency) && s.maxConcurrency > 0)" + } + ], + "additionalProperties": false + }, + "status": { + "description": "ModelRouteStatus 是 controller 回写的观测状态。", + "properties": { + "appliedRouteConfigMap": { + "type": "string" + }, + "appliedRouteKey": { + "description": "AppliedRouteKey / AppliedRouteConfigMap:**上一次真正写进去的** openresty key 及其 ConfigMap。\n用来在 spec.nginx.route 改名后删掉旧 key —— 只看当前 spec 是推不出旧名字的,\n结果就是改一次名泄漏一个 key,而 openresty 会继续加载那条陈旧路由(指向改名前的 peers)。", + "type": "string" + }, + "backends": { + "type": "integer" + }, + "cartPeers": { + "type": "integer" + }, + "conditions": { + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "lastSyncTime": { + "format": "date-time", + "type": "string" + }, + "observedGeneration": { + "format": "int64", + "type": "integer" + }, + "orphanRouteKeys": { + "description": "OrphanRouteKeys:改名后遗留、已无任何 ModelRoute 声明的 openresty key(格式 \"ns/cm:key\")。\n**只报不删** —— 见 reportOrphanKeys 里为什么不能由 operator 自动删。", + "items": { + "type": "string" + }, + "type": "array" + }, + "ready": { + "type": "boolean" + } + }, + "required": [ + "backends", + "cartPeers", + "ready" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false, + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { + "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", + "type": "object" + }, + "creationTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "deletionGracePeriodSeconds": { + "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", + "format": "int64", + "type": "integer" + }, + "deletionTimestamp": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "finalizers": { + "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set", + "x-kubernetes-patch-strategy": "merge" + }, + "generateName": { + "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", + "type": "string" + }, + "generation": { + "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", + "format": "int64", + "type": "integer" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", + "type": "object" + }, + "managedFields": { + "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "name": { + "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", + "type": "string" + }, + "ownerReferences": { + "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", + "items": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "uid" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "uid", + "x-kubernetes-patch-strategy": "merge" + }, + "resourceVersion": { + "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", + "type": "string" + }, + "selfLink": { + "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", + "type": "string" + }, + "uid": { + "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { + "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", + "format": "date-time", + "type": "string" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { + "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", + "type": "string" + }, + "fieldsType": { + "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", + "type": "string" + }, + "fieldsV1": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", + "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." + }, + "manager": { + "description": "Manager is an identifier of the workflow managing these fields.", + "type": "string" + }, + "operation": { + "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", + "type": "string" + }, + "subresource": { + "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", + "type": "string" + }, + "time": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." + } + }, + "type": "object", + "additionalProperties": false + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { + "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", + "type": "object" + }, + "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { + "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", + "properties": { + "apiVersion": { + "description": "API version of the referent.", + "type": "string" + }, + "blockOwnerDeletion": { + "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", + "type": "boolean" + }, + "controller": { + "description": "If true, this reference points to the managing controller.", + "type": "boolean" + }, + "kind": { + "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "name": { + "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", + "type": "string" + }, + "uid": { + "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", + "type": "string" + } + }, + "required": [ + "apiVersion", + "kind", + "name", + "uid" + ], + "type": "object", + "x-kubernetes-map-type": "atomic", + "additionalProperties": false + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ] +} diff --git a/schema/helm/provenance.json b/schema/helm/provenance.json new file mode 100644 index 0000000..3688c3b --- /dev/null +++ b/schema/helm/provenance.json @@ -0,0 +1,121 @@ +{ + "converterVersion": "catalog-crd-schema-v1", + "objectMeta": { + "url": "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/39a87cd29966bc0b3434e8cfbc2061782c8cb69a/v1.36.3-standalone-strict/_definitions.json", + "sha256": "ed76a6bccfa27ff085c390952d64267a18c91beb045b3e33117d482e26510cf3" + }, + "sources": [ + { + "repository": "modelsphere/autoconfig", + "commit": "b07623f8179a31cd63545d4077fa21c253b608dd", + "path": "config/crd/bases/routing.modelsphere.dev_modelroutes.yaml", + "kind": "ModelRoute", + "url": "https://raw.githubusercontent.com/modelsphere/autoconfig/b07623f8179a31cd63545d4077fa21c253b608dd/config/crd/bases/routing.modelsphere.dev_modelroutes.yaml", + "sha256": "ee2397f6a5636f585c5ec9b96abf46ef0b68df758beb94abd048236340554e2f", + "schemas": [ + { + "file": "routing.modelsphere.dev/modelroute_v1alpha1.json", + "group": "routing.modelsphere.dev", + "version": "v1alpha1", + "kind": "ModelRoute" + } + ] + }, + { + "repository": "modelsphere/llm-operator", + "commit": "47d2040748b20bd8f73cad587df556d3b29e4842", + "path": "config/crd/bases/autoscaling.4pd.io_llmscalers.yaml", + "kind": "LLMScaler", + "url": "https://raw.githubusercontent.com/modelsphere/llm-operator/47d2040748b20bd8f73cad587df556d3b29e4842/config/crd/bases/autoscaling.4pd.io_llmscalers.yaml", + "sha256": "ad25f5946a732fb3021485298db31dbec2a2d9b4285f14a9b31d33b2ea517115", + "schemas": [ + { + "file": "autoscaling.4pd.io/llmscaler_v1alpha1.json", + "group": "autoscaling.4pd.io", + "version": "v1alpha1", + "kind": "LLMScaler" + } + ] + }, + { + "repository": "modelsphere/llm-operator", + "commit": "3583a1fae4b979fd506f81be9317d3316395fc00", + "path": "config/crd/bases/autoscaling.modelsphere.dev_llmscalers.yaml", + "kind": "LLMScaler", + "url": "https://raw.githubusercontent.com/modelsphere/llm-operator/3583a1fae4b979fd506f81be9317d3316395fc00/config/crd/bases/autoscaling.modelsphere.dev_llmscalers.yaml", + "sha256": "72168fc74a2603ad726ad6a85a2cb7737d105cc4e3e8eeea4284ff87f3a85214", + "schemas": [ + { + "file": "autoscaling.modelsphere.dev/llmscaler_v1alpha1.json", + "group": "autoscaling.modelsphere.dev", + "version": "v1alpha1", + "kind": "LLMScaler" + } + ] + }, + { + "repository": "modelsphere/helm-charts", + "commit": "46c4a9c4c90274bb2c6d9fbfe2617d5b39e2eccc", + "path": "charts/llm-slo-decision-gen/crds/llmslorequirements.inference.x-k8s.io.yaml", + "kind": "LLMSLORequirement", + "url": "https://raw.githubusercontent.com/modelsphere/helm-charts/46c4a9c4c90274bb2c6d9fbfe2617d5b39e2eccc/charts/llm-slo-decision-gen/crds/llmslorequirements.inference.x-k8s.io.yaml", + "sha256": "9e2744ddd82995bd5404797d23ee19ae6dfc9b76d77b9f29c3a8f76da1661352", + "schemas": [ + { + "file": "inference.x-k8s.io/llmslorequirement_v1alpha1.json", + "group": "inference.x-k8s.io", + "version": "v1alpha1", + "kind": "LLMSLORequirement" + } + ] + }, + { + "repository": "modelsphere/helm-charts", + "commit": "8c2ca99e4576aafbdd17107a3c55fb391b2473c4", + "path": "charts/llm-slo-decision-gen/crds/llmslorequirements.inference.modelsphere.dev.yaml", + "kind": "LLMSLORequirement", + "url": "https://raw.githubusercontent.com/modelsphere/helm-charts/8c2ca99e4576aafbdd17107a3c55fb391b2473c4/charts/llm-slo-decision-gen/crds/llmslorequirements.inference.modelsphere.dev.yaml", + "sha256": "a16199665872f1d2b78cb008bcfff3d232db59595e1f8c820f648c85720a511a", + "schemas": [ + { + "file": "inference.modelsphere.dev/llmslorequirement_v1alpha1.json", + "group": "inference.modelsphere.dev", + "version": "v1alpha1", + "kind": "LLMSLORequirement" + } + ] + }, + { + "repository": "kubernetes-sigs/lws", + "commit": "03254992e177a706fc531572376a3d3153addc93", + "path": "config/crd/bases/leaderworkerset.x-k8s.io_leaderworkersets.yaml", + "kind": "LeaderWorkerSet", + "url": "https://raw.githubusercontent.com/kubernetes-sigs/lws/03254992e177a706fc531572376a3d3153addc93/config/crd/bases/leaderworkerset.x-k8s.io_leaderworkersets.yaml", + "sha256": "1554930d16a4c48bbfca4952afbf877c2814f9f751e0f9694e6c22ef3206a518", + "schemas": [ + { + "file": "leaderworkerset.x-k8s.io/leaderworkerset_v1.json", + "group": "leaderworkerset.x-k8s.io", + "version": "v1", + "kind": "LeaderWorkerSet" + } + ] + }, + { + "repository": "prometheus-operator/prometheus-operator", + "commit": "5b656b46d40ee3de0c444e55bce82871b42aa959", + "path": "example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml", + "kind": "ServiceMonitor", + "url": "https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/5b656b46d40ee3de0c444e55bce82871b42aa959/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml", + "sha256": "31bdff398b54ac2bc993a33f5dcb0472792a77104a6a609d264c8f1f17829769", + "schemas": [ + { + "file": "monitoring.coreos.com/servicemonitor_v1.json", + "group": "monitoring.coreos.com", + "version": "v1", + "kind": "ServiceMonitor" + } + ] + } + ] +} diff --git a/schema/helm/sources.json b/schema/helm/sources.json new file mode 100644 index 0000000..f2bec3c --- /dev/null +++ b/schema/helm/sources.json @@ -0,0 +1,46 @@ +{ + "sources": [ + { + "repository": "modelsphere/autoconfig", + "commit": "b07623f8179a31cd63545d4077fa21c253b608dd", + "path": "config/crd/bases/routing.modelsphere.dev_modelroutes.yaml", + "kind": "ModelRoute" + }, + { + "repository": "modelsphere/llm-operator", + "commit": "47d2040748b20bd8f73cad587df556d3b29e4842", + "path": "config/crd/bases/autoscaling.4pd.io_llmscalers.yaml", + "kind": "LLMScaler" + }, + { + "repository": "modelsphere/llm-operator", + "commit": "3583a1fae4b979fd506f81be9317d3316395fc00", + "path": "config/crd/bases/autoscaling.modelsphere.dev_llmscalers.yaml", + "kind": "LLMScaler" + }, + { + "repository": "modelsphere/helm-charts", + "commit": "46c4a9c4c90274bb2c6d9fbfe2617d5b39e2eccc", + "path": "charts/llm-slo-decision-gen/crds/llmslorequirements.inference.x-k8s.io.yaml", + "kind": "LLMSLORequirement" + }, + { + "repository": "modelsphere/helm-charts", + "commit": "8c2ca99e4576aafbdd17107a3c55fb391b2473c4", + "path": "charts/llm-slo-decision-gen/crds/llmslorequirements.inference.modelsphere.dev.yaml", + "kind": "LLMSLORequirement" + }, + { + "repository": "kubernetes-sigs/lws", + "commit": "03254992e177a706fc531572376a3d3153addc93", + "path": "config/crd/bases/leaderworkerset.x-k8s.io_leaderworkersets.yaml", + "kind": "LeaderWorkerSet" + }, + { + "repository": "prometheus-operator/prometheus-operator", + "commit": "5b656b46d40ee3de0c444e55bce82871b42aa959", + "path": "example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml", + "kind": "ServiceMonitor" + } + ] +} From 14ea93de3ee47daeb44e8309f7d977518f2f6ecb Mon Sep 17 00:00:00 2001 From: wenyunqing Date: Thu, 8 Oct 2026 17:09:43 +0800 Subject: [PATCH 2/8] fix(qwen3.6): extend rollout deadlines beyond startup probe budget Set progressDeadlineSeconds to 7200 for sglang-tp2-h100 in model versions 1.0.0 and 1.1.0. The startup probe allows 5400 seconds, so the previous 2000-second deadline caused Helm template validation to fail. Update the validation documentation to record the resolved failures. --- .../qwen3.6-35b-a3b-1.0.0.yaml | 2 +- .../qwen3.6-35b-a3b-1.1.0.yaml | 2 +- schema/helm/README.md | 21 ++++++------------- 3 files changed, 8 insertions(+), 17 deletions(-) diff --git a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml index 326f4b6..ff3c5ee 100644 --- a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml +++ b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml @@ -62,7 +62,7 @@ variants: ephemeral-storage: 16Gi limits: ephemeral-storage: 16Gi - progressDeadlineSeconds: 2000 + progressDeadlineSeconds: 7200 startupProbe: httpGet: path: /health diff --git a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml index cd65b6f..9b1ae37 100644 --- a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml +++ b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml @@ -62,7 +62,7 @@ variants: ephemeral-storage: 16Gi limits: ephemeral-storage: 16Gi - progressDeadlineSeconds: 2000 + progressDeadlineSeconds: 7200 startupProbe: httpGet: path: /health diff --git a/schema/helm/README.md b/schema/helm/README.md index eaf5500..816e588 100644 --- a/schema/helm/README.md +++ b/schema/helm/README.md @@ -96,21 +96,12 @@ propagation. ## Rollout and limits -The initial full-catalog run checked 43 variants: 41 passed and two existing -Qwen configurations failed Helm's template check. Their published YAMLs are -intentionally preserved; the gate has no exception for these failures. - -| Version file | Variant | Declared / resolved chart | Existing failure | -| --- | --- | --- | --- | -| `models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml` | `sglang-tp2-h100` | `0.7.1` / `0.7.1` | `values.progressDeadlineSeconds: 2000` is below the startup probe budget, `180 × 30 = 5400` seconds. | -| `models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml` | `sglang-tp2-h100` | `>=0.7.1` / `0.8.10` | The same deadline/startup budget mismatch. | - -Consequently, this validator's introduction and subsequent changes that trigger -full-catalog validation will fail until those historical incompatibilities are -resolved. PRs that change other version configurations validate only their -selected files. The real acceptance suite passes independently of these two -historical failures. The resolved range version above records the initial run -and may change on future runs. +The initial full-catalog run exposed a deadline/startup budget mismatch in the +`sglang-tp2-h100` variants of Qwen 3.6 versions `1.0.0` and `1.1.0`: +`progressDeadlineSeconds: 2000` was below the startup probe budget, +`180 × 30 = 5400` seconds. Both values have been deliberately corrected to +`7200`, matching this model's other variants and leaving 1800 seconds beyond +the probe budget. No validator exception is needed for these configurations. After this workflow is merged and its check has run, add **`validate-helm`** to the target branch's required status checks in GitHub branch protection/rulesets. From 453c1abf0e41885ef1266ba9ebad467931300ccd Mon Sep 17 00:00:00 2001 From: wenyunqing Date: Thu, 8 Oct 2026 18:52:29 +0800 Subject: [PATCH 3/8] refactor(catalog)!: unify custom CRDs under modelsphere.dev Raise model chart pins and constraint minima to sglang 0.8.0 and vllm 0.5.0, the first releases using the canonical Modelsphere API groups. Remove legacy autoscaling.4pd.io and inference.x-k8s.io schemas and regenerate source provenance. Require Modelsphere CRD sources to use .modelsphere.dev while retaining external projects' upstream groups. Update documentation and tests to check rendered API groups, cover the fixed vLLM release, and reject legacy charts and API groups. Validation: all 43 catalog variants, regression tests, integration tests, and the PR-mode site build pass. BREAKING CHANGE: model variants require controllers and CRDs using the .modelsphere.dev groups. Published chart declarations are deliberately updated and need allow_rewrites when publishing the catalog. --- README.md | 8 +- hack/lib/crd-schema.js | 11 +- hack/lib/crd-schema.test.js | 14 +- hack/update-helm-schemas.js | 4 +- hack/validate-helm.integration.test.js | 22 +- hack/validate-helm.test.js | 14 +- hack/validate-schema.js | 2 +- .../deepseek-v4-flash-0731-1.0.0.yaml | 4 +- .../deepseek-v4-flash-1.0.0.yaml | 4 +- .../deepseek-v4.1-flash-1.0.0.yaml | 4 +- .../google-gemma-4-31b-it-1.0.0.yaml | 4 +- models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml | 4 +- models/glm5.1/glm5.1-1.0.0.yaml | 2 +- models/glm5.3/glm5.3-1.0.0.yaml | 2 +- models/glm5.3/glm5.3-1.0.1.yaml | 2 +- models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml | 4 +- models/hy3/hy3-1.0.0.yaml | 4 +- models/kimi-k2.5/kimi-k2.5-1.0.0.yaml | 2 +- models/kimi-k3/kimi-k3-1.0.0.yaml | 2 +- models/kimi-k3/kimi-k3-1.0.1.yaml | 4 +- models/kimi-k3/kimi-k3-1.0.2.yaml | 4 +- models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml | 4 +- .../ling-3.0-flash-vl-1.0.0.yaml | 4 +- .../ling-3.0-flash/ling-3.0-flash-1.0.0.yaml | 4 +- models/mimo-v2.5/mimo-v2.5-1.0.0.yaml | 4 +- .../nemotron-3.5-lightning-30b-a3b-1.0.0.yaml | 4 +- models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml | 4 +- .../qwen3.6-35b-a3b-1.0.0.yaml | 2 +- .../qwen3.6-35b-a3b-1.1.0.yaml | 6 +- .../qwen3.8-27b-fp8-1.0.0.yaml | 4 +- .../qwen3.8-flash-next-1.0.0.yaml | 4 +- schema/helm/README.md | 33 +- .../llmscaler_v1alpha1.json | 465 ------------------ .../llmslorequirement_v1alpha1.json | 462 ----------------- schema/helm/provenance.json | 37 +- schema/helm/sources.json | 27 +- schema/version.schema.json | 2 +- 37 files changed, 140 insertions(+), 1047 deletions(-) delete mode 100644 schema/helm/crds/autoscaling.4pd.io/llmscaler_v1alpha1.json delete mode 100644 schema/helm/crds/inference.x-k8s.io/llmslorequirement_v1alpha1.json diff --git a/README.md b/README.md index e448a4e..9a84378 100644 --- a/README.md +++ b/README.md @@ -148,10 +148,10 @@ publishing a new one. | `chart.version` | means | | --- | --- | -| `0.7.1` | exactly 0.7.1 | -| `">=0.7.1"` | 0.7.1 or newer (quoted: a bare `>` starts a YAML block scalar) | -| `"^0.7.1"` | 0.7.x from 0.7.1; in 0.x, a minor bump is the breaking one | -| `">=0.7.1 <0.9.0"` | both | +| `0.8.0` | exactly 0.8.0 | +| `">=0.8.0"` | 0.8.0 or newer (quoted: a bare `>` starts a YAML block scalar) | +| `"^0.8.0"` | 0.8.x from 0.8.0; in 0.x, a minor bump is the breaking one | +| `">=0.8.0 <0.9.0"` | both | A deploy still pins: swissd records the one version the range resolved to (the newest in range, or one the operator picks) and an upgrade keeps it until asked diff --git a/hack/lib/crd-schema.js b/hack/lib/crd-schema.js index b48c0b4..38dcc98 100644 --- a/hack/lib/crd-schema.js +++ b/hack/lib/crd-schema.js @@ -3,6 +3,15 @@ // Versioned with the repository; changing this contract requires regeneration. const CONVERTER_VERSION = "catalog-crd-schema-v1"; +function assertCrdSource(source, crd) { + if (source.repository.startsWith("modelsphere/") && !source.group?.endsWith(".modelsphere.dev")) { + throw new Error(`${source.repository}: Modelsphere CRDs must use a .modelsphere.dev API group`); + } + if (crd?.kind !== "CustomResourceDefinition" || crd.spec?.names?.kind !== source.kind || crd.spec?.group !== source.group) { + throw new Error(`expected CRD ${source.group}/${source.kind}, got ${crd?.spec?.group}/${crd?.spec?.names?.kind}`); + } +} + function convertSchema(input) { if (typeof input === "boolean") return input; const schema = structuredClone(input); @@ -78,4 +87,4 @@ function crdSchemas(crd, metadata = {schema: {type: "object"}, definitions: {}}) }); } -module.exports = {CONVERTER_VERSION, convertSchema, crdSchemas, objectMetaSchema}; +module.exports = {CONVERTER_VERSION, assertCrdSource, convertSchema, crdSchemas, objectMetaSchema}; diff --git a/hack/lib/crd-schema.test.js b/hack/lib/crd-schema.test.js index 68f1c1a..ac19a15 100644 --- a/hack/lib/crd-schema.test.js +++ b/hack/lib/crd-schema.test.js @@ -3,10 +3,22 @@ const test = require("node:test"); const assert = require("node:assert/strict"); const Ajv = require("ajv"); -const {convertSchema, crdSchemas, objectMetaSchema} = require("./crd-schema"); +const {assertCrdSource, convertSchema, crdSchemas, objectMetaSchema} = require("./crd-schema"); const compile = (schema) => new Ajv({strict: false}).compile(schema); +test("Modelsphere sources require their own API groups; external CRDs retain upstream groups", () => { + const source = {repository: "modelsphere/llm-operator", group: "autoscaling.modelsphere.dev", kind: "LLMScaler"}; + const crd = {kind: "CustomResourceDefinition", spec: {group: source.group, names: {kind: source.kind}}}; + assert.doesNotThrow(() => assertCrdSource(source, crd)); + assert.throws(() => assertCrdSource(source, {...crd, spec: {...crd.spec, group: "autoscaling.4pd.io"}}), /expected CRD/); + assert.throws(() => assertCrdSource({...source, group: "autoscaling.4pd.io"}, crd), /must use a .modelsphere.dev/); + assert.throws(() => assertCrdSource(source, {...crd, spec: {...crd.spec, names: {kind: "Wrong"}}}), /expected CRD/); + const external = {repository: "kubernetes-sigs/lws", group: "leaderworkerset.x-k8s.io", kind: "LeaderWorkerSet"}; + assert.doesNotThrow(() => assertCrdSource(external, + {kind: "CustomResourceDefinition", spec: {group: external.group, names: {kind: external.kind}}})); +}); + test("strictness descends into array items while preserving typed maps and free objects", () => { const validate = compile(convertSchema({type: "object", properties: { env: {type: "array", items: {type: "object", properties: {name: {type: "string"}}, required: ["name"]}}, diff --git a/hack/update-helm-schemas.js b/hack/update-helm-schemas.js index 58a120c..318572e 100644 --- a/hack/update-helm-schemas.js +++ b/hack/update-helm-schemas.js @@ -6,7 +6,7 @@ const path = require("node:path"); const crypto = require("node:crypto"); const YAML = require("yaml"); const {root} = require("./lib/catalog"); -const {CONVERTER_VERSION, crdSchemas, objectMetaSchema} = require("./lib/crd-schema"); +const {CONVERTER_VERSION, assertCrdSource, crdSchemas, objectMetaSchema} = require("./lib/crd-schema"); const config = require("../schema/helm/config.json"); const sources = require("../schema/helm/sources.json").sources; @@ -32,7 +32,7 @@ async function main() { if (doc.errors.length) throw doc.errors[0]; const crd = doc.toJS(); if (!crd) return []; - if (crd.spec?.names?.kind !== source.kind) throw new Error(`${url}: unexpected CRD kind`); + assertCrdSource(source, crd); return crdSchemas(crd, metadata); }); if (!schemas.length) throw new Error(`${url}: no served schemas`); diff --git a/hack/validate-helm.integration.test.js b/hack/validate-helm.integration.test.js index b5acaa0..76ae7d0 100644 --- a/hack/validate-helm.integration.test.js +++ b/hack/validate-helm.integration.test.js @@ -28,7 +28,10 @@ test("released charts: fixed/range versions, all example variants, LWS, defaults ["valid-gemma", "models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml"], ["valid-lws", "models/kimi-k2.5/kimi-k2.5-1.0.0.yaml"] ]) write(name, YAML.parse(fs.readFileSync(path.join(root, file), "utf8"))); - const base = {variants: [{id: "fixture", chart: {name: "sglang", version: ">=0.7.8"}}]}; + const vllm = YAML.parse(fs.readFileSync(path.join(root, "models/kimi-k3/kimi-k3-1.0.1.yaml"), "utf8")); + vllm.variants = vllm.variants.filter((v) => v.chart.name === "vllm"); + write("valid-vllm-fixed", vllm); + const base = {variants: [{id: "fixture", chart: {name: "sglang", version: ">=0.8.0"}}]}; write("valid-defaults", base); const invalids = [ ["bad-key", {unkownField: true}, "lint"], @@ -45,14 +48,24 @@ test("released charts: fixed/range versions, all example variants, LWS, defaults } const noVersion = structuredClone(base); noVersion.variants[0].chart.version = "9999.0.0"; write("bad-resolution", noVersion); + const legacy = structuredClone(base); legacy.variants[0].chart.version = "0.7.1"; + write("bad-legacy-chart", legacy); const output = path.join(temp, "artifacts"); assert.equal(main({all: true, files: [], output}, {repositoryRoot: temp}), false); const summary = JSON.parse(fs.readFileSync(path.join(output, "summary.json"), "utf8")); for (const result of summary.results.filter((r) => path.basename(r.file).startsWith("valid-"))) { assert.equal(result.ok, true, `${result.file}: ${JSON.stringify(result)}`); + const expected = {LLMScaler: "autoscaling.modelsphere.dev/v1alpha1", LLMSLORequirement: "inference.modelsphere.dev/v1alpha1", + ModelRoute: "routing.modelsphere.dev/v1alpha1"}; + const rendered = YAML.parseAllDocuments(fs.readFileSync(path.join(temp, result.artifacts, "rendered.yaml"), "utf8")); + for (const doc of rendered) { + const resource = doc.toJS(); + if (expected[resource?.kind]) assert.equal(resource.apiVersion, expected[resource.kind], result.file); + } } const fixed = summary.results.find((r) => r.file.endsWith("valid-fixed.yaml")); - assert.equal(fixed.chart.version, "0.7.1"); + assert.equal(fixed.chart.version, "0.8.0"); + assert.equal(summary.results.find((r) => r.file.endsWith("valid-vllm-fixed.yaml")).chart.version, "0.5.0"); assert.equal(summary.results.filter((r) => r.file.endsWith("valid-gemma.yaml")).length, 2); for (const [name, , stage] of invalids) { const result = summary.results.find((r) => r.file.endsWith(`${name}.yaml`)); @@ -60,12 +73,15 @@ test("released charts: fixed/range versions, all example variants, LWS, defaults assert.equal(result.stages[stage], false, `${name}: ${JSON.stringify(result)}`); } assert.match(summary.results.find((r) => r.file.endsWith("bad-resolution.yaml")).error, /no published/); + assert.equal(summary.results.find((r) => r.file.endsWith("bad-legacy-chart.yaml")).stages.kubeconform, false); // Verify the exact production kubeconform invocation fails for unknown GVKs, // even if their kind resembles an existing native resource or known CRD. const cache = path.join(temp, "schema-cache"); fs.mkdirSync(cache); for (const [apiVersion, kind] of [ ["unknown.example/v1", "Unknown"], ["wrong.example/v1", "ModelRoute"], - ["routing.modelsphere.dev/v9", "ModelRoute"], ["apps.wrong.example/v1", "Deployment"] + ["routing.modelsphere.dev/v9", "ModelRoute"], ["apps.wrong.example/v1", "Deployment"], + ["autoscaling.4pd.io/v1alpha1", "LLMScaler"], ["inference.x-k8s.io/v1alpha1", "LLMSLORequirement"], + ["routing.gpucluster.io/v1alpha1", "ModelRoute"] ]) { const rendered = path.join(temp, "unknown.yaml"); fs.writeFileSync(rendered, YAML.stringify({apiVersion, kind, metadata: {name: "unknown"}})); diff --git a/hack/validate-helm.test.js b/hack/validate-helm.test.js index 168917d..6b0c62a 100644 --- a/hack/validate-helm.test.js +++ b/hack/validate-helm.test.js @@ -16,8 +16,8 @@ function fixture(t, failure) { const file = "models/example/example-1.0.0.yaml"; fs.mkdirSync(path.join(root, "models/example"), {recursive: true}); fs.writeFileSync(path.join(root, file), YAML.stringify({variants: [ - {id: "default", default: true, chart: {name: "sglang", version: "0.7.1"}}, - {id: "other", chart: {name: "sglang", version: ">=0.7.1"}, values: {extraArgs: ["--other"]}} + {id: "default", default: true, chart: {name: "sglang", version: "0.8.0"}}, + {id: "other", chart: {name: "sglang", version: ">=0.8.0"}, values: {extraArgs: ["--other"]}} ]})); fs.mkdirSync(path.join(root, "schema/helm"), {recursive: true}); fs.writeFileSync(path.join(root, "schema/helm/provenance.json"), JSON.stringify({converterVersion: config.converterVersion, sources: []})); @@ -32,12 +32,12 @@ function fixture(t, failure) { const dir = path.join(opts.env.HELM_CACHE_HOME, "repository"); fs.mkdirSync(dir, {recursive: true}); fs.writeFileSync(path.join(dir, "catalog-index.yaml"), YAML.stringify({entries: {sglang: [ - {version: "0.7.1", digest: crypto.createHash("sha256").update(bytes).digest("hex")} + {version: "0.8.0", digest: crypto.createHash("sha256").update(bytes).digest("hex")} ]}})); - } else if (args[0] === "search") stdout = JSON.stringify(failure === "resolution" ? [] : [{name: "catalog/sglang", version: "0.7.1"}]); - else if (args[0] === "pull") fs.writeFileSync(path.join(args.at(-1), "sglang-0.7.1.tgz"), bytes); + } else if (args[0] === "search") stdout = JSON.stringify(failure === "resolution" ? [] : [{name: "catalog/sglang", version: "0.8.0"}]); + else if (args[0] === "pull") fs.writeFileSync(path.join(args.at(-1), "sglang-0.8.0.tgz"), bytes); else if (args[0] === "-tzf") stdout = failure === "schema" ? "sglang/Chart.yaml\n" : "sglang/Chart.yaml\nsglang/values.schema.json\n"; - else if (args[0] === "show") stdout = "name: sglang\nversion: 0.7.1\n"; + else if (args[0] === "show") stdout = "name: sglang\nversion: 0.8.0\n"; else if (args[0] === "template") stdout = failure === "empty" ? "" : "apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: example\n"; const stage = args[0] === "-strict" ? "kubeconform" : args[0] === "pull" ? "download" : args[0]; const ok = stage !== failure; @@ -54,7 +54,7 @@ test("every variant uses independent values and the resolved package is reused", assert.equal(f.run(), true); const s = f.summary(); assert.equal(s.results.length, 2); - assert(s.results.every((r) => r.ok && r.chart.version === "0.7.1" && r.chart.digest.startsWith("sha256:"))); + assert(s.results.every((r) => r.ok && r.chart.version === "0.8.0" && r.chart.digest.startsWith("sha256:"))); assert.equal(f.calls.filter((a) => a[0] === "pull").length, 1); const values = s.results.map((r) => YAML.parse(fs.readFileSync(path.join(f.root, r.artifacts, "values.yaml"), "utf8"))); assert.equal(values[0].extraArgs, undefined); diff --git a/hack/validate-schema.js b/hack/validate-schema.js index 4165bb7..754535f 100644 --- a/hack/validate-schema.js +++ b/hack/validate-schema.js @@ -67,7 +67,7 @@ function detail(err) { case "pattern": // The chart.version pattern is a generated grammar nobody reads. if (err.instancePath.endsWith("/chart/version")) { - return `must be a chart version or a range, e.g. 0.7.1, ">=0.7.1", "^0.7.1"${got}` + return `must be a chart version or a range, e.g. 0.8.0, ">=0.8.0", "^0.8.0"${got}` } return `must match /${params.pattern}/${got}` case "type": diff --git a/models/deepseek-v4-flash-0731/deepseek-v4-flash-0731-1.0.0.yaml b/models/deepseek-v4-flash-0731/deepseek-v4-flash-0731-1.0.0.yaml index 837ad43..7d8a2f3 100644 --- a/models/deepseek-v4-flash-0731/deepseek-v4-flash-0731-1.0.0.yaml +++ b/models/deepseek-v4-flash-0731/deepseek-v4-flash-0731-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 @@ -79,7 +79,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 diff --git a/models/deepseek-v4-flash/deepseek-v4-flash-1.0.0.yaml b/models/deepseek-v4-flash/deepseek-v4-flash-1.0.0.yaml index 2ed49ac..64f6a45 100644 --- a/models/deepseek-v4-flash/deepseek-v4-flash-1.0.0.yaml +++ b/models/deepseek-v4-flash/deepseek-v4-flash-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -79,7 +79,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/deepseek-v4.1-flash/deepseek-v4.1-flash-1.0.0.yaml b/models/deepseek-v4.1-flash/deepseek-v4.1-flash-1.0.0.yaml index 1e6aaae..432091a 100644 --- a/models/deepseek-v4.1-flash/deepseek-v4.1-flash-1.0.0.yaml +++ b/models/deepseek-v4.1-flash/deepseek-v4.1-flash-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -88,7 +88,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml b/models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml index 7097657..62ede64 100644 --- a/models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml +++ b/models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 @@ -80,7 +80,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 diff --git a/models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml b/models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml index 535ab66..24fcbd7 100644 --- a/models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml +++ b/models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: glm-5.3-flash @@ -81,7 +81,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: glm-5.3-flash diff --git a/models/glm5.1/glm5.1-1.0.0.yaml b/models/glm5.1/glm5.1-1.0.0.yaml index 3d180c0..b1549ee 100644 --- a/models/glm5.1/glm5.1-1.0.0.yaml +++ b/models/glm5.1/glm5.1-1.0.0.yaml @@ -13,7 +13,7 @@ variants: description: TP2 on two GPUs, single node. chart: name: sglang - version: ">=0.7.0" + version: ">=0.8.0" image: repository: harbor-contest.4pd.io/lijiashu/sglang tag: v0.5.10.post1 diff --git a/models/glm5.3/glm5.3-1.0.0.yaml b/models/glm5.3/glm5.3-1.0.0.yaml index f6e6128..d7d1313 100644 --- a/models/glm5.3/glm5.3-1.0.0.yaml +++ b/models/glm5.3/glm5.3-1.0.0.yaml @@ -13,7 +13,7 @@ variants: description: TP4 on four B300 GPUs. NVFP4 weights, EAGLE speculative decoding, hierarchical KV cache. chart: name: sglang - version: 0.7.1 + version: 0.8.0 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 diff --git a/models/glm5.3/glm5.3-1.0.1.yaml b/models/glm5.3/glm5.3-1.0.1.yaml index a765aff..977abfc 100644 --- a/models/glm5.3/glm5.3-1.0.1.yaml +++ b/models/glm5.3/glm5.3-1.0.1.yaml @@ -13,7 +13,7 @@ variants: description: TP4 on four B300 GPUs. NVFP4 weights, EAGLE speculative decoding, hierarchical KV cache. chart: name: sglang - version: ">=0.7.8" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 diff --git a/models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml b/models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml index 717a5a4..3979a7a 100644 --- a/models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml +++ b/models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml @@ -8,7 +8,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -80,7 +80,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/hy3/hy3-1.0.0.yaml b/models/hy3/hy3-1.0.0.yaml index 281230f..8c98adf 100644 --- a/models/hy3/hy3-1.0.0.yaml +++ b/models/hy3/hy3-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -80,7 +80,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/kimi-k2.5/kimi-k2.5-1.0.0.yaml b/models/kimi-k2.5/kimi-k2.5-1.0.0.yaml index 94da877..f5ad527 100644 --- a/models/kimi-k2.5/kimi-k2.5-1.0.0.yaml +++ b/models/kimi-k2.5/kimi-k2.5-1.0.0.yaml @@ -9,7 +9,7 @@ variants: description: TP8 per node, PP2 across two nodes over IB. chart: name: sglang - version: ">=0.7.0" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.10.post1-gm-fix-v0.1 diff --git a/models/kimi-k3/kimi-k3-1.0.0.yaml b/models/kimi-k3/kimi-k3-1.0.0.yaml index da6a9fe..9bb03f9 100644 --- a/models/kimi-k3/kimi-k3-1.0.0.yaml +++ b/models/kimi-k3/kimi-k3-1.0.0.yaml @@ -11,7 +11,7 @@ variants: description: TP8 with DCP8 on one eight-GPU B300 node, fp8 KV cache, DSPARK speculative decoding. chart: name: sglang - version: 0.7.1 + version: 0.8.0 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 diff --git a/models/kimi-k3/kimi-k3-1.0.1.yaml b/models/kimi-k3/kimi-k3-1.0.1.yaml index ad0f904..c056c6a 100644 --- a/models/kimi-k3/kimi-k3-1.0.1.yaml +++ b/models/kimi-k3/kimi-k3-1.0.1.yaml @@ -9,7 +9,7 @@ variants: description: TP8 with DCP8 on one eight-GPU B300 node, fp8 KV cache, DSPARK speculative decoding. chart: name: sglang - version: 0.7.1 + version: 0.8.0 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 @@ -109,7 +109,7 @@ variants: tag: v0.30.1-nightly-0961bbae-patch chart: name: vllm - version: 0.4.1 + version: 0.5.0 requires: gpus: 8 topology: single-node diff --git a/models/kimi-k3/kimi-k3-1.0.2.yaml b/models/kimi-k3/kimi-k3-1.0.2.yaml index 09aa58a..216dff4 100644 --- a/models/kimi-k3/kimi-k3-1.0.2.yaml +++ b/models/kimi-k3/kimi-k3-1.0.2.yaml @@ -9,7 +9,7 @@ variants: description: TP8 with DCP8 on one eight-GPU B300 node, fp8 KV cache, DSPARK speculative decoding. chart: name: sglang - version: ">=0.7.9" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 @@ -109,7 +109,7 @@ variants: tag: v0.30.1-nightly-0961bbae-patch chart: name: vllm - version: ">=0.4.6" + version: ">=0.5.0" requires: gpus: 8 topology: single-node diff --git a/models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml b/models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml index 0fc5b66..799ada9 100644 --- a/models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml +++ b/models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -82,7 +82,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/ling-3.0-flash-vl/ling-3.0-flash-vl-1.0.0.yaml b/models/ling-3.0-flash-vl/ling-3.0-flash-vl-1.0.0.yaml index eae4d1b..15a689f 100644 --- a/models/ling-3.0-flash-vl/ling-3.0-flash-vl-1.0.0.yaml +++ b/models/ling-3.0-flash-vl/ling-3.0-flash-vl-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-Ling-3.0-flash-VL @@ -82,7 +82,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-Ling-3.0-flash-VL diff --git a/models/ling-3.0-flash/ling-3.0-flash-1.0.0.yaml b/models/ling-3.0-flash/ling-3.0-flash-1.0.0.yaml index 306bb06..6782f20 100644 --- a/models/ling-3.0-flash/ling-3.0-flash-1.0.0.yaml +++ b/models/ling-3.0-flash/ling-3.0-flash-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-Ling-3.0-flash-VL @@ -83,7 +83,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-Ling-3.0-flash-VL diff --git a/models/mimo-v2.5/mimo-v2.5-1.0.0.yaml b/models/mimo-v2.5/mimo-v2.5-1.0.0.yaml index 53da94e..4182826 100644 --- a/models/mimo-v2.5/mimo-v2.5-1.0.0.yaml +++ b/models/mimo-v2.5/mimo-v2.5-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -84,7 +84,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/nemotron-3.5-lightning-30b-a3b/nemotron-3.5-lightning-30b-a3b-1.0.0.yaml b/models/nemotron-3.5-lightning-30b-a3b/nemotron-3.5-lightning-30b-a3b-1.0.0.yaml index 9e6759f..7a82dbd 100644 --- a/models/nemotron-3.5-lightning-30b-a3b/nemotron-3.5-lightning-30b-a3b-1.0.0.yaml +++ b/models/nemotron-3.5-lightning-30b-a3b/nemotron-3.5-lightning-30b-a3b-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -85,7 +85,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml b/models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml index c26f6dc..ffaf513 100644 --- a/models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml +++ b/models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -81,7 +81,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml index ff3c5ee..6fe9c4b 100644 --- a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml +++ b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml @@ -9,7 +9,7 @@ variants: description: TP2 on two H100 or H800 GPUs, single node. chart: name: sglang - version: 0.7.1 + version: 0.8.0 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.18-cu129 diff --git a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml index 9b1ae37..50257c8 100644 --- a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml +++ b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml @@ -9,7 +9,7 @@ variants: description: TP2 on two H100 or H800 GPUs, single node. chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.18-cu129 @@ -87,7 +87,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 @@ -157,7 +157,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 diff --git a/models/qwen3.8-27b-fp8/qwen3.8-27b-fp8-1.0.0.yaml b/models/qwen3.8-27b-fp8/qwen3.8-27b-fp8-1.0.0.yaml index 776c9a9..b5ea6b1 100644 --- a/models/qwen3.8-27b-fp8/qwen3.8-27b-fp8-1.0.0.yaml +++ b/models/qwen3.8-27b-fp8/qwen3.8-27b-fp8-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: 0.7.1 + version: 0.8.0 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 @@ -79,7 +79,7 @@ variants: engine: sglang chart: name: sglang - version: 0.7.1 + version: 0.8.0 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 diff --git a/models/qwen3.8-flash-next/qwen3.8-flash-next-1.0.0.yaml b/models/qwen3.8-flash-next/qwen3.8-flash-next-1.0.0.yaml index 1c60cc4..f067047 100644 --- a/models/qwen3.8-flash-next/qwen3.8-flash-next-1.0.0.yaml +++ b/models/qwen3.8-flash-next/qwen3.8-flash-next-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: qwen38flashnext @@ -81,7 +81,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.7.1" + version: ">=0.8.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: qwen38flashnext diff --git a/schema/helm/README.md b/schema/helm/README.md index 816e588..a8a408c 100644 --- a/schema/helm/README.md +++ b/schema/helm/README.md @@ -53,9 +53,25 @@ even on failure. Helm and kubeconform errors retain field paths. [`sources.json`](sources.json) locks upstream CRDs to full commit SHAs. [`provenance.json`](provenance.json) records source URLs, source hashes, served -versions and generated filenames. Both historical and current API groups are -included for `LLMScaler` and `LLMSLORequirement`: chart `0.7.1` uses the older -groups, while later releases use `modelsphere.dev`. +versions and generated filenames. Modelsphere-owned CRDs use only +`routing.modelsphere.dev`, `autoscaling.modelsphere.dev` and +`inference.modelsphere.dev`. Each source declares its expected group and kind; +the generator rejects a mismatched CRD or a Modelsphere source whose group does +not end in `.modelsphere.dev`. + +Catalog chart declarations use `sglang` version `0.8.0` or newer and `vllm` +version `0.5.0` or newer, the first releases using these groups. Fixed pins remain +fixed, and version ranges retain their form with the new minimum. Legacy +`autoscaling.4pd.io` and `inference.x-k8s.io` schemas are removed; resources from +old charts fail validation rather than being rewritten or accepted through aliases. +External CRDs retain their upstream groups: `leaderworkerset.x-k8s.io` for +LeaderWorkerSet and `monitoring.coreos.com` for ServiceMonitor. + +Deployments using the old groups need the corresponding controllers, CRDs, +RBAC and resource objects migrated together. Existing objects under an old API +group do not automatically become objects under the new group. This catalog +change deliberately updates published version declarations; the Pages workflow +requires `allow_rewrites` when publishing those changes. The converter is repository-versioned as `catalog-crd-schema-v1` in [`hack/lib/crd-schema.js`](../../hack/lib/crd-schema.js), using the YAML parser @@ -87,11 +103,12 @@ must regenerate the schemas; bump the converter version when changing an already deployed conversion contract. Tool updates must also update archive checksums in `config.json`. -The acceptance suite checks GLM's fixed and ranged chart declarations, both -Gemma variants, an LWS deployment, default values, misspelled fields, incorrect -types, invalid Kubernetes nesting, invalid CRD fields, template errors, no matching -release, and unknown/mismatched GVKs. Unit tests additionally cover selection, -download failures, a missing chart values schema, empty renders and failure +The acceptance suite checks GLM's fixed and ranged chart declarations, a fixed +vLLM release, both Gemma variants, an LWS deployment, default values, misspelled +fields, incorrect types, invalid Kubernetes nesting, invalid CRD fields, template errors, no matching +release, legacy chart rejection, and unknown/mismatched GVKs. Rendered custom +resources must use the canonical Modelsphere groups. Unit tests additionally +cover selection, download failures, a missing chart values schema, empty renders and failure propagation. ## Rollout and limits diff --git a/schema/helm/crds/autoscaling.4pd.io/llmscaler_v1alpha1.json b/schema/helm/crds/autoscaling.4pd.io/llmscaler_v1alpha1.json deleted file mode 100644 index 5743781..0000000 --- a/schema/helm/crds/autoscaling.4pd.io/llmscaler_v1alpha1.json +++ /dev/null @@ -1,465 +0,0 @@ -{ - "description": "LLMScaler is the Schema for the llmscalers API", - "properties": { - "apiVersion": { - "type": "string", - "enum": [ - "autoscaling.4pd.io/v1alpha1" - ] - }, - "kind": { - "type": "string", - "enum": [ - "LLMScaler" - ] - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" - }, - "spec": { - "description": "spec defines the desired state of LLMScaler", - "properties": { - "customProvider": { - "description": "customProvider configures the Custom metric provider. Required when\nmetricProvider is Custom, ignored otherwise.", - "properties": { - "namespace": { - "description": "namespace optionally narrows the match to decisions carrying this\nnamespace, for a server that reports the same serviceId in several. When\nempty, serviceId alone selects the decision — and a serviceId matching\nmore than one decision is an error rather than a choice, so set this if\nthe server ever reports duplicates.", - "type": "string" - }, - "path": { - "default": "/decisions", - "description": "path is the request path on serverAddress. Defaults to /decisions.", - "type": "string" - }, - "serviceId": { - "description": "serviceId names the service whose decision to read. It is sent as the\nserviceId query parameter and is also matched against\ndecisions[].serviceId in the reply, since the server is free to answer\nwith more than it was asked for.", - "type": "string" - } - }, - "required": [ - "serviceId" - ], - "type": "object", - "additionalProperties": false - }, - "maxReplicas": { - "description": "maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up", - "format": "int32", - "minimum": 1, - "type": "integer" - }, - "metricProvider": { - "default": "Prometheus", - "description": "metricProvider selects where the scaling signal comes from.\n\"Prometheus\" (default) evaluates spec.metrics as PromQL against\nspec.serverAddress and derives replicas from them. \"Custom\" ignores\nspec.metrics entirely and reads a replica count straight off the decision\nserver described by spec.customProvider — the two are alternatives, not\nlayers, and there is no fallback from one to the other.", - "enum": [ - "Prometheus", - "Custom" - ], - "type": "string" - }, - "metrics": { - "description": "metrics contains the specifications for which to use to calculate the\ndesired replica count. Required (and non-empty) under the Prometheus\nprovider; ignored under Custom, which gets its recommendation from the\ndecision server instead.", - "items": { - "description": "MetricSpec defines a Prometheus query and the target value to scale on.", - "properties": { - "name": { - "description": "name is an optional identifier for this metric, used in logs and events.", - "type": "string" - }, - "query": { - "description": "query is a PromQL instant query returning the current metric value as a\nsingle (averaged) scalar. Scaling compares it to target as\n desiredReplicas = ceil(readyReplicas * value / target)\nso it should be a per-replica value — e.g. wrap it in avg(...). Bake any\nlabel filters into the query. Example:\n avg(vllm:kv_cache_usage_perc{model_name=\"opt-125m\"})\nA result of more than one series is an error, not a sample to pick from:\naggregate away every label the source varies on (backend, model, route,\npod). A query that errors, returns no data, or returns NaN/Inf is skipped\nfor that sync rather than read as zero; if every metric is skipped the\nreplica count is held where it is.", - "type": "string" - }, - "target": { - "description": "target is the desired per-replica value of the query result. When the\nmeasured value exceeds target, replicas scale up proportionally. It must be\na finite positive number on the same scale as the query — a \"%\" suffix is\nrejected, since \"80%\" cannot be resolved without knowing whether the query\nreturns a 0-1 fraction (write \"0.8\") or a 0-100 percentage (write \"80\").", - "type": "string" - } - }, - "required": [ - "query", - "target" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array" - }, - "minReplicas": { - "description": "minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down", - "format": "int32", - "minimum": 1, - "type": "integer" - }, - "preemption": { - "description": "preemption defines whether priority-based preemption is enabled", - "properties": { - "enable": { - "type": "boolean" - }, - "priorityClass": { - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "retryPeriodSeconds": { - "default": 10, - "description": "retryPeriodSeconds is the interval at which the autoscaler retries when an error occurs or target is not found. Defaults to 10.", - "format": "int32", - "type": "integer" - }, - "scaleDown": { - "description": "scaleDown defines the behavior for scaling down, e.g. cache-aware teardown", - "properties": { - "behavior": { - "default": "CacheAware", - "description": "behavior controls how pods are chosen when scaling down.\n\"CacheAware\" (default) biases removal toward the coldest-cache pods by\nsetting a low controller.kubernetes.io/pod-deletion-cost on the pods being\nremoved, so the ReplicaSet deletes them first. This is best-effort and only\napplies to Deployment/ReplicaSet targets — StatefulSet/LWS scale-down is\nordinal-based and ignores the hint. \"None\" opts out and uses the workload\ncontroller's default deletion order.", - "enum": [ - "CacheAware", - "None" - ], - "type": "string" - }, - "deletionCostQuery": { - "description": "deletionCostQuery is an optional PromQL instant query used to compute each\npod's controller.kubernetes.io/pod-deletion-cost at scale-down time (only\napplies when behavior is CacheAware). It is evaluated against\nspec.serverAddress and must return one series per pod\ncarrying a \"pod\" label; the sample value becomes that pod's deletion cost.\nLower cost is deleted first, so the expression should yield lower numbers\nfor colder / less valuable pods (e.g. \"vllm:kv_cache_usage_perc * 100\").\nWhen empty, a newest-pod-first heuristic is used instead. It is PromQL, so\nit is only consulted under the Prometheus metric provider — under Custom,\nspec.serverAddress is a decision server with no query API, and the\nheuristic is used regardless of what is set here.", - "type": "string" - }, - "maxStepReplicas": { - "description": "maxStepReplicas caps how many replicas a single scale-down step may remove,\nso the fleet shrinks gradually instead of dropping straight from N to\nminReplicas when the metric collapses. It bounds the size of a step, not how\noften one happens: the next scale-down also waits for the previous one to\nsettle, so steps are at least syncPeriodSeconds apart and can be further\napart while the target is still converging. A full descent therefore takes\nroughly ceil((current-minReplicas)/maxStepReplicas) steps at that spacing —\non a slow-settling workload prefer a larger step. It rate-limits the write\nonly:\nstatus.desiredReplicas keeps reporting the uncapped recommendation, and\nsubsequent syncs keep stepping toward it until they meet. Scaling never goes\nbelow minReplicas, and scale-up is unaffected. 0 (default) means unlimited —\nscale down straight to the recommendation.", - "format": "int32", - "minimum": 0, - "type": "integer" - }, - "stabilizationWindowSeconds": { - "description": "stabilizationWindowSeconds dampens scale-down: replicas are held at the\nhighest recommendation seen within this many seconds, so a brief metric dip\ndoesn't shrink the fleet. Scale-up is immediate. 0 disables stabilization.", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "serverAddress": { - "description": "serverAddress is the metric source endpoint: the Prometheus query API\n(e.g. http://prometheus:9090) under the Prometheus provider, or the\ndecision server's base URL (e.g. http://decisions:80) under Custom.", - "type": "string" - }, - "serverHeaders": { - "additionalProperties": { - "type": "string" - }, - "description": "serverHeaders are additional HTTP headers sent with every metric-fetch\nrequest to the metric source (e.g. Authorization for a secured endpoint).\nValues are used verbatim.", - "type": "object" - }, - "syncPeriodSeconds": { - "default": 15, - "description": "syncPeriodSeconds is the interval at which the autoscaler evaluates metrics and scales. Defaults to 15.", - "format": "int32", - "type": "integer" - }, - "targetRef": { - "description": "targetRef points to the resource (e.g., Deployment) to scale", - "properties": { - "apiVersion": { - "type": "string" - }, - "kind": { - "type": "string" - }, - "name": { - "type": "string" - } - }, - "required": [ - "apiVersion", - "kind", - "name" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "maxReplicas", - "minReplicas", - "serverAddress", - "targetRef" - ], - "type": "object", - "x-kubernetes-validations": [ - { - "message": "spec.metrics must be non-empty unless spec.metricProvider is Custom", - "rule": "(has(self.metricProvider) && self.metricProvider == 'Custom') || (has(self.metrics) && size(self.metrics) > 0)" - }, - { - "message": "spec.customProvider is required when spec.metricProvider is Custom", - "rule": "!(has(self.metricProvider) && self.metricProvider == 'Custom') || has(self.customProvider)" - } - ], - "additionalProperties": false - }, - "status": { - "description": "status defines the observed state of LLMScaler", - "properties": { - "conditions": { - "description": "conditions represent the current state of the LLMScaler resource.", - "items": { - "description": "Condition contains details for one aspect of the current state of this API Resource.", - "properties": { - "lastTransitionTime": { - "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", - "format": "date-time", - "type": "string" - }, - "message": { - "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", - "maxLength": 32768, - "type": "string" - }, - "observedGeneration": { - "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "reason": { - "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", - "maxLength": 1024, - "minLength": 1, - "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", - "type": "string" - }, - "status": { - "description": "status of the condition, one of True, False, Unknown.", - "enum": [ - "True", - "False", - "Unknown" - ], - "type": "string" - }, - "type": { - "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", - "maxLength": 316, - "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", - "type": "string" - } - }, - "required": [ - "lastTransitionTime", - "message", - "reason", - "status", - "type" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "type" - ], - "x-kubernetes-list-type": "map" - }, - "currentReplicas": { - "description": "currentReplicas is the current number of replicas of pods managed by this autoscaler", - "format": "int32", - "type": "integer" - }, - "desiredReplicas": { - "description": "desiredReplicas is the desired number of replicas of pods managed by this autoscaler", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "spec", - "apiVersion", - "kind", - "metadata" - ], - "type": "object", - "additionalProperties": false, - "$schema": "http://json-schema.org/draft-07/schema#", - "definitions": { - "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { - "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", - "type": "object" - }, - "creationTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "deletionGracePeriodSeconds": { - "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", - "format": "int64", - "type": "integer" - }, - "deletionTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "finalizers": { - "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set", - "x-kubernetes-patch-strategy": "merge" - }, - "generateName": { - "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", - "type": "string" - }, - "generation": { - "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", - "format": "int64", - "type": "integer" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", - "type": "object" - }, - "managedFields": { - "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "namespace": { - "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", - "type": "string" - }, - "ownerReferences": { - "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "uid" - ], - "x-kubernetes-list-type": "map", - "x-kubernetes-patch-merge-key": "uid", - "x-kubernetes-patch-strategy": "merge" - }, - "resourceVersion": { - "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", - "type": "string" - }, - "selfLink": { - "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", - "type": "string" - }, - "uid": { - "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { - "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", - "format": "date-time", - "type": "string" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { - "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", - "type": "string" - }, - "fieldsType": { - "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", - "type": "string" - }, - "fieldsV1": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", - "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." - }, - "manager": { - "description": "Manager is an identifier of the workflow managing these fields.", - "type": "string" - }, - "operation": { - "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", - "type": "string" - }, - "subresource": { - "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", - "type": "string" - }, - "time": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { - "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", - "type": "object" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { - "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", - "properties": { - "apiVersion": { - "description": "API version of the referent.", - "type": "string" - }, - "blockOwnerDeletion": { - "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", - "type": "boolean" - }, - "controller": { - "description": "If true, this reference points to the managing controller.", - "type": "boolean" - }, - "kind": { - "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "name": { - "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "uid": { - "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "required": [ - "apiVersion", - "kind", - "name", - "uid" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - } -} diff --git a/schema/helm/crds/inference.x-k8s.io/llmslorequirement_v1alpha1.json b/schema/helm/crds/inference.x-k8s.io/llmslorequirement_v1alpha1.json deleted file mode 100644 index 50fa938..0000000 --- a/schema/helm/crds/inference.x-k8s.io/llmslorequirement_v1alpha1.json +++ /dev/null @@ -1,462 +0,0 @@ -{ - "properties": { - "spec": { - "properties": { - "maximumDeployment": { - "properties": { - "type": { - "default": "replica", - "enum": [ - "replica" - ], - "type": "string" - }, - "value": { - "minimum": 1, - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "minimumDeployment": { - "default": { - "type": "replica", - "value": 1 - }, - "properties": { - "type": { - "default": "replica", - "enum": [ - "replica", - "concurrency" - ], - "type": "string" - }, - "value": { - "default": 1, - "minimum": 1, - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "otps": { - "description": "Output Tokens Per Second (OTPS) SLO configuration.", - "properties": { - "default": { - "description": "Default fallback metrics applied when input does not hit any specific range.", - "properties": { - "metrics": { - "items": { - "properties": { - "threshold": { - "format": "float", - "minimum": 0, - "type": "number" - }, - "type": { - "enum": [ - "avg", - "p50", - "p80", - "p90", - "p95", - "p99" - ], - "type": "string" - } - }, - "required": [ - "type", - "threshold" - ], - "type": "object", - "additionalProperties": false - }, - "minItems": 1, - "type": "array" - } - }, - "required": [ - "metrics" - ], - "type": "object", - "additionalProperties": false - }, - "ranges": { - "items": { - "properties": { - "contextLengthRangeHigh": { - "minimum": 1, - "type": "integer" - }, - "contextLengthRangeLow": { - "minimum": 0, - "type": "integer" - }, - "metrics": { - "description": "Multiple metric definitions (p50, p90, etc.) for this context range.", - "items": { - "properties": { - "threshold": { - "format": "float", - "minimum": 0, - "type": "number" - }, - "type": { - "enum": [ - "avg", - "p50", - "p80", - "p90", - "p95", - "p99" - ], - "type": "string" - } - }, - "required": [ - "type", - "threshold" - ], - "type": "object", - "additionalProperties": false - }, - "minItems": 1, - "type": "array" - } - }, - "required": [ - "contextLengthRangeLow", - "metrics" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array" - } - }, - "type": "object", - "additionalProperties": false - }, - "priority": { - "default": 0, - "description": "Priority level from 0 to 10. Deployments with higher priority acquire nodes first.", - "maximum": 10, - "minimum": 0, - "type": "integer" - }, - "serviceId": { - "description": "Identifier referencing the target service.", - "type": "string" - }, - "ttft": { - "description": "Time To First Token (TTFT) SLO configuration.", - "properties": { - "default": { - "description": "Default fallback metrics applied when input does not hit any specific range.", - "properties": { - "metrics": { - "items": { - "properties": { - "threshold": { - "format": "float", - "minimum": 0, - "type": "number" - }, - "type": { - "enum": [ - "avg", - "p50", - "p80", - "p90", - "p95", - "p99" - ], - "type": "string" - } - }, - "required": [ - "type", - "threshold" - ], - "type": "object", - "additionalProperties": false - }, - "minItems": 1, - "type": "array" - } - }, - "required": [ - "metrics" - ], - "type": "object", - "additionalProperties": false - }, - "ranges": { - "items": { - "properties": { - "contextLengthRangeHigh": { - "minimum": 1, - "type": "integer" - }, - "contextLengthRangeLow": { - "minimum": 0, - "type": "integer" - }, - "metrics": { - "description": "Multiple metric definitions (p50, p90, etc.) for this context range.", - "items": { - "properties": { - "threshold": { - "format": "float", - "minimum": 0, - "type": "number" - }, - "type": { - "enum": [ - "avg", - "p50", - "p80", - "p90", - "p95", - "p99" - ], - "type": "string" - } - }, - "required": [ - "type", - "threshold" - ], - "type": "object", - "additionalProperties": false - }, - "minItems": 1, - "type": "array" - } - }, - "required": [ - "contextLengthRangeLow", - "metrics" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "serviceId" - ], - "type": "object", - "additionalProperties": false - }, - "apiVersion": { - "type": "string", - "enum": [ - "inference.x-k8s.io/v1alpha1" - ] - }, - "kind": { - "type": "string", - "enum": [ - "LLMSLORequirement" - ] - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" - } - }, - "type": "object", - "additionalProperties": false, - "$schema": "http://json-schema.org/draft-07/schema#", - "definitions": { - "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { - "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", - "type": "object" - }, - "creationTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "deletionGracePeriodSeconds": { - "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", - "format": "int64", - "type": "integer" - }, - "deletionTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "finalizers": { - "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set", - "x-kubernetes-patch-strategy": "merge" - }, - "generateName": { - "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", - "type": "string" - }, - "generation": { - "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", - "format": "int64", - "type": "integer" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", - "type": "object" - }, - "managedFields": { - "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "namespace": { - "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", - "type": "string" - }, - "ownerReferences": { - "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "uid" - ], - "x-kubernetes-list-type": "map", - "x-kubernetes-patch-merge-key": "uid", - "x-kubernetes-patch-strategy": "merge" - }, - "resourceVersion": { - "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", - "type": "string" - }, - "selfLink": { - "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", - "type": "string" - }, - "uid": { - "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { - "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", - "format": "date-time", - "type": "string" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { - "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", - "type": "string" - }, - "fieldsType": { - "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", - "type": "string" - }, - "fieldsV1": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", - "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." - }, - "manager": { - "description": "Manager is an identifier of the workflow managing these fields.", - "type": "string" - }, - "operation": { - "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", - "type": "string" - }, - "subresource": { - "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", - "type": "string" - }, - "time": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { - "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", - "type": "object" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { - "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", - "properties": { - "apiVersion": { - "description": "API version of the referent.", - "type": "string" - }, - "blockOwnerDeletion": { - "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", - "type": "boolean" - }, - "controller": { - "description": "If true, this reference points to the managing controller.", - "type": "boolean" - }, - "kind": { - "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "name": { - "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "uid": { - "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "required": [ - "apiVersion", - "kind", - "name", - "uid" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "required": [ - "apiVersion", - "kind", - "metadata" - ] -} diff --git a/schema/helm/provenance.json b/schema/helm/provenance.json index 3688c3b..27c1683 100644 --- a/schema/helm/provenance.json +++ b/schema/helm/provenance.json @@ -10,6 +10,7 @@ "commit": "b07623f8179a31cd63545d4077fa21c253b608dd", "path": "config/crd/bases/routing.modelsphere.dev_modelroutes.yaml", "kind": "ModelRoute", + "group": "routing.modelsphere.dev", "url": "https://raw.githubusercontent.com/modelsphere/autoconfig/b07623f8179a31cd63545d4077fa21c253b608dd/config/crd/bases/routing.modelsphere.dev_modelroutes.yaml", "sha256": "ee2397f6a5636f585c5ec9b96abf46ef0b68df758beb94abd048236340554e2f", "schemas": [ @@ -21,27 +22,12 @@ } ] }, - { - "repository": "modelsphere/llm-operator", - "commit": "47d2040748b20bd8f73cad587df556d3b29e4842", - "path": "config/crd/bases/autoscaling.4pd.io_llmscalers.yaml", - "kind": "LLMScaler", - "url": "https://raw.githubusercontent.com/modelsphere/llm-operator/47d2040748b20bd8f73cad587df556d3b29e4842/config/crd/bases/autoscaling.4pd.io_llmscalers.yaml", - "sha256": "ad25f5946a732fb3021485298db31dbec2a2d9b4285f14a9b31d33b2ea517115", - "schemas": [ - { - "file": "autoscaling.4pd.io/llmscaler_v1alpha1.json", - "group": "autoscaling.4pd.io", - "version": "v1alpha1", - "kind": "LLMScaler" - } - ] - }, { "repository": "modelsphere/llm-operator", "commit": "3583a1fae4b979fd506f81be9317d3316395fc00", "path": "config/crd/bases/autoscaling.modelsphere.dev_llmscalers.yaml", "kind": "LLMScaler", + "group": "autoscaling.modelsphere.dev", "url": "https://raw.githubusercontent.com/modelsphere/llm-operator/3583a1fae4b979fd506f81be9317d3316395fc00/config/crd/bases/autoscaling.modelsphere.dev_llmscalers.yaml", "sha256": "72168fc74a2603ad726ad6a85a2cb7737d105cc4e3e8eeea4284ff87f3a85214", "schemas": [ @@ -53,27 +39,12 @@ } ] }, - { - "repository": "modelsphere/helm-charts", - "commit": "46c4a9c4c90274bb2c6d9fbfe2617d5b39e2eccc", - "path": "charts/llm-slo-decision-gen/crds/llmslorequirements.inference.x-k8s.io.yaml", - "kind": "LLMSLORequirement", - "url": "https://raw.githubusercontent.com/modelsphere/helm-charts/46c4a9c4c90274bb2c6d9fbfe2617d5b39e2eccc/charts/llm-slo-decision-gen/crds/llmslorequirements.inference.x-k8s.io.yaml", - "sha256": "9e2744ddd82995bd5404797d23ee19ae6dfc9b76d77b9f29c3a8f76da1661352", - "schemas": [ - { - "file": "inference.x-k8s.io/llmslorequirement_v1alpha1.json", - "group": "inference.x-k8s.io", - "version": "v1alpha1", - "kind": "LLMSLORequirement" - } - ] - }, { "repository": "modelsphere/helm-charts", "commit": "8c2ca99e4576aafbdd17107a3c55fb391b2473c4", "path": "charts/llm-slo-decision-gen/crds/llmslorequirements.inference.modelsphere.dev.yaml", "kind": "LLMSLORequirement", + "group": "inference.modelsphere.dev", "url": "https://raw.githubusercontent.com/modelsphere/helm-charts/8c2ca99e4576aafbdd17107a3c55fb391b2473c4/charts/llm-slo-decision-gen/crds/llmslorequirements.inference.modelsphere.dev.yaml", "sha256": "a16199665872f1d2b78cb008bcfff3d232db59595e1f8c820f648c85720a511a", "schemas": [ @@ -90,6 +61,7 @@ "commit": "03254992e177a706fc531572376a3d3153addc93", "path": "config/crd/bases/leaderworkerset.x-k8s.io_leaderworkersets.yaml", "kind": "LeaderWorkerSet", + "group": "leaderworkerset.x-k8s.io", "url": "https://raw.githubusercontent.com/kubernetes-sigs/lws/03254992e177a706fc531572376a3d3153addc93/config/crd/bases/leaderworkerset.x-k8s.io_leaderworkersets.yaml", "sha256": "1554930d16a4c48bbfca4952afbf877c2814f9f751e0f9694e6c22ef3206a518", "schemas": [ @@ -106,6 +78,7 @@ "commit": "5b656b46d40ee3de0c444e55bce82871b42aa959", "path": "example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml", "kind": "ServiceMonitor", + "group": "monitoring.coreos.com", "url": "https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/5b656b46d40ee3de0c444e55bce82871b42aa959/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml", "sha256": "31bdff398b54ac2bc993a33f5dcb0472792a77104a6a609d264c8f1f17829769", "schemas": [ diff --git a/schema/helm/sources.json b/schema/helm/sources.json index f2bec3c..1d20a07 100644 --- a/schema/helm/sources.json +++ b/schema/helm/sources.json @@ -4,43 +4,36 @@ "repository": "modelsphere/autoconfig", "commit": "b07623f8179a31cd63545d4077fa21c253b608dd", "path": "config/crd/bases/routing.modelsphere.dev_modelroutes.yaml", - "kind": "ModelRoute" - }, - { - "repository": "modelsphere/llm-operator", - "commit": "47d2040748b20bd8f73cad587df556d3b29e4842", - "path": "config/crd/bases/autoscaling.4pd.io_llmscalers.yaml", - "kind": "LLMScaler" + "kind": "ModelRoute", + "group": "routing.modelsphere.dev" }, { "repository": "modelsphere/llm-operator", "commit": "3583a1fae4b979fd506f81be9317d3316395fc00", "path": "config/crd/bases/autoscaling.modelsphere.dev_llmscalers.yaml", - "kind": "LLMScaler" - }, - { - "repository": "modelsphere/helm-charts", - "commit": "46c4a9c4c90274bb2c6d9fbfe2617d5b39e2eccc", - "path": "charts/llm-slo-decision-gen/crds/llmslorequirements.inference.x-k8s.io.yaml", - "kind": "LLMSLORequirement" + "kind": "LLMScaler", + "group": "autoscaling.modelsphere.dev" }, { "repository": "modelsphere/helm-charts", "commit": "8c2ca99e4576aafbdd17107a3c55fb391b2473c4", "path": "charts/llm-slo-decision-gen/crds/llmslorequirements.inference.modelsphere.dev.yaml", - "kind": "LLMSLORequirement" + "kind": "LLMSLORequirement", + "group": "inference.modelsphere.dev" }, { "repository": "kubernetes-sigs/lws", "commit": "03254992e177a706fc531572376a3d3153addc93", "path": "config/crd/bases/leaderworkerset.x-k8s.io_leaderworkersets.yaml", - "kind": "LeaderWorkerSet" + "kind": "LeaderWorkerSet", + "group": "leaderworkerset.x-k8s.io" }, { "repository": "prometheus-operator/prometheus-operator", "commit": "5b656b46d40ee3de0c444e55bce82871b42aa959", "path": "example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml", - "kind": "ServiceMonitor" + "kind": "ServiceMonitor", + "group": "monitoring.coreos.com" } ] } diff --git a/schema/version.schema.json b/schema/version.schema.json index 6073cb7..29783d8 100644 --- a/schema/version.schema.json +++ b/schema/version.schema.json @@ -92,7 +92,7 @@ ] }, "version": { - "description": "One chart version, or a range of them in helm's constraint syntax. A bare version pins exactly: 0.7.1 is 0.7.1 and nothing else. A range lets a chart fix reach this model version without publishing a new one: >=0.7.1, ^0.7.1 (0.7.x from 0.7.1), >=0.7.1 <0.9.0. A deploy records the one version the range resolved to, so the deploy itself stays pinned. Prereleases match only a range that names one.", + "description": "One chart version, or a range of them in helm's constraint syntax. A bare version pins exactly: 0.8.0 is 0.8.0 and nothing else. A range lets a chart fix reach this model version without publishing a new one: >=0.8.0, ^0.8.0 (0.8.x from 0.8.0), >=0.8.0 <0.9.0. A deploy records the one version the range resolved to, so the deploy itself stays pinned. Prereleases match only a range that names one.", "type": "string", "pattern": "^(v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?\\s+-\\s+v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?|(=|!=|>=?|<=?|~>?|\\^)?\\s*v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?)((\\s*,\\s*|\\s+)(v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?\\s+-\\s+v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?|(=|!=|>=?|<=?|~>?|\\^)?\\s*v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?))*(\\s*\\|\\|\\s*(v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?\\s+-\\s+v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?|(=|!=|>=?|<=?|~>?|\\^)?\\s*v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?)((\\s*,\\s*|\\s+)(v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?\\s+-\\s+v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?|(=|!=|>=?|<=?|~>?|\\^)?\\s*v?(\\d+|[xX*])(\\.(\\d+|[xX*])){0,2}(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?))*)*$" } From 6b2b9a98520d56bc117a0e1ae540a057799185d0 Mon Sep 17 00:00:00 2001 From: wenyunqing Date: Thu, 8 Oct 2026 19:05:42 +0800 Subject: [PATCH 4/8] feat(ci): validate model values against latest stable charts Resolve the newest stable sglang >=0.8.0 and vllm >=0.5.0 from a fresh repository snapshot for each validation run, independently of deployment pins. Keep declared releases resolvable above the baseline and provide a declared mode for reproducing deployment compatibility. Record both versions and the package digest in validation artifacts. Validate all 43 catalog variants against sglang 0.8.11 and vllm 0.7.6. Cover future releases, prerelease exclusion, missing releases and both validation modes with unit and released-chart integration tests. --- .github/workflows/lint.yml | 4 +- README.md | 7 +- hack/validate-helm.integration.test.js | 171 ++++++++++++++----------- hack/validate-helm.js | 53 +++++--- hack/validate-helm.test.js | 74 +++++++++-- schema/helm/README.md | 49 +++++-- schema/helm/config.json | 4 + 7 files changed, 241 insertions(+), 121 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index ac50503..2655b43 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -52,10 +52,10 @@ jobs: - name: Install pinned Helm and kubeconform run: npm run helm:install - - name: Validate changed model variants + - name: Validate changed model variants against latest stable charts env: BASE_REF: ${{ github.event.pull_request.base.sha }} - run: npm run validate:helm -- --base "$BASE_REF" + run: npm run validate:helm -- --base "$BASE_REF" --chart-mode latest - name: Save Helm validation logs and manifests if: always() diff --git a/README.md b/README.md index 9a84378..e83d034 100644 --- a/README.md +++ b/README.md @@ -117,9 +117,11 @@ A published catalog is a static site, and `./hack/serve.sh` is the smallest thing that behaves like one: it rebuilds the index, then serves the tree. PRs also run the independent `validate-helm` check on every variant in changed -version YAMLs, using the declared released chart, Helm's values schema and -strict Kubernetes/CRD schemas. See [Helm validation](schema/helm/README.md) for +version YAMLs, using the latest stable released chart for each engine, Helm's +values schema and strict Kubernetes/CRD schemas. See [Helm validation](schema/helm/README.md) for local commands, schema updates, artifacts, and validation limits. +Deployment still follows the YAML chart declaration. Use `--chart-mode declared` +with `npm run validate:helm` to reproduce that release locally. ## Versions are immutable @@ -324,4 +326,3 @@ exist until the site is deployed. swissd refuses an index with a field it does not know. A field added to `index.json` -- `site` and `tuning` among them -- has to be understood by every swissd reading this catalog before it merges: the next deploy publishes it. - diff --git a/hack/validate-helm.integration.test.js b/hack/validate-helm.integration.test.js index 76ae7d0..e763f1f 100644 --- a/hack/validate-helm.integration.test.js +++ b/hack/validate-helm.integration.test.js @@ -12,81 +12,98 @@ const {main} = require("./validate-helm"); const {command, kubeconformArgs} = require("./lib/helm-validation"); const config = require("../schema/helm/config.json"); -test("released charts: fixed/range versions, all example variants, LWS, defaults and invalid configurations", {timeout: 240000}, (t) => { - const temp = fs.mkdtempSync(path.join(os.tmpdir(), "helm-acceptance-")); - t.after(() => fs.rmSync(temp, {recursive: true, force: true})); - fs.mkdirSync(path.join(temp, "models/fixtures"), {recursive: true}); - fs.mkdirSync(path.join(temp, "schema")); - fs.symlinkSync(path.join(root, "schema/helm"), path.join(temp, "schema/helm"), "dir"); - fs.symlinkSync(path.join(root, ".cache"), path.join(temp, ".cache"), "dir"); - function write(name, doc) { - fs.writeFileSync(path.join(temp, `models/fixtures/${name}.yaml`), YAML.stringify(doc)); - } - for (const [name, file] of [ - ["valid-fixed", "models/glm5.3/glm5.3-1.0.0.yaml"], - ["valid-range", "models/glm5.3/glm5.3-1.0.1.yaml"], - ["valid-gemma", "models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml"], - ["valid-lws", "models/kimi-k2.5/kimi-k2.5-1.0.0.yaml"] - ]) write(name, YAML.parse(fs.readFileSync(path.join(root, file), "utf8"))); - const vllm = YAML.parse(fs.readFileSync(path.join(root, "models/kimi-k3/kimi-k3-1.0.1.yaml"), "utf8")); - vllm.variants = vllm.variants.filter((v) => v.chart.name === "vllm"); - write("valid-vllm-fixed", vllm); - const base = {variants: [{id: "fixture", chart: {name: "sglang", version: ">=0.8.0"}}]}; - write("valid-defaults", base); - const invalids = [ - ["bad-key", {unkownField: true}, "lint"], - ["bad-type", {service: {port: "bad"}}, "lint"], - ["bad-env", {env: [{name: "TEST", value: "x", misspelled: true}]}, "kubeconform"], - ["bad-volume", {volumes: [{name: "bad", emptyDir: {misspelled: true}}]}, "kubeconform"], - ["bad-resources", {resources: {requsets: {cpu: "1"}}}, "kubeconform"], - ["bad-crd", {sloRequirement: {extraSpec: {unknownSpecField: true}}}, "kubeconform"], - ["bad-template", {sloRequirement: {extraSpec: {serviceId: "duplicate"}}}, "template"], - ["bad-explicit-route", {modelRoute: {nginx: {outputConfigMap: ""}}}, "template"] - ]; - for (const [name, values] of invalids) { - const doc = structuredClone(base); doc.variants[0].values = values; write(name, doc); - } - const noVersion = structuredClone(base); noVersion.variants[0].chart.version = "9999.0.0"; - write("bad-resolution", noVersion); - const legacy = structuredClone(base); legacy.variants[0].chart.version = "0.7.1"; - write("bad-legacy-chart", legacy); - const output = path.join(temp, "artifacts"); - assert.equal(main({all: true, files: [], output}, {repositoryRoot: temp}), false); - const summary = JSON.parse(fs.readFileSync(path.join(output, "summary.json"), "utf8")); - for (const result of summary.results.filter((r) => path.basename(r.file).startsWith("valid-"))) { - assert.equal(result.ok, true, `${result.file}: ${JSON.stringify(result)}`); - const expected = {LLMScaler: "autoscaling.modelsphere.dev/v1alpha1", LLMSLORequirement: "inference.modelsphere.dev/v1alpha1", - ModelRoute: "routing.modelsphere.dev/v1alpha1"}; - const rendered = YAML.parseAllDocuments(fs.readFileSync(path.join(temp, result.artifacts, "rendered.yaml"), "utf8")); - for (const doc of rendered) { - const resource = doc.toJS(); - if (expected[resource?.kind]) assert.equal(resource.apiVersion, expected[resource.kind], result.file); +for (const chartMode of ["latest", "declared"]) { + test(`released charts (${chartMode}): fixed/range versions, all example variants, LWS, defaults and invalid configurations`, {timeout: 240000}, (t) => { + const temp = fs.mkdtempSync(path.join(os.tmpdir(), "helm-acceptance-")); + t.after(() => fs.rmSync(temp, {recursive: true, force: true})); + fs.mkdirSync(path.join(temp, "models/fixtures"), {recursive: true}); + fs.mkdirSync(path.join(temp, "schema")); + fs.symlinkSync(path.join(root, "schema/helm"), path.join(temp, "schema/helm"), "dir"); + fs.symlinkSync(path.join(root, ".cache"), path.join(temp, ".cache"), "dir"); + function write(name, doc) { + fs.writeFileSync(path.join(temp, `models/fixtures/${name}.yaml`), YAML.stringify(doc)); } - } - const fixed = summary.results.find((r) => r.file.endsWith("valid-fixed.yaml")); - assert.equal(fixed.chart.version, "0.8.0"); - assert.equal(summary.results.find((r) => r.file.endsWith("valid-vllm-fixed.yaml")).chart.version, "0.5.0"); - assert.equal(summary.results.filter((r) => r.file.endsWith("valid-gemma.yaml")).length, 2); - for (const [name, , stage] of invalids) { - const result = summary.results.find((r) => r.file.endsWith(`${name}.yaml`)); - assert.equal(result.ok, false, name); - assert.equal(result.stages[stage], false, `${name}: ${JSON.stringify(result)}`); - } - assert.match(summary.results.find((r) => r.file.endsWith("bad-resolution.yaml")).error, /no published/); - assert.equal(summary.results.find((r) => r.file.endsWith("bad-legacy-chart.yaml")).stages.kubeconform, false); - // Verify the exact production kubeconform invocation fails for unknown GVKs, - // even if their kind resembles an existing native resource or known CRD. - const cache = path.join(temp, "schema-cache"); fs.mkdirSync(cache); - for (const [apiVersion, kind] of [ - ["unknown.example/v1", "Unknown"], ["wrong.example/v1", "ModelRoute"], - ["routing.modelsphere.dev/v9", "ModelRoute"], ["apps.wrong.example/v1", "Deployment"], - ["autoscaling.4pd.io/v1alpha1", "LLMScaler"], ["inference.x-k8s.io/v1alpha1", "LLMSLORequirement"], - ["routing.gpucluster.io/v1alpha1", "ModelRoute"] - ]) { - const rendered = path.join(temp, "unknown.yaml"); - fs.writeFileSync(rendered, YAML.stringify({apiVersion, kind, metadata: {name: "unknown"}})); - const result = command(path.join(root, ".cache/helm-validation/bin/kubeconform"), - kubeconformArgs(config, path.join(root, "schema/helm/crds"), cache, rendered)); - assert.equal(result.ok, false, `${apiVersion}/${kind}`); - } -}); + for (const [name, file] of [ + ["valid-fixed", "models/glm5.3/glm5.3-1.0.0.yaml"], + ["valid-range", "models/glm5.3/glm5.3-1.0.1.yaml"], + ["valid-gemma", "models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml"], + ["valid-lws", "models/kimi-k2.5/kimi-k2.5-1.0.0.yaml"] + ]) write(name, YAML.parse(fs.readFileSync(path.join(root, file), "utf8"))); + const vllm = YAML.parse(fs.readFileSync(path.join(root, "models/kimi-k3/kimi-k3-1.0.1.yaml"), "utf8")); + vllm.variants = vllm.variants.filter((v) => v.chart.name === "vllm"); + write("valid-vllm-fixed", vllm); + const base = {variants: [{id: "fixture", chart: {name: "sglang", version: ">=0.8.0"}}]}; + write("valid-defaults", base); + const invalids = [ + ["bad-key", {unkownField: true}, "lint"], + ["bad-type", {service: {port: "bad"}}, "lint"], + ["bad-env", {env: [{name: "TEST", value: "x", misspelled: true}]}, "kubeconform"], + ["bad-volume", {volumes: [{name: "bad", emptyDir: {misspelled: true}}]}, "kubeconform"], + ["bad-resources", {resources: {requsets: {cpu: "1"}}}, "kubeconform"], + ["bad-crd", {sloRequirement: {extraSpec: {unknownSpecField: true}}}, "kubeconform"], + ["bad-template", {sloRequirement: {extraSpec: {serviceId: "duplicate"}}}, "template"], + ["bad-explicit-route", {modelRoute: {nginx: {outputConfigMap: ""}}}, "template"] + ]; + for (const [name, values] of invalids) { + const doc = structuredClone(base); doc.variants[0].values = values; write(name, doc); + } + const noVersion = structuredClone(base); noVersion.variants[0].chart.version = "9999.0.0"; + write("bad-resolution", noVersion); + const legacy = structuredClone(base); legacy.variants[0].chart.version = "0.7.1"; + write("bad-legacy-chart", legacy); + const output = path.join(temp, "artifacts"); + assert.equal(main({all: true, files: [], output, chartMode}, {repositoryRoot: temp}), false); + const summary = JSON.parse(fs.readFileSync(path.join(output, "summary.json"), "utf8")); + for (const result of summary.results.filter((r) => path.basename(r.file).startsWith("valid-"))) { + assert.equal(result.ok, true, `${result.file}: ${JSON.stringify(result)}`); + const expected = {LLMScaler: "autoscaling.modelsphere.dev/v1alpha1", LLMSLORequirement: "inference.modelsphere.dev/v1alpha1", + ModelRoute: "routing.modelsphere.dev/v1alpha1"}; + const rendered = YAML.parseAllDocuments(fs.readFileSync(path.join(temp, result.artifacts, "rendered.yaml"), "utf8")); + for (const doc of rendered) { + const resource = doc.toJS(); + if (expected[resource?.kind]) assert.equal(resource.apiVersion, expected[resource.kind], result.file); + } + } + const fixed = summary.results.find((r) => r.file.endsWith("valid-fixed.yaml")); + const vllmFixed = summary.results.find((r) => r.file.endsWith("valid-vllm-fixed.yaml")); + assert.equal(fixed.chart.declaredVersion, "0.8.0"); + assert.equal(vllmFixed.chart.declaredVersion, "0.5.0"); + if (chartMode === "declared") { + assert.equal(fixed.chart.version, "0.8.0"); + assert.equal(vllmFixed.chart.version, "0.5.0"); + } else { + // Inspect the same snapshot Helm searched, rather than hardcoding today's latest. + const index = YAML.parse(fs.readFileSync(path.join(temp, summary.runDirectory, "helm/cache/repository/catalog-index.yaml"), "utf8")); + const {compareVersions, isPrerelease} = require("./lib/catalog"); + for (const [name, pin] of [["sglang", fixed], ["vllm", vllmFixed]]) { + const latest = index.entries[name].filter((e) => !isPrerelease(e.version) && compareVersions(e.version, config.minimumChartVersions[name]) >= 0) + .sort((a, b) => compareVersions(b.version, a.version))[0].version; + assert.equal(pin.chart.version, latest); + assert(summary.results.filter((r) => r.ok && r.chart.name === name).every((r) => r.chart.version === latest)); + } + } + assert.equal(summary.results.filter((r) => r.file.endsWith("valid-gemma.yaml")).length, 2); + for (const [name, , stage] of invalids) { + const result = summary.results.find((r) => r.file.endsWith(`${name}.yaml`)); + assert.equal(result.ok, false, name); + assert.equal(result.stages[stage], false, `${name}: ${JSON.stringify(result)}`); + } + assert.match(summary.results.find((r) => r.file.endsWith("bad-resolution.yaml")).error, /no published/); + assert.match(summary.results.find((r) => r.file.endsWith("bad-legacy-chart.yaml")).error, /below the required minimum/); + // Verify the exact production kubeconform invocation fails for unknown GVKs, + // even if their kind resembles an existing native resource or known CRD. + const cache = path.join(temp, "schema-cache"); fs.mkdirSync(cache); + for (const [apiVersion, kind] of [ + ["unknown.example/v1", "Unknown"], ["wrong.example/v1", "ModelRoute"], + ["routing.modelsphere.dev/v9", "ModelRoute"], ["apps.wrong.example/v1", "Deployment"], + ["autoscaling.4pd.io/v1alpha1", "LLMScaler"], ["inference.x-k8s.io/v1alpha1", "LLMSLORequirement"], + ["routing.gpucluster.io/v1alpha1", "ModelRoute"] + ]) { + const rendered = path.join(temp, "unknown.yaml"); + fs.writeFileSync(rendered, YAML.stringify({apiVersion, kind, metadata: {name: "unknown"}})); + const result = command(path.join(root, ".cache/helm-validation/bin/kubeconform"), + kubeconformArgs(config, path.join(root, "schema/helm/crds"), cache, rendered)); + assert.equal(result.ok, false, `${apiVersion}/${kind}`); + } + }); +} diff --git a/hack/validate-helm.js b/hack/validate-helm.js index 7f8993c..05a64d3 100644 --- a/hack/validate-helm.js +++ b/hack/validate-helm.js @@ -5,18 +5,18 @@ const fs = require("node:fs"); const path = require("node:path"); const crypto = require("node:crypto"); const YAML = require("yaml"); -const {root} = require("./lib/catalog"); +const {root, compareVersions, isPrerelease} = require("./lib/catalog"); const {command, selectFiles, variantValues, kubeconformArgs, parseVersions} = require("./lib/helm-validation"); const config = require("../schema/helm/config.json"); function options(args) { - const opts = {files: [], output: path.join(root, "artifacts/helm-validation")}; + const opts = {files: [], chartMode: "latest", output: path.join(root, "artifacts/helm-validation")}; for (let i = 0; i < args.length; i++) { const arg = args[i]; if (arg === "--all") opts.all = true; - else if (["--base", "--output"].includes(arg)) { + else if (["--base", "--output", "--chart-mode"].includes(arg)) { if (!args[i + 1] || args[i + 1].startsWith("--")) throw new Error(`${arg}: missing argument`); - opts[arg.slice(2)] = args[++i]; + opts[arg === "--chart-mode" ? "chartMode" : arg.slice(2)] = args[++i]; } else if (arg.startsWith("-")) throw new Error(`unknown option ${arg}`); else opts.files.push(arg); } @@ -24,6 +24,7 @@ function options(args) { throw new Error("choose one of --all, --base REF, or explicit files"); } opts.output = path.resolve(root, opts.output); + if (!["latest", "declared"].includes(opts.chartMode)) throw new Error("--chart-mode must be latest or declared"); return opts; } @@ -32,7 +33,8 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { fs.mkdirSync(opts.output, {recursive: true}); // Each invocation has isolated Helm settings and a fresh repository snapshot. const runDir = fs.mkdtempSync(path.join(opts.output, "run-")); - const summary = {config, files: [], results: []}; + const chartMode = opts.chartMode ?? "latest"; + const summary = {config, chartMode, files: [], results: []}; const writeSummary = () => { const body = JSON.stringify(summary, null, 2) + "\n"; fs.writeFileSync(path.join(opts.output, "summary.json"), body); @@ -59,6 +61,7 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { return result.stdout; }; try { + if (!["latest", "declared"].includes(chartMode)) throw new Error("chartMode must be latest or declared"); const selection = selectFiles(root, opts); Object.assign(summary, selection, {runDirectory: path.relative(root, runDir)}); log(`Selection: ${selection.reason}${selection.mergeBase ? ` (${selection.mergeBase})` : ""}`); @@ -66,7 +69,7 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { log("No model version configuration changes (无版本配置变更)."); return true; } - log(`Validating ${selection.files.length} version files; Kubernetes ${config.kubernetesVersion}.`); + log(`Validating ${selection.files.length} version files; chart mode ${chartMode}; Kubernetes ${config.kubernetesVersion}.`); for (const [name, args] of [["helm", ["version", "--short"]], ["kubeconform", ["-v"]]]) { const version = requireSuccess(invoke(bin(name), args, runDir, `${name}-version`), "tools").trim(); if (!new RegExp(`^v${config[`${name}Version`].replaceAll(".", "\\.")}(?:\\+|$)`).test(version)) { @@ -82,9 +85,23 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { requireSuccess(invoke(bin("helm"), ["repo", "add", "catalog", config.chartRepository], runDir, "chart-repository"), "chart-repository"); const index = YAML.parse(fs.readFileSync(path.join(env.HELM_CACHE_HOME, "repository/catalog-index.yaml"), "utf8")); const requests = new Map(); + const resolutions = new Map(); const packages = new Map(); const chartDir = path.join(runDir, "charts"); fs.mkdirSync(chartDir); + function resolveChart(name, constraint, dir, stage, stableOnly = false) { + const key = JSON.stringify([name, constraint, stableOnly]); + if (!resolutions.has(key)) { + const search = invoke(bin("helm"), ["search", "repo", `catalog/${name}`, "--versions", "--version", constraint, "--output", "json"], dir, stage); + // Helm searches descriptions as well as names. Retain its version order + // and require an exact name; latest checks never select prereleases. + const matches = JSON.parse(requireSuccess(search, stage)).filter((m) => + m.name === `catalog/${name}` && (!stableOnly || !isPrerelease(m.version))); + if (!matches.length) throw new Error(`chart.version: no published ${name} matches ${JSON.stringify(constraint)}${stableOnly ? " (stable releases only)" : ""}`); + resolutions.set(key, matches[0].version); + } + return resolutions.get(key); + } function chartFor(chart, dir) { const requestKey = JSON.stringify(chart); if (requests.has(requestKey)) { @@ -93,12 +110,17 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { return cached; } try { - const search = invoke(bin("helm"), ["search", "repo", `catalog/${chart.name}`, "--versions", "--version", chart.version, "--output", "json"], dir, "chart-resolution"); - // Helm searches descriptions as well as names. Restrict its results to - // the exact declared chart, retaining Helm's version precedence. - const matches = JSON.parse(requireSuccess(search, "chart-resolution")).filter((m) => m.name === `catalog/${chart.name}`); - if (!matches.length) throw new Error(`chart.version: no published ${chart.name} matches ${JSON.stringify(chart.version)}`); - const actualVersion = matches[0].version; + const minimum = config.minimumChartVersions[chart.name]; + if (!minimum) throw new Error(`chart.name: unsupported chart ${chart.name}`); + // Keep deployment declarations resolvable even when rendering against + // latest. A missing or obsolete declared release must still fail CI. + const declaredVersion = resolveChart(chart.name, chart.version, dir, "declared-chart-resolution"); + if (compareVersions(declaredVersion, minimum) < 0) { + throw new Error(`chart.version: ${chart.name} ${declaredVersion} is below the required minimum ${minimum}`); + } + const selectionConstraint = chartMode === "latest" ? `>=${minimum}` : chart.version; + const actualVersion = chartMode === "latest" ? + resolveChart(chart.name, selectionConstraint, dir, "latest-chart-resolution", true) : declaredVersion; const key = `${chart.name}@${actualVersion}`; if (!packages.has(key)) { requireSuccess(invoke(bin("helm"), ["pull", `catalog/${chart.name}`, "--version", actualVersion, "--destination", chartDir], dir, "chart-download"), "chart-download"); @@ -112,7 +134,7 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { if (metadata.name !== chart.name || metadata.version !== actualVersion) throw new Error(`${key}: package metadata mismatch`); packages.set(key, {archive, name: chart.name, actualVersion, digest: `sha256:${digest}`}); } - const pkg = packages.get(key); + const pkg = {...packages.get(key), declaredVersion, selectionConstraint}; requests.set(requestKey, pkg); return pkg; } catch (err) { @@ -145,8 +167,9 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { fs.writeFileSync(valuesFile, YAML.stringify(values)); stage = "chart"; const pkg = chartFor(variant.chart, dir); - record.chart = {name: pkg.name, version: pkg.actualVersion, digest: pkg.digest}; - log(`${label}: chart ${pkg.name}@${pkg.actualVersion} ${pkg.digest}`); + record.chart = {name: pkg.name, version: pkg.actualVersion, digest: pkg.digest, + mode: chartMode, declaredVersion: pkg.declaredVersion, selectionConstraint: pkg.selectionConstraint}; + log(`${label}: declared ${pkg.name} ${variant.chart.version} -> ${pkg.declaredVersion}; validating ${chartMode} chart ${pkg.name}@${pkg.actualVersion} ${pkg.digest}`); fs.writeFileSync(path.join(dir, "chart.json"), JSON.stringify(record.chart, null, 2) + "\n"); const shared = ["--values", valuesFile, "--kube-version", config.kubernetesVersion]; // Run both stages even when lint fails: template can expose separate failures. diff --git a/hack/validate-helm.test.js b/hack/validate-helm.test.js index 6b0c62a..d7c64e7 100644 --- a/hack/validate-helm.test.js +++ b/hack/validate-helm.test.js @@ -10,19 +10,20 @@ const YAML = require("yaml"); const {main, options} = require("./validate-helm"); const config = require("../schema/helm/config.json"); -function fixture(t, failure) { +function fixture(t, failure, {chartName = "sglang", declaredVersion = "0.8.0", latestVersion = "0.8.0"} = {}) { const root = fs.mkdtempSync(path.join(os.tmpdir(), "helm-validator-")); t.after(() => fs.rmSync(root, {recursive: true, force: true})); const file = "models/example/example-1.0.0.yaml"; fs.mkdirSync(path.join(root, "models/example"), {recursive: true}); fs.writeFileSync(path.join(root, file), YAML.stringify({variants: [ - {id: "default", default: true, chart: {name: "sglang", version: "0.8.0"}}, - {id: "other", chart: {name: "sglang", version: ">=0.8.0"}, values: {extraArgs: ["--other"]}} + {id: "default", default: true, chart: {name: chartName, version: declaredVersion}}, + {id: "other", chart: {name: chartName, version: `>=${config.minimumChartVersions[chartName]}`}, values: {extraArgs: ["--other"]}} ]})); fs.mkdirSync(path.join(root, "schema/helm"), {recursive: true}); fs.writeFileSync(path.join(root, "schema/helm/provenance.json"), JSON.stringify({converterVersion: config.converterVersion, sources: []})); const calls = []; const bytes = Buffer.from("fixture-package"); + let prereleaseInserted = false; const runCommand = (bin, args, opts) => { calls.push(args); let stdout = ""; @@ -31,20 +32,32 @@ function fixture(t, failure) { else if (args[0] === "repo") { const dir = path.join(opts.env.HELM_CACHE_HOME, "repository"); fs.mkdirSync(dir, {recursive: true}); - fs.writeFileSync(path.join(dir, "catalog-index.yaml"), YAML.stringify({entries: {sglang: [ - {version: "0.8.0", digest: crypto.createHash("sha256").update(bytes).digest("hex")} - ]}})); - } else if (args[0] === "search") stdout = JSON.stringify(failure === "resolution" ? [] : [{name: "catalog/sglang", version: "0.8.0"}]); - else if (args[0] === "pull") fs.writeFileSync(path.join(args.at(-1), "sglang-0.8.0.tgz"), bytes); - else if (args[0] === "-tzf") stdout = failure === "schema" ? "sglang/Chart.yaml\n" : "sglang/Chart.yaml\nsglang/values.schema.json\n"; - else if (args[0] === "show") stdout = "name: sglang\nversion: 0.8.0\n"; + fs.writeFileSync(path.join(dir, "catalog-index.yaml"), YAML.stringify({entries: {[chartName]: + [...new Set([latestVersion, declaredVersion])].map((version) => ({version, digest: crypto.createHash("sha256").update(bytes).digest("hex")})) + }})); + } else if (args[0] === "search") { + const constraint = args[args.indexOf("--version") + 1]; + const version = constraint === declaredVersion ? declaredVersion : latestVersion; + const matches = failure === "resolution" || failure === "latest-resolution" && constraint.startsWith(">=") ? [] : [{name: `catalog/${chartName}`, version}]; + if (matches.length) matches.unshift({name: `catalog/${chartName}-other`, version: "98.0.0"}); + // Inject a prerelease into the first latest lookup to exercise its filter. + if (failure === "prerelease" && constraint.startsWith(">=") && !prereleaseInserted) { + matches.unshift({name: `catalog/${chartName}`, version: "99.0.0-rc.1"}); + prereleaseInserted = true; + } + stdout = JSON.stringify(matches); + } + else if (args[0] === "pull") fs.writeFileSync(path.join(args.at(-1), `${chartName}-${args[args.indexOf("--version") + 1]}.tgz`), bytes); + else if (args[0] === "-tzf") stdout = failure === "schema" ? `${chartName}/Chart.yaml\n` : `${chartName}/Chart.yaml\n${chartName}/values.schema.json\n`; + else if (args[0] === "show") stdout = YAML.stringify({name: chartName, + version: path.basename(args.at(-1)).slice(chartName.length + 1, -4)}); else if (args[0] === "template") stdout = failure === "empty" ? "" : "apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: example\n"; const stage = args[0] === "-strict" ? "kubeconform" : args[0] === "pull" ? "download" : args[0]; const ok = stage !== failure; return {stdout, ok, log: ok ? stdout : `${stage}: fixture failure at spec.template.spec.containers[0].env[0]\n`}; }; const output = path.join(root, "artifacts"); - const run = () => main({all: true, files: [], output}, {repositoryRoot: root, runCommand}); + const run = (opts = {}) => main({all: true, files: [], output, ...opts}, {repositoryRoot: root, runCommand}); const summary = () => JSON.parse(fs.readFileSync(path.join(output, "summary.json"), "utf8")); return {run, summary, calls, root}; } @@ -62,6 +75,41 @@ test("every variant uses independent values and the resolved package is reused", assert(f.calls.filter((a) => ["lint", "template"].includes(a[0])).every((a) => a.includes(config.kubernetesVersion))); }); +for (const [chartName, declaredVersion, latestVersion] of [["sglang", "0.8.0", "1.2.0"], ["vllm", "0.5.0", "1.3.0"]]) { + test(`${chartName} latest mode checks a future stable release beyond a fixed pin`, (t) => { + const f = fixture(t, "prerelease", {chartName, declaredVersion, latestVersion}); + assert.equal(f.run(), true); + const s = f.summary(); + assert.equal(s.chartMode, "latest"); + assert(s.results.every((r) => r.chart.version === latestVersion)); + assert.equal(s.results[0].chart.declaredVersion, declaredVersion); + assert.equal(s.results[0].declaredChart.version, declaredVersion); + assert.equal(f.calls.filter((a) => a[0] === "pull").length, 1); + assert(f.calls.filter((a) => a[0] === "pull").every((a) => a.includes(latestVersion))); + assert(f.calls.filter((a) => a[0] === "search").every((a) => !a.includes("--devel"))); + }); +} + +test("declared mode checks the fixed deployment release independently of latest", (t) => { + const f = fixture(t, undefined, {latestVersion: "1.2.0"}); + assert.equal(f.run({chartMode: "declared"}), true); + assert.equal(f.summary().results[0].chart.version, "0.8.0"); + assert.equal(f.summary().results[0].chart.mode, "declared"); +}); + +test("a declared release below the baseline cannot pass by checking a newer chart", (t) => { + const f = fixture(t, undefined, {declaredVersion: "0.7.1"}); + assert.equal(f.run(), false); + assert.match(f.summary().results[0].error, /below the required minimum 0.8.0/); +}); + +test("missing latest release does not fall back to a valid declared pin", (t) => { + const f = fixture(t, "latest-resolution"); + assert.equal(f.run(), false); + assert(f.summary().results.every((r) => !r.ok)); + assert.equal(f.calls.filter((a) => a[0] === "pull").length, 0); +}); + for (const failure of ["resolution", "download", "schema", "lint", "template", "kubeconform", "empty"]) { test(`${failure} failure cannot report success`, (t) => { const f = fixture(t, failure); @@ -76,4 +124,8 @@ test("CLI rejects ambiguous selectors and incomplete arguments", () => { assert.throws(() => options(["--all", "--base", "main"])); assert.throws(() => options(["--base"])); assert.throws(() => options(["--unknown"])); + assert.throws(() => options(["--chart-mode", "invalid"])); + assert.throws(() => options(["--chart-mode"])); + assert.equal(options([]).chartMode, "latest"); + assert.equal(options(["--all", "--chart-mode", "declared"]).chartMode, "declared"); }); diff --git a/schema/helm/README.md b/schema/helm/README.md index a8a408c..6860fe6 100644 --- a/schema/helm/README.md +++ b/schema/helm/README.md @@ -1,8 +1,9 @@ # Helm validation schemas `npm run validate:helm` checks every variant in selected model version YAMLs. -It downloads **released** charts from the official repository, lets Helm merge -the chart defaults with `variant.values`, runs `helm lint --strict` and +By default it downloads the **latest stable released** chart for each engine +from the official repository, lets Helm merge the chart defaults with +`variant.values`, runs `helm lint --strict` and `helm template`, then runs `kubeconform -strict`. It never ignores missing schemas. It does not build dependencies: the dependency charts in the released package are the ones being checked. @@ -18,6 +19,7 @@ npm ci npm run helm:install npm run validate:helm -- --base origin/master npm run validate:helm -- --all +npm run validate:helm -- --all --chart-mode declared npm run validate:helm -- models/glm5.3/glm5.3-1.0.1.yaml npm run test:helm npm run test:helm:integration @@ -36,16 +38,34 @@ Only absent `values.modelRoute.nginx.outputConfigMap` is supplied with are preserved. No feature is disabled to make validation pass. Missing `values` means chart defaults plus that route placeholder. -The repository index is fetched once per invocation. Helm resolves the declared -version constraint, and each resolved chart package is downloaded once and -checked against the index's SHA-256 digest. Every variant records the declared -constraint, resolved version and digest. Version ranges check the currently -selected release; they do not guarantee all past or future matching releases. +The repository index is freshly fetched once per invocation. The default +`--chart-mode latest` (also explicitly used in CI) selects the newest stable +release of `sglang >=0.8.0` or `vllm >=0.5.0` in that snapshot. Prereleases are +excluded. Future stable releases, including new minor or major versions, are +automatically selected on subsequent runs. All selected variants of the same +engine use the same release, even when their YAML pins an older chart or imposes +an upper bound. The latest selection is never reused across invocations. + +Helm separately resolves the YAML declaration and checks that its selected +release meets the configured minimum. A missing, invalid or obsolete declared +release still fails the check. The YAML declaration continues to control +deployment; latest-mode validation checks forward compatibility and does not +change that declaration. `--chart-mode declared` renders the actual release +selected by the YAML constraint, for deployment compatibility and reproduction. +No matching latest release or a failed latest download causes a failure, with +no fallback to the declared chart. + +Each selected package is downloaded once and checked against the repository +index's SHA-256 digest. Every variant records the validation mode, original +declaration, resolved declaration version, validation chart version, selection +constraint and package digest. This checks the selected release at run time; +it does not guarantee all historical or future releases are compatible. The default artifact directory is `artifacts/helm-validation/`; override it with `--output DIR`. `summary.json` identifies files, variants, actual chart versions, -stage results and per-variant artifact directories. Each invocation has a fresh -`run-*` directory with extracted values, rendered manifests, tool logs, downloaded +mode, resolved declaration versions, stage results and per-variant artifact +directories. Each invocation has a fresh `run-*` directory with extracted values, +rendered manifests, tool logs, downloaded charts, a schema cache and isolated Helm settings. CI uploads these artifacts even on failure. Helm and kubeconform errors retain field paths. @@ -96,6 +116,7 @@ npm run helm:update-schemas npm run test:helm npm run test:helm:integration npm run validate:helm -- --all +npm run validate:helm -- --all --chart-mode declared ``` Review generated changes together with provenance. Changes to conversion rules @@ -103,13 +124,15 @@ must regenerate the schemas; bump the converter version when changing an already deployed conversion contract. Tool updates must also update archive checksums in `config.json`. -The acceptance suite checks GLM's fixed and ranged chart declarations, a fixed -vLLM release, both Gemma variants, an LWS deployment, default values, misspelled +The acceptance suite runs both latest and declared modes. It checks GLM's fixed +and ranged chart declarations, a fixed vLLM release, both Gemma variants, an LWS +deployment, default values, misspelled fields, incorrect types, invalid Kubernetes nesting, invalid CRD fields, template errors, no matching release, legacy chart rejection, and unknown/mismatched GVKs. Rendered custom resources must use the canonical Modelsphere groups. Unit tests additionally -cover selection, download failures, a missing chart values schema, empty renders and failure -propagation. +cover selection, future stable releases beyond fixed pins, prerelease exclusion, +package reuse, missing latest releases, download failures, a missing chart values +schema, empty renders and failure propagation. ## Rollout and limits diff --git a/schema/helm/config.json b/schema/helm/config.json index a9e7383..37c3e60 100644 --- a/schema/helm/config.json +++ b/schema/helm/config.json @@ -3,6 +3,10 @@ "kubeconformVersion": "0.8.0", "kubernetesVersion": "1.36.3", "chartRepository": "https://modelsphere.github.io/helm-charts/", + "minimumChartVersions": { + "sglang": "0.8.0", + "vllm": "0.5.0" + }, "kubernetesSchemaCommit": "39a87cd29966bc0b3434e8cfbc2061782c8cb69a", "converterVersion": "catalog-crd-schema-v1", "toolChecksums": { From cc2f380c9aa6dadbb803d9244e5e876c59d2f972 Mon Sep 17 00:00:00 2001 From: aceforeverd Date: Thu, 8 Oct 2026 22:38:31 +0800 Subject: [PATCH 5/8] refactor: dont vendor 3rd crds, revert version change --- hack/build-crds.js | 37 + hack/install-helm-tools.js | 5 +- hack/lib/crd-schema.js | 42 +- hack/lib/download.js | 25 + hack/lib/helm-validation.js | 21 +- hack/lib/helm-validation.test.js | 14 +- hack/update-crds.js | 26 + hack/update-helm-schemas.js | 59 - hack/validate-helm.integration.test.js | 17 +- hack/validate-helm.js | 40 +- hack/validate-helm.test.js | 27 +- .../deepseek-v4-flash-0731-1.0.0.yaml | 4 +- .../deepseek-v4-flash-1.0.0.yaml | 4 +- .../deepseek-v4.1-flash-1.0.0.yaml | 4 +- .../google-gemma-4-31b-it-1.0.0.yaml | 4 +- models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml | 4 +- models/glm5.1/glm5.1-1.0.0.yaml | 2 +- models/glm5.3/glm5.3-1.0.0.yaml | 2 +- models/glm5.3/glm5.3-1.0.1.yaml | 2 +- models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml | 4 +- models/hy3/hy3-1.0.0.yaml | 4 +- models/kimi-k2.5/kimi-k2.5-1.0.0.yaml | 2 +- models/kimi-k3/kimi-k3-1.0.0.yaml | 2 +- models/kimi-k3/kimi-k3-1.0.1.yaml | 4 +- models/kimi-k3/kimi-k3-1.0.2.yaml | 4 +- models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml | 4 +- .../ling-3.0-flash-vl-1.0.0.yaml | 4 +- .../ling-3.0-flash/ling-3.0-flash-1.0.0.yaml | 4 +- models/mimo-v2.5/mimo-v2.5-1.0.0.yaml | 4 +- .../nemotron-3.5-lightning-30b-a3b-1.0.0.yaml | 4 +- models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml | 4 +- .../qwen3.6-35b-a3b-1.0.0.yaml | 2 +- .../qwen3.6-35b-a3b-1.1.0.yaml | 6 +- .../qwen3.8-flash-next-1.0.0.yaml | 4 +- package.json | 2 +- schema/helm/README.md | 56 +- .../llmscaler_v1alpha1.json | 465 - .../llmslorequirement_v1alpha1.json | 474 - .../leaderworkerset_v1.json | 16589 ---------------- .../servicemonitor_v1.json | 1441 -- .../modelroute_v1alpha1.json | 541 - 41 files changed, 301 insertions(+), 19662 deletions(-) create mode 100755 hack/build-crds.js create mode 100644 hack/lib/download.js create mode 100644 hack/update-crds.js delete mode 100644 hack/update-helm-schemas.js delete mode 100644 schema/helm/crds/autoscaling.modelsphere.dev/llmscaler_v1alpha1.json delete mode 100644 schema/helm/crds/inference.modelsphere.dev/llmslorequirement_v1alpha1.json delete mode 100644 schema/helm/crds/leaderworkerset.x-k8s.io/leaderworkerset_v1.json delete mode 100644 schema/helm/crds/monitoring.coreos.com/servicemonitor_v1.json delete mode 100644 schema/helm/crds/routing.modelsphere.dev/modelroute_v1alpha1.json diff --git a/hack/build-crds.js b/hack/build-crds.js new file mode 100755 index 0000000..b50d5e9 --- /dev/null +++ b/hack/build-crds.js @@ -0,0 +1,37 @@ +#!/usr/bin/env node +"use strict"; + +// Build the kubeconform CRD schemas from the lock into DIR. Every source is +// downloaded at its locked commit and must match its recorded sha256. +// node hack/build-crds.js [--lock schema/helm/provenance.json] DIR +const fs = require("node:fs"); +const path = require("node:path"); +const {root} = require("./lib/catalog"); +const {CONVERTER_VERSION, buildSchemas} = require("./lib/crd-schema"); + +async function main(args) { + let lock = path.join(root, "schema/helm/provenance.json"); + const rest = []; + for (let i = 0; i < args.length; i++) { + if (args[i] === "--lock" && args[i + 1]) lock = args[++i]; + else rest.push(args[i]); + } + if (rest.length !== 1 || rest[0].startsWith("-")) throw new Error("usage: build-crds.js [--lock FILE] DIR"); + const provenance = JSON.parse(fs.readFileSync(lock, "utf8")); + if (provenance.converterVersion !== CONVERTER_VERSION) { + throw new Error(`${lock}: converter ${provenance.converterVersion}, want ${CONVERTER_VERSION}; run npm run helm:update-crds`); + } + const {files} = await buildSchemas(provenance.sources, provenance.objectMeta); + const locked = provenance.sources.flatMap((source) => source.schemas.map((schema) => schema.file)).sort(); + if (JSON.stringify([...files.keys()].sort()) !== JSON.stringify(locked)) { + throw new Error(`${lock}: built schemas differ from the locked list; run npm run helm:update-crds`); + } + const output = path.resolve(rest[0]); + for (const [file, body] of files) { + fs.mkdirSync(path.dirname(path.join(output, file)), {recursive: true}); + fs.writeFileSync(path.join(output, file), body); + } + console.log(`Built ${files.size} CRD schemas in ${output}`); +} + +main(process.argv.slice(2)).catch((err) => {console.error(err.message); process.exitCode = 1;}); diff --git a/hack/install-helm-tools.js b/hack/install-helm-tools.js index c62db55..45f7336 100644 --- a/hack/install-helm-tools.js +++ b/hack/install-helm-tools.js @@ -6,6 +6,7 @@ const path = require("node:path"); const crypto = require("node:crypto"); const {execFileSync} = require("node:child_process"); const {root} = require("./lib/catalog"); +const {download} = require("./lib/download"); const config = require("../schema/helm/config.json"); async function main() { @@ -19,9 +20,7 @@ async function main() { const archive = name === "helm" ? `helm-v${version}-${platform}.tar.gz` : `kubeconform-${platform}.tar.gz`; const url = name === "helm" ? `https://get.helm.sh/${archive}` : `https://github.com/yannh/kubeconform/releases/download/v${version}/${archive}`; - const response = await fetch(url, {signal: AbortSignal.timeout(60000)}); - if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`); - const bytes = Buffer.from(await response.arrayBuffer()); + const bytes = await download(url); if (crypto.createHash("sha256").update(bytes).digest("hex") !== sums[name]) { throw new Error(`${archive}: checksum mismatch`); } diff --git a/hack/lib/crd-schema.js b/hack/lib/crd-schema.js index 38dcc98..353e127 100644 --- a/hack/lib/crd-schema.js +++ b/hack/lib/crd-schema.js @@ -1,5 +1,9 @@ "use strict"; +const crypto = require("node:crypto"); +const YAML = require("yaml"); +const {download} = require("./download"); + // Versioned with the repository; changing this contract requires regeneration. const CONVERTER_VERSION = "catalog-crd-schema-v1"; @@ -87,4 +91,40 @@ function crdSchemas(crd, metadata = {schema: {type: "object"}, definitions: {}}) }); } -module.exports = {CONVERTER_VERSION, assertCrdSource, convertSchema, crdSchemas, objectMetaSchema}; +// A source carrying a sha256 is locked: different bytes are refused, not converted. +async function fetchPinned({url, sha256}) { + const bytes = await download(url); + const digest = crypto.createHash("sha256").update(bytes).digest("hex"); + if (sha256 && digest !== sha256) throw new Error(`${url}: sha256 ${digest}, locked ${sha256}`); + return {body: bytes.toString("utf8"), sha256: digest}; +} + +// Download CRD sources at their pinned commits and convert every served version. +// Returns the schema files and the provenance records that lock them. +async function buildSchemas(sources, objectMeta) { + const meta = await fetchPinned(objectMeta); + const metadata = objectMetaSchema(JSON.parse(meta.body).definitions); + const files = new Map(); + const records = []; + for (const source of sources) { + if (!/^[a-f0-9]{40}$/.test(source.commit)) throw new Error("source must use a full commit SHA"); + const url = `https://raw.githubusercontent.com/${source.repository}/${source.commit}/${source.path}`; + const {body, sha256} = await fetchPinned({url, sha256: source.sha256}); + const schemas = YAML.parseAllDocuments(body).flatMap((doc) => { + if (doc.errors.length) throw doc.errors[0]; + const crd = doc.toJS(); + if (!crd) return []; + assertCrdSource(source, crd); + return crdSchemas(crd, metadata); + }); + if (!schemas.length) throw new Error(`${url}: no served schemas`); + for (const {file, schema} of schemas) { + if (files.has(file)) throw new Error(`duplicate schema ${file}`); + files.set(file, JSON.stringify(schema, null, 2) + "\n"); + } + records.push({...source, url, sha256, schemas: schemas.map(({file, group, version, kind}) => ({file, group, version, kind}))}); + } + return {files, objectMeta: {url: objectMeta.url, sha256: meta.sha256}, records}; +} + +module.exports = {CONVERTER_VERSION, assertCrdSource, convertSchema, crdSchemas, objectMetaSchema, buildSchemas}; diff --git a/hack/lib/download.js b/hack/lib/download.js new file mode 100644 index 0000000..2321b45 --- /dev/null +++ b/hack/lib/download.js @@ -0,0 +1,25 @@ +"use strict"; + +const http = require("node:http"); + +let proxied = false; + +// fetch() ignores HTTPS_PROXY and friends unless told to, unlike curl, helm and +// kubeconform. Honor them the same way; without a proxy variable this is a no-op. +function useEnvProxy() { + if (proxied) return; + proxied = true; + if (typeof http.setGlobalProxyFromEnv === "function") http.setGlobalProxyFromEnv(); + else if (["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"].some((name) => process.env[name])) { + console.warn(`Node ${process.version} cannot route fetch() through the proxy variables; set NODE_USE_ENV_PROXY=1 or upgrade Node.`); + } +} + +async function download(url) { + useEnvProxy(); + const response = await fetch(url, {signal: AbortSignal.timeout(60000)}); + if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`); + return Buffer.from(await response.arrayBuffer()); +} + +module.exports = {download}; diff --git a/hack/lib/helm-validation.js b/hack/lib/helm-validation.js index acbf81f..a46d1df 100644 --- a/hack/lib/helm-validation.js +++ b/hack/lib/helm-validation.js @@ -11,8 +11,8 @@ function isVersionFile(file) { function affectsValidator(file) { return file.startsWith("schema/helm/") || - /^hack\/(validate-helm|install-helm-tools|update-helm-schemas)(\.integration)?\.(js|test\.js)$/.test(file) || - /^hack\/lib\/(helm-validation|crd-schema|catalog)(\.test)?\.js$/.test(file) || + /^hack\/(validate-helm|install-helm-tools|build-crds|update-crds)(\.integration)?\.(js|test\.js)$/.test(file) || + /^hack\/lib\/(helm-validation|crd-schema|download|catalog)(\.test)?\.js$/.test(file) || ["package.json", "package-lock.json", ".github/workflows/lint.yml"].includes(file); } @@ -43,26 +43,33 @@ function allVersionFiles(root) { // Keep both sides of renames for validator-change detection. NUL delimiters // preserve filenames with whitespace; missing old/deleted model paths are excluded. +// `added` lists the new versions, held to the chart minimum: a published version +// keeps the chart it was published with. Explicit files are checked as new. function selectFiles(root, {all = false, base = "origin/HEAD", files = []} = {}) { - if (all) return {files: allVersionFiles(root), reason: "--all"}; + if (all) return {files: allVersionFiles(root), added: [], reason: "--all"}; if (files.length) { const selected = files.map((file) => path.relative(root, path.resolve(root, file)).split(path.sep).join("/")); if (selected.some((file) => !isVersionFile(file) || !fs.existsSync(path.join(root, file)))) { throw new Error("explicit files must be existing model version YAMLs under models/"); } - return {files: [...new Set(selected)].sort(), reason: "explicit files"}; + const unique = [...new Set(selected)].sort(); + return {files: unique, added: unique, reason: "explicit files"}; } const mergeBase = git(root, ["merge-base", base, "HEAD"]).trim(); const tokens = git(root, ["diff", "--name-status", "-z", "--find-renames", mergeBase, "HEAD"]).split("\0"); const changed = []; + const added = []; for (let i = 0; i < tokens.length && tokens[i];) { const status = tokens[i++]; changed.push(tokens[i++]); if (/^[RC]/.test(status)) changed.push(tokens[i++]); + if (/^[ARC]/.test(status)) added.push(changed.at(-1)); } - if (changed.some(affectsValidator)) return {files: allVersionFiles(root), reason: "validator/dependency/schema changes", mergeBase}; - return {files: [...new Set(changed.filter((file) => isVersionFile(file) && fs.existsSync(path.join(root, file))))].sort(), - reason: `changes since merge-base with ${base}`, mergeBase}; + const versions = (list) => [...new Set(list.filter((file) => isVersionFile(file) && fs.existsSync(path.join(root, file))))].sort(); + if (changed.some(affectsValidator)) { + return {files: allVersionFiles(root), added: versions(added), reason: "validator/dependency/schema changes", mergeBase}; + } + return {files: versions(changed), added: versions(added), reason: `changes since merge-base with ${base}`, mergeBase}; } function isObject(value) { diff --git a/hack/lib/helm-validation.test.js b/hack/lib/helm-validation.test.js index a6c6600..04489fa 100644 --- a/hack/lib/helm-validation.test.js +++ b/hack/lib/helm-validation.test.js @@ -57,7 +57,7 @@ test("selection uses the common ancestor even when the target branch advances", }); test("validator, dependency and schema changes, including deletions, trigger all versions", (t) => { - for (const file of ["hack/validate-helm.js", "hack/lib/crd-schema.js", "schema/helm/config.json", "package-lock.json", ".github/workflows/lint.yml"]) { + for (const file of ["hack/validate-helm.js", "hack/build-crds.js", "hack/lib/crd-schema.js", "schema/helm/config.json", "package-lock.json", ".github/workflows/lint.yml"]) { const r = repository(t); r.write(file, "changed\n"); r.commit(); assert.equal(selectFiles(r.dir, {base: "base"}).reason, "validator/dependency/schema changes"); @@ -70,6 +70,18 @@ test("validator, dependency and schema changes, including deletions, trigger all assert.equal(selectFiles(renamed.dir, {base: "base"}).reason, "validator/dependency/schema changes"); }); +test("only added versions are held to the chart minimum, also in a full scan", (t) => { + const r = repository(t); + r.write("models/example/example-1.0.0.yaml", "modified\n"); + r.write("models/example/example-1.1.0.yaml"); + r.write("hack/validate-helm.js", "changed\n"); r.commit(); + const selection = selectFiles(r.dir, {base: "base"}); + assert.deepEqual(selection.files, ["models/example/example-1.0.0.yaml", "models/example/example-1.1.0.yaml"]); + assert.deepEqual(selection.added, ["models/example/example-1.1.0.yaml"]); + assert.deepEqual(selectFiles(r.dir, {all: true}).added, []); + assert.deepEqual(selectFiles(r.dir, {files: ["models/example/example-1.0.0.yaml"]}).added, ["models/example/example-1.0.0.yaml"]); +}); + test("unknown base fails rather than reporting no changes", (t) => { const r = repository(t); assert.throws(() => selectFiles(r.dir, {base: "missing-ref"})); diff --git a/hack/update-crds.js b/hack/update-crds.js new file mode 100644 index 0000000..9e46717 --- /dev/null +++ b/hack/update-crds.js @@ -0,0 +1,26 @@ +#!/usr/bin/env node +"use strict"; + +// Refresh the CRD lock: download every source at the commit sources.json pins, +// check it converts, and record its sha256 and schemas in provenance.json. +// Schemas are not committed; hack/build-crds.js builds them from this lock. +const fs = require("node:fs"); +const path = require("node:path"); +const {root} = require("./lib/catalog"); +const {CONVERTER_VERSION, buildSchemas} = require("./lib/crd-schema"); +const config = require("../schema/helm/config.json"); +const sources = require("../schema/helm/sources.json").sources; + +async function main() { + if (config.converterVersion !== CONVERTER_VERSION) throw new Error("converter version mismatch"); + const objectMeta = {url: `https://raw.githubusercontent.com/yannh/kubernetes-json-schema/${config.kubernetesSchemaCommit}/` + + `v${config.kubernetesVersion}-standalone-strict/_definitions.json`}; + const lock = await buildSchemas(sources, objectMeta); + fs.writeFileSync(path.join(root, "schema/helm/provenance.json"), + JSON.stringify({converterVersion: CONVERTER_VERSION, objectMeta: lock.objectMeta, sources: lock.records}, null, 2) + "\n"); + for (const record of lock.records) { + for (const schema of record.schemas) console.log(`Locked ${schema.file} from ${record.repository}@${record.commit}`); + } +} + +main().catch((err) => {console.error(err.message); process.exitCode = 1;}); diff --git a/hack/update-helm-schemas.js b/hack/update-helm-schemas.js deleted file mode 100644 index 318572e..0000000 --- a/hack/update-helm-schemas.js +++ /dev/null @@ -1,59 +0,0 @@ -#!/usr/bin/env node -"use strict"; - -const fs = require("node:fs"); -const path = require("node:path"); -const crypto = require("node:crypto"); -const YAML = require("yaml"); -const {root} = require("./lib/catalog"); -const {CONVERTER_VERSION, assertCrdSource, crdSchemas, objectMetaSchema} = require("./lib/crd-schema"); -const config = require("../schema/helm/config.json"); -const sources = require("../schema/helm/sources.json").sources; - -async function main() { - if (config.converterVersion !== CONVERTER_VERSION) throw new Error("converter version mismatch"); - const output = path.join(root, "schema/helm/crds"); - const files = new Map(); - const records = []; - const metadataUrl = `https://raw.githubusercontent.com/yannh/kubernetes-json-schema/${config.kubernetesSchemaCommit}/` + - `v${config.kubernetesVersion}-standalone-strict/_definitions.json`; - const metadataResponse = await fetch(metadataUrl, {signal: AbortSignal.timeout(60000)}); - if (!metadataResponse.ok) throw new Error(`${metadataUrl}: HTTP ${metadataResponse.status}`); - const metadataBody = await metadataResponse.text(); - const metadata = objectMetaSchema(JSON.parse(metadataBody).definitions); - // Download and convert everything before replacing the generated directory. - for (const source of sources) { - if (!/^[a-f0-9]{40}$/.test(source.commit)) throw new Error("source must use a full commit SHA"); - const url = `https://raw.githubusercontent.com/${source.repository}/${source.commit}/${source.path}`; - const response = await fetch(url, {signal: AbortSignal.timeout(60000)}); - if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`); - const body = await response.text(); - const schemas = YAML.parseAllDocuments(body).flatMap((doc) => { - if (doc.errors.length) throw doc.errors[0]; - const crd = doc.toJS(); - if (!crd) return []; - assertCrdSource(source, crd); - return crdSchemas(crd, metadata); - }); - if (!schemas.length) throw new Error(`${url}: no served schemas`); - for (const {file, schema} of schemas) { - if (files.has(file)) throw new Error(`duplicate schema ${file}`); - files.set(file, JSON.stringify(schema, null, 2) + "\n"); - } - records.push({...source, url, sha256: crypto.createHash("sha256").update(body).digest("hex"), - schemas: schemas.map(({file, group, version, kind}) => ({file, group, version, kind}))}); - } - fs.rmSync(output, {recursive: true, force: true}); - for (const [file, body] of files) { - const target = path.join(output, file); - fs.mkdirSync(path.dirname(target), {recursive: true}); - fs.writeFileSync(target, body); - console.log(`Generated schema/helm/crds/${file}`); - } - fs.writeFileSync(path.join(root, "schema/helm/provenance.json"), - JSON.stringify({converterVersion: CONVERTER_VERSION, - objectMeta: {url: metadataUrl, sha256: crypto.createHash("sha256").update(metadataBody).digest("hex")}, - sources: records}, null, 2) + "\n"); -} - -main().catch((err) => {console.error(err.message); process.exitCode = 1;}); diff --git a/hack/validate-helm.integration.test.js b/hack/validate-helm.integration.test.js index e763f1f..c3d95c8 100644 --- a/hack/validate-helm.integration.test.js +++ b/hack/validate-helm.integration.test.js @@ -23,14 +23,19 @@ for (const chartMode of ["latest", "declared"]) { function write(name, doc) { fs.writeFileSync(path.join(temp, `models/fixtures/${name}.yaml`), YAML.stringify(doc)); } + const read = (file) => YAML.parse(fs.readFileSync(path.join(root, file), "utf8")); for (const [name, file] of [ - ["valid-fixed", "models/glm5.3/glm5.3-1.0.0.yaml"], ["valid-range", "models/glm5.3/glm5.3-1.0.1.yaml"], ["valid-gemma", "models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml"], ["valid-lws", "models/kimi-k2.5/kimi-k2.5-1.0.0.yaml"] - ]) write(name, YAML.parse(fs.readFileSync(path.join(root, file), "utf8"))); - const vllm = YAML.parse(fs.readFileSync(path.join(root, "models/kimi-k3/kimi-k3-1.0.1.yaml"), "utf8")); + ]) write(name, read(file)); + // Published fixed pins predate the minimum; pin these copies to it. + const glm = read("models/glm5.3/glm5.3-1.0.0.yaml"); + for (const v of glm.variants) v.chart.version = config.minimumChartVersions.sglang; + write("valid-fixed", glm); + const vllm = read("models/kimi-k3/kimi-k3-1.0.1.yaml"); vllm.variants = vllm.variants.filter((v) => v.chart.name === "vllm"); + for (const v of vllm.variants) v.chart.version = config.minimumChartVersions.vllm; write("valid-vllm-fixed", vllm); const base = {variants: [{id: "fixture", chart: {name: "sglang", version: ">=0.8.0"}}]}; write("valid-defaults", base); @@ -52,7 +57,9 @@ for (const chartMode of ["latest", "declared"]) { const legacy = structuredClone(base); legacy.variants[0].chart.version = "0.7.1"; write("bad-legacy-chart", legacy); const output = path.join(temp, "artifacts"); - assert.equal(main({all: true, files: [], output, chartMode}, {repositoryRoot: temp}), false); + // Explicit files are new versions, so the legacy fixture must fail the minimum. + const files = fs.readdirSync(path.join(temp, "models/fixtures")).map((name) => `models/fixtures/${name}`); + assert.equal(main({files, output, chartMode}, {repositoryRoot: temp}), false); const summary = JSON.parse(fs.readFileSync(path.join(output, "summary.json"), "utf8")); for (const result of summary.results.filter((r) => path.basename(r.file).startsWith("valid-"))) { assert.equal(result.ok, true, `${result.file}: ${JSON.stringify(result)}`); @@ -102,7 +109,7 @@ for (const chartMode of ["latest", "declared"]) { const rendered = path.join(temp, "unknown.yaml"); fs.writeFileSync(rendered, YAML.stringify({apiVersion, kind, metadata: {name: "unknown"}})); const result = command(path.join(root, ".cache/helm-validation/bin/kubeconform"), - kubeconformArgs(config, path.join(root, "schema/helm/crds"), cache, rendered)); + kubeconformArgs(config, path.join(temp, summary.runDirectory, "crds"), cache, rendered)); assert.equal(result.ok, false, `${apiVersion}/${kind}`); } }); diff --git a/hack/validate-helm.js b/hack/validate-helm.js index 05a64d3..706b725 100644 --- a/hack/validate-helm.js +++ b/hack/validate-helm.js @@ -63,6 +63,7 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { try { if (!["latest", "declared"].includes(chartMode)) throw new Error("chartMode must be latest or declared"); const selection = selectFiles(root, opts); + const added = new Set(selection.added); Object.assign(summary, selection, {runDirectory: path.relative(root, runDir)}); log(`Selection: ${selection.reason}${selection.mergeBase ? ` (${selection.mergeBase})` : ""}`); if (!selection.files.length) { @@ -76,10 +77,13 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { throw new Error(`${name}: expected ${config[`${name}Version`]}, got ${version}; run npm run helm:install`); } } - const schemaDir = path.join(root, "schema/helm/crds"); - const provenance = JSON.parse(fs.readFileSync(path.join(root, "schema/helm/provenance.json"), "utf8")); + const lock = path.join(root, "schema/helm/provenance.json"); + const provenance = JSON.parse(fs.readFileSync(lock, "utf8")); if (provenance.converterVersion !== config.converterVersion) throw new Error("CRD converter version mismatch"); const apis = [...new Set(provenance.sources.flatMap((source) => source.schemas.map((s) => `${s.group}/${s.version}`)))]; + // CRD schemas are not committed: build them from the lock for this run. + const schemaDir = path.join(runDir, "crds"); + requireSuccess(invoke(process.execPath, [path.join(__dirname, "build-crds.js"), "--lock", lock, schemaDir], runDir, "crds"), "crds"); const schemaCache = path.join(runDir, "schema-cache"); fs.mkdirSync(schemaCache); requireSuccess(invoke(bin("helm"), ["repo", "add", "catalog", config.chartRepository], runDir, "chart-repository"), "chart-repository"); @@ -113,10 +117,15 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { const minimum = config.minimumChartVersions[chart.name]; if (!minimum) throw new Error(`chart.name: unsupported chart ${chart.name}`); // Keep deployment declarations resolvable even when rendering against - // latest. A missing or obsolete declared release must still fail CI. + // latest. A missing declared release must still fail CI; one below the + // minimum fails a new version only (see the variant loop). const declaredVersion = resolveChart(chart.name, chart.version, dir, "declared-chart-resolution"); - if (compareVersions(declaredVersion, minimum) < 0) { - throw new Error(`chart.version: ${chart.name} ${declaredVersion} is below the required minimum ${minimum}`); + const legacy = compareVersions(declaredVersion, minimum) < 0; + if (legacy && chartMode === "declared") { + // Its chart renders API groups with no schema here: nothing to render. + const pkg = {name: chart.name, declaredVersion, minimum, legacy}; + requests.set(requestKey, pkg); + return pkg; } const selectionConstraint = chartMode === "latest" ? `>=${minimum}` : chart.version; const actualVersion = chartMode === "latest" ? @@ -134,7 +143,7 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { if (metadata.name !== chart.name || metadata.version !== actualVersion) throw new Error(`${key}: package metadata mismatch`); packages.set(key, {archive, name: chart.name, actualVersion, digest: `sha256:${digest}`}); } - const pkg = {...packages.get(key), declaredVersion, selectionConstraint}; + const pkg = {...packages.get(key), declaredVersion, selectionConstraint, minimum, legacy}; requests.set(requestKey, pkg); return pkg; } catch (err) { @@ -167,6 +176,19 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { fs.writeFileSync(valuesFile, YAML.stringify(values)); stage = "chart"; const pkg = chartFor(variant.chart, dir); + if (pkg.legacy) { + const below = `${pkg.name} ${pkg.declaredVersion} is below the required minimum ${pkg.minimum}`; + if (added.has(file)) throw new Error(`chart.version: ${below}`); + // A published version keeps its chart; rewriting it to pass would + // change the digest every existing deploy recorded. + record.warning = `published version declares ${below}`; + if (!pkg.archive) { + record.skipped = true; + log(`SKIP ${label}: ${record.warning}; its legacy chart cannot be rendered here`); + continue; + } + log(`WARN ${label}: ${record.warning}; its values are still checked against the latest chart`); + } record.chart = {name: pkg.name, version: pkg.actualVersion, digest: pkg.digest, mode: chartMode, declaredVersion: pkg.declaredVersion, selectionConstraint: pkg.selectionConstraint}; log(`${label}: declared ${pkg.name} ${variant.chart.version} -> ${pkg.declaredVersion}; validating ${chartMode} chart ${pkg.name}@${pkg.actualVersion} ${pkg.digest}`); @@ -207,8 +229,10 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { } } } - const failed = summary.results.filter((r) => !r.ok).length; - log(`${summary.results.length} checks: ${summary.results.length - failed} passed, ${failed} failed. Artifacts: ${runDir}`); + const failed = summary.results.filter((r) => !r.ok && !r.skipped).length; + const skipped = summary.results.filter((r) => r.skipped).length; + log(`${summary.results.length} checks: ${summary.results.length - failed - skipped} passed, ${failed} failed` + + `${skipped ? `, ${skipped} skipped` : ""}. Artifacts: ${runDir}`); return failed === 0; } catch (err) { summary.error = err.message; diff --git a/hack/validate-helm.test.js b/hack/validate-helm.test.js index d7c64e7..05db7d5 100644 --- a/hack/validate-helm.test.js +++ b/hack/validate-helm.test.js @@ -52,7 +52,8 @@ function fixture(t, failure, {chartName = "sglang", declaredVersion = "0.8.0", l else if (args[0] === "show") stdout = YAML.stringify({name: chartName, version: path.basename(args.at(-1)).slice(chartName.length + 1, -4)}); else if (args[0] === "template") stdout = failure === "empty" ? "" : "apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: example\n"; - const stage = args[0] === "-strict" ? "kubeconform" : args[0] === "pull" ? "download" : args[0]; + const stage = args[0] === "-strict" ? "kubeconform" : args[0] === "pull" ? "download" : + args[0].endsWith("build-crds.js") ? "crds" : args[0]; const ok = stage !== failure; return {stdout, ok, log: ok ? stdout : `${stage}: fixture failure at spec.template.spec.containers[0].env[0]\n`}; }; @@ -97,12 +98,30 @@ test("declared mode checks the fixed deployment release independently of latest" assert.equal(f.summary().results[0].chart.mode, "declared"); }); -test("a declared release below the baseline cannot pass by checking a newer chart", (t) => { +test("a new version below the baseline cannot pass by checking a newer chart", (t) => { const f = fixture(t, undefined, {declaredVersion: "0.7.1"}); - assert.equal(f.run(), false); + assert.equal(f.run({all: false, files: ["models/example/example-1.0.0.yaml"]}), false); assert.match(f.summary().results[0].error, /below the required minimum 0.8.0/); }); +test("a published version below the baseline warns and its values are checked against latest", (t) => { + const f = fixture(t, undefined, {declaredVersion: "0.7.1", latestVersion: "0.8.2"}); + assert.equal(f.run(), true); + const [legacy] = f.summary().results; + assert.equal(legacy.ok, true); + assert.match(legacy.warning, /0.7.1 is below the required minimum 0.8.0/); + assert.equal(legacy.chart.version, "0.8.2"); +}); + +test("declared mode skips a published version below the baseline instead of rendering its legacy chart", (t) => { + const f = fixture(t, undefined, {declaredVersion: "0.7.1"}); + assert.equal(f.run({chartMode: "declared"}), true); + const [legacy, other] = f.summary().results; + assert.equal(legacy.skipped, true); + assert.equal(other.ok, true); + assert(f.calls.filter((a) => a[0] === "pull").every((a) => !a.includes("0.7.1"))); +}); + test("missing latest release does not fall back to a valid declared pin", (t) => { const f = fixture(t, "latest-resolution"); assert.equal(f.run(), false); @@ -110,7 +129,7 @@ test("missing latest release does not fall back to a valid declared pin", (t) => assert.equal(f.calls.filter((a) => a[0] === "pull").length, 0); }); -for (const failure of ["resolution", "download", "schema", "lint", "template", "kubeconform", "empty"]) { +for (const failure of ["crds", "resolution", "download", "schema", "lint", "template", "kubeconform", "empty"]) { test(`${failure} failure cannot report success`, (t) => { const f = fixture(t, failure); assert.equal(f.run(), false); diff --git a/models/deepseek-v4-flash-0731/deepseek-v4-flash-0731-1.0.0.yaml b/models/deepseek-v4-flash-0731/deepseek-v4-flash-0731-1.0.0.yaml index 7d8a2f3..837ad43 100644 --- a/models/deepseek-v4-flash-0731/deepseek-v4-flash-0731-1.0.0.yaml +++ b/models/deepseek-v4-flash-0731/deepseek-v4-flash-0731-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 @@ -79,7 +79,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 diff --git a/models/deepseek-v4-flash/deepseek-v4-flash-1.0.0.yaml b/models/deepseek-v4-flash/deepseek-v4-flash-1.0.0.yaml index 64f6a45..2ed49ac 100644 --- a/models/deepseek-v4-flash/deepseek-v4-flash-1.0.0.yaml +++ b/models/deepseek-v4-flash/deepseek-v4-flash-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -79,7 +79,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/deepseek-v4.1-flash/deepseek-v4.1-flash-1.0.0.yaml b/models/deepseek-v4.1-flash/deepseek-v4.1-flash-1.0.0.yaml index 432091a..1e6aaae 100644 --- a/models/deepseek-v4.1-flash/deepseek-v4.1-flash-1.0.0.yaml +++ b/models/deepseek-v4.1-flash/deepseek-v4.1-flash-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -88,7 +88,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml b/models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml index 62ede64..7097657 100644 --- a/models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml +++ b/models/gemma-4-31b-it/google-gemma-4-31b-it-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 @@ -80,7 +80,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 diff --git a/models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml b/models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml index 24fcbd7..535ab66 100644 --- a/models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml +++ b/models/glm-5.3-flash/glm-5.3-flash-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: glm-5.3-flash @@ -81,7 +81,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: glm-5.3-flash diff --git a/models/glm5.1/glm5.1-1.0.0.yaml b/models/glm5.1/glm5.1-1.0.0.yaml index b1549ee..3d180c0 100644 --- a/models/glm5.1/glm5.1-1.0.0.yaml +++ b/models/glm5.1/glm5.1-1.0.0.yaml @@ -13,7 +13,7 @@ variants: description: TP2 on two GPUs, single node. chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.0" image: repository: harbor-contest.4pd.io/lijiashu/sglang tag: v0.5.10.post1 diff --git a/models/glm5.3/glm5.3-1.0.0.yaml b/models/glm5.3/glm5.3-1.0.0.yaml index d7d1313..f6e6128 100644 --- a/models/glm5.3/glm5.3-1.0.0.yaml +++ b/models/glm5.3/glm5.3-1.0.0.yaml @@ -13,7 +13,7 @@ variants: description: TP4 on four B300 GPUs. NVFP4 weights, EAGLE speculative decoding, hierarchical KV cache. chart: name: sglang - version: 0.8.0 + version: 0.7.1 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 diff --git a/models/glm5.3/glm5.3-1.0.1.yaml b/models/glm5.3/glm5.3-1.0.1.yaml index 977abfc..a765aff 100644 --- a/models/glm5.3/glm5.3-1.0.1.yaml +++ b/models/glm5.3/glm5.3-1.0.1.yaml @@ -13,7 +13,7 @@ variants: description: TP4 on four B300 GPUs. NVFP4 weights, EAGLE speculative decoding, hierarchical KV cache. chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.8" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 diff --git a/models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml b/models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml index 3979a7a..717a5a4 100644 --- a/models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml +++ b/models/gpt-oss-120b/gpt-oss-120b-1.0.0.yaml @@ -8,7 +8,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -80,7 +80,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/hy3/hy3-1.0.0.yaml b/models/hy3/hy3-1.0.0.yaml index 8c98adf..281230f 100644 --- a/models/hy3/hy3-1.0.0.yaml +++ b/models/hy3/hy3-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -80,7 +80,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/kimi-k2.5/kimi-k2.5-1.0.0.yaml b/models/kimi-k2.5/kimi-k2.5-1.0.0.yaml index f5ad527..94da877 100644 --- a/models/kimi-k2.5/kimi-k2.5-1.0.0.yaml +++ b/models/kimi-k2.5/kimi-k2.5-1.0.0.yaml @@ -9,7 +9,7 @@ variants: description: TP8 per node, PP2 across two nodes over IB. chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.0" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.10.post1-gm-fix-v0.1 diff --git a/models/kimi-k3/kimi-k3-1.0.0.yaml b/models/kimi-k3/kimi-k3-1.0.0.yaml index 9bb03f9..da6a9fe 100644 --- a/models/kimi-k3/kimi-k3-1.0.0.yaml +++ b/models/kimi-k3/kimi-k3-1.0.0.yaml @@ -11,7 +11,7 @@ variants: description: TP8 with DCP8 on one eight-GPU B300 node, fp8 KV cache, DSPARK speculative decoding. chart: name: sglang - version: 0.8.0 + version: 0.7.1 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 diff --git a/models/kimi-k3/kimi-k3-1.0.1.yaml b/models/kimi-k3/kimi-k3-1.0.1.yaml index c056c6a..ad0f904 100644 --- a/models/kimi-k3/kimi-k3-1.0.1.yaml +++ b/models/kimi-k3/kimi-k3-1.0.1.yaml @@ -9,7 +9,7 @@ variants: description: TP8 with DCP8 on one eight-GPU B300 node, fp8 KV cache, DSPARK speculative decoding. chart: name: sglang - version: 0.8.0 + version: 0.7.1 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 @@ -109,7 +109,7 @@ variants: tag: v0.30.1-nightly-0961bbae-patch chart: name: vllm - version: 0.5.0 + version: 0.4.1 requires: gpus: 8 topology: single-node diff --git a/models/kimi-k3/kimi-k3-1.0.2.yaml b/models/kimi-k3/kimi-k3-1.0.2.yaml index 216dff4..09aa58a 100644 --- a/models/kimi-k3/kimi-k3-1.0.2.yaml +++ b/models/kimi-k3/kimi-k3-1.0.2.yaml @@ -9,7 +9,7 @@ variants: description: TP8 with DCP8 on one eight-GPU B300 node, fp8 KV cache, DSPARK speculative decoding. chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.9" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19 @@ -109,7 +109,7 @@ variants: tag: v0.30.1-nightly-0961bbae-patch chart: name: vllm - version: ">=0.5.0" + version: ">=0.4.6" requires: gpus: 8 topology: single-node diff --git a/models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml b/models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml index 799ada9..0fc5b66 100644 --- a/models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml +++ b/models/laguna-s-2.1/laguna-s-2.1-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -82,7 +82,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/ling-3.0-flash-vl/ling-3.0-flash-vl-1.0.0.yaml b/models/ling-3.0-flash-vl/ling-3.0-flash-vl-1.0.0.yaml index 15a689f..eae4d1b 100644 --- a/models/ling-3.0-flash-vl/ling-3.0-flash-vl-1.0.0.yaml +++ b/models/ling-3.0-flash-vl/ling-3.0-flash-vl-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-Ling-3.0-flash-VL @@ -82,7 +82,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-Ling-3.0-flash-VL diff --git a/models/ling-3.0-flash/ling-3.0-flash-1.0.0.yaml b/models/ling-3.0-flash/ling-3.0-flash-1.0.0.yaml index 6782f20..306bb06 100644 --- a/models/ling-3.0-flash/ling-3.0-flash-1.0.0.yaml +++ b/models/ling-3.0-flash/ling-3.0-flash-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-Ling-3.0-flash-VL @@ -83,7 +83,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-Ling-3.0-flash-VL diff --git a/models/mimo-v2.5/mimo-v2.5-1.0.0.yaml b/models/mimo-v2.5/mimo-v2.5-1.0.0.yaml index 4182826..53da94e 100644 --- a/models/mimo-v2.5/mimo-v2.5-1.0.0.yaml +++ b/models/mimo-v2.5/mimo-v2.5-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -84,7 +84,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/nemotron-3.5-lightning-30b-a3b/nemotron-3.5-lightning-30b-a3b-1.0.0.yaml b/models/nemotron-3.5-lightning-30b-a3b/nemotron-3.5-lightning-30b-a3b-1.0.0.yaml index 7a82dbd..9e6759f 100644 --- a/models/nemotron-3.5-lightning-30b-a3b/nemotron-3.5-lightning-30b-a3b-1.0.0.yaml +++ b/models/nemotron-3.5-lightning-30b-a3b/nemotron-3.5-lightning-30b-a3b-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -85,7 +85,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml b/models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml index ffaf513..c26f6dc 100644 --- a/models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml +++ b/models/nex-n2.5-pro/nex-n2.5-pro-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 @@ -81,7 +81,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: dev-dsv41 diff --git a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml index 6fe9c4b..ff3c5ee 100644 --- a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml +++ b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.0.0.yaml @@ -9,7 +9,7 @@ variants: description: TP2 on two H100 or H800 GPUs, single node. chart: name: sglang - version: 0.8.0 + version: 0.7.1 image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.18-cu129 diff --git a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml index 50257c8..9b1ae37 100644 --- a/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml +++ b/models/qwen3.6-35b-a3b/qwen3.6-35b-a3b-1.1.0.yaml @@ -9,7 +9,7 @@ variants: description: TP2 on two H100 or H800 GPUs, single node. chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.18-cu129 @@ -87,7 +87,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 @@ -157,7 +157,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: v0.5.19-cu129 diff --git a/models/qwen3.8-flash-next/qwen3.8-flash-next-1.0.0.yaml b/models/qwen3.8-flash-next/qwen3.8-flash-next-1.0.0.yaml index f067047..1c60cc4 100644 --- a/models/qwen3.8-flash-next/qwen3.8-flash-next-1.0.0.yaml +++ b/models/qwen3.8-flash-next/qwen3.8-flash-next-1.0.0.yaml @@ -9,7 +9,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: qwen38flashnext @@ -81,7 +81,7 @@ variants: engine: sglang chart: name: sglang - version: ">=0.8.0" + version: ">=0.7.1" image: repository: harbor.4pd.io/hardcore-tech/sglang tag: qwen38flashnext diff --git a/package.json b/package.json index aa753b7..138581c 100644 --- a/package.json +++ b/package.json @@ -19,7 +19,7 @@ "validate:schema": "node hack/validate-schema.js", "validate:helm": "node hack/validate-helm.js", "helm:install": "node hack/install-helm-tools.js", - "helm:update-schemas": "node hack/update-helm-schemas.js", + "helm:update-crds": "node hack/update-crds.js", "test:helm": "node --test hack/lib/helm-validation.test.js hack/lib/crd-schema.test.js hack/validate-helm.test.js", "test:helm:integration": "node --test hack/validate-helm.integration.test.js", "test:lib": "node --test 'hack/lib/*.test.js'", diff --git a/schema/helm/README.md b/schema/helm/README.md index 6860fe6..fe1c23a 100644 --- a/schema/helm/README.md +++ b/schema/helm/README.md @@ -47,8 +47,12 @@ engine use the same release, even when their YAML pins an older chart or imposes an upper bound. The latest selection is never reused across invocations. Helm separately resolves the YAML declaration and checks that its selected -release meets the configured minimum. A missing, invalid or obsolete declared -release still fails the check. The YAML declaration continues to control +release meets the configured minimum. A missing or invalid declared release +fails the check, and so does an obsolete one in a version that is new: added +since the base, or named explicitly. A published version keeps the chart it was +published with, so an obsolete declaration there is a warning: latest mode still +checks its values against the latest chart, and declared mode skips it, since +its chart renders API groups with no schema here. The YAML declaration continues to control deployment; latest-mode validation checks forward compatibility and does not change that declaration. `--chart-mode declared` renders the actual release selected by the YAML constraint, for deployment compatibility and reproduction. @@ -66,22 +70,27 @@ The default artifact directory is `artifacts/helm-validation/`; override it with mode, resolved declaration versions, stage results and per-variant artifact directories. Each invocation has a fresh `run-*` directory with extracted values, rendered manifests, tool logs, downloaded -charts, a schema cache and isolated Helm settings. CI uploads these artifacts +charts, the CRD schemas it built, a schema cache and isolated Helm settings. CI uploads these artifacts even on failure. Helm and kubeconform errors retain field paths. ## Schema sources and updates -[`sources.json`](sources.json) locks upstream CRDs to full commit SHAs. -[`provenance.json`](provenance.json) records source URLs, source hashes, served -versions and generated filenames. Modelsphere-owned CRDs use only +[`sources.json`](sources.json) pins upstream CRDs to full commit SHAs. +[`provenance.json`](provenance.json) is the lock: source URLs, the SHA-256 of each +source file, served versions and schema filenames. The converted schemas are not +committed. Each `validate:helm` run builds them into its run directory with +`hack/build-crds.js`, which downloads every source at its locked commit and +refuses one whose bytes differ from the recorded hash. Modelsphere-owned CRDs use only `routing.modelsphere.dev`, `autoscaling.modelsphere.dev` and `inference.modelsphere.dev`. Each source declares its expected group and kind; the generator rejects a mismatched CRD or a Modelsphere source whose group does not end in `.modelsphere.dev`. -Catalog chart declarations use `sglang` version `0.8.0` or newer and `vllm` -version `0.5.0` or newer, the first releases using these groups. Fixed pins remain -fixed, and version ranges retain their form with the new minimum. Legacy +New model versions declare `sglang` version `0.8.0` or newer and `vllm` +version `0.5.0` or newer, the first releases using these groups. Published +versions are not rewritten to match: their ranges already resolve above the +minimum, and their fixed pins (`glm5.3` 1.0.0, `kimi-k3` 1.0.0 and 1.0.1, +`qwen3.6-35b-a3b` 1.0.0) are each superseded by a later version. Legacy `autoscaling.4pd.io` and `inference.x-k8s.io` schemas are removed; resources from old charts fail validation rather than being rewritten or accepted through aliases. External CRDs retain their upstream groups: `leaderworkerset.x-k8s.io` for @@ -89,9 +98,7 @@ LeaderWorkerSet and `monitoring.coreos.com` for ServiceMonitor. Deployments using the old groups need the corresponding controllers, CRDs, RBAC and resource objects migrated together. Existing objects under an old API -group do not automatically become objects under the new group. This catalog -change deliberately updates published version declarations; the Pages workflow -requires `allow_rewrites` when publishing those changes. +group do not automatically become objects under the new group. The converter is repository-versioned as `catalog-crd-schema-v1` in [`hack/lib/crd-schema.js`](../../hack/lib/crd-schema.js), using the YAML parser @@ -105,24 +112,27 @@ to each CRD schema, including CRDs that omit it. Native Kubernetes schemas use the configured `1.36.3` baseline and a pinned `yannh/kubernetes-json-schema` commit. Helm uses the same version baseline. -Schema checking requires no cluster. Downloading tools, charts, and native -schemas requires public network access; CRD schemas are committed locally. +Schema checking requires no cluster. Downloading tools, charts, native schemas +and CRD sources requires public network access. Every download honors +`HTTPS_PROXY`/`HTTP_PROXY`/`NO_PROXY`: Helm and kubeconform natively, and the Node +scripts through `hack/lib/download.js`. To update a source, edit its commit/path in `sources.json` (and the Kubernetes -commit/version in `config.json` when needed), then regenerate and verify: +commit/version in `config.json` when needed), then refresh the lock and verify: ```sh -npm run helm:update-schemas +npm run helm:update-crds npm run test:helm npm run test:helm:integration npm run validate:helm -- --all npm run validate:helm -- --all --chart-mode declared ``` -Review generated changes together with provenance. Changes to conversion rules -must regenerate the schemas; bump the converter version when changing an -already deployed conversion contract. Tool updates must also update archive -checksums in `config.json`. +Review the lock change by comparing each upstream CRD between the old and new +commits; `node hack/build-crds.js DIR` writes the converted schemas for a closer +look. Conversion rule changes take effect on the next run; bump the converter +version, and refresh the lock, when changing an already deployed conversion +contract. Tool updates must also update archive checksums in `config.json`. The acceptance suite runs both latest and declared modes. It checks GLM's fixed and ranged chart declarations, a fixed vLLM release, both Gemma variants, an LWS @@ -131,8 +141,8 @@ fields, incorrect types, invalid Kubernetes nesting, invalid CRD fields, templat release, legacy chart rejection, and unknown/mismatched GVKs. Rendered custom resources must use the canonical Modelsphere groups. Unit tests additionally cover selection, future stable releases beyond fixed pins, prerelease exclusion, -package reuse, missing latest releases, download failures, a missing chart values -schema, empty renders and failure propagation. +package reuse, missing latest releases, CRD build and download failures, a missing chart values +schema, empty renders, published legacy declarations and failure propagation. ## Rollout and limits @@ -142,6 +152,8 @@ The initial full-catalog run exposed a deadline/startup budget mismatch in the `180 × 30 = 5400` seconds. Both values have been deliberately corrected to `7200`, matching this model's other variants and leaving 1800 seconds beyond the probe budget. No validator exception is needed for these configurations. +This edits two published versions in place, so the Pages workflow requires +`allow_rewrites` when publishing it. After this workflow is merged and its check has run, add **`validate-helm`** to the target branch's required status checks in GitHub branch protection/rulesets. diff --git a/schema/helm/crds/autoscaling.modelsphere.dev/llmscaler_v1alpha1.json b/schema/helm/crds/autoscaling.modelsphere.dev/llmscaler_v1alpha1.json deleted file mode 100644 index 0c07922..0000000 --- a/schema/helm/crds/autoscaling.modelsphere.dev/llmscaler_v1alpha1.json +++ /dev/null @@ -1,465 +0,0 @@ -{ - "description": "LLMScaler is the Schema for the llmscalers API", - "properties": { - "apiVersion": { - "type": "string", - "enum": [ - "autoscaling.modelsphere.dev/v1alpha1" - ] - }, - "kind": { - "type": "string", - "enum": [ - "LLMScaler" - ] - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" - }, - "spec": { - "description": "spec defines the desired state of LLMScaler", - "properties": { - "customProvider": { - "description": "customProvider configures the Custom metric provider. Required when\nmetricProvider is Custom, ignored otherwise.", - "properties": { - "namespace": { - "description": "namespace optionally narrows the match to decisions carrying this\nnamespace, for a server that reports the same serviceId in several. When\nempty, serviceId alone selects the decision — and a serviceId matching\nmore than one decision is an error rather than a choice, so set this if\nthe server ever reports duplicates.", - "type": "string" - }, - "path": { - "default": "/decisions", - "description": "path is the request path on serverAddress. Defaults to /decisions.", - "type": "string" - }, - "serviceId": { - "description": "serviceId names the service whose decision to read. It is sent as the\nserviceId query parameter and is also matched against\ndecisions[].serviceId in the reply, since the server is free to answer\nwith more than it was asked for.", - "type": "string" - } - }, - "required": [ - "serviceId" - ], - "type": "object", - "additionalProperties": false - }, - "maxReplicas": { - "description": "maxReplicas is the upper limit for the number of replicas to which the\nautoscaler can scale up. 0 pins the fleet at zero replicas, which\ncombined with minReplicas: 0 disables scaling entirely.", - "format": "int32", - "minimum": 0, - "type": "integer" - }, - "metricProvider": { - "default": "Prometheus", - "description": "metricProvider selects where the scaling signal comes from.\n\"Prometheus\" (default) evaluates spec.metrics as PromQL against\nspec.serverAddress and derives replicas from them. \"Custom\" ignores\nspec.metrics entirely and reads a replica count straight off the decision\nserver described by spec.customProvider — the two are alternatives, not\nlayers, and there is no fallback from one to the other.", - "enum": [ - "Prometheus", - "Custom" - ], - "type": "string" - }, - "metrics": { - "description": "metrics contains the specifications for which to use to calculate the\ndesired replica count. Required (and non-empty) under the Prometheus\nprovider; ignored under Custom, which gets its recommendation from the\ndecision server instead.", - "items": { - "description": "MetricSpec defines a Prometheus query and the target value to scale on.", - "properties": { - "name": { - "description": "name is an optional identifier for this metric, used in logs and events.", - "type": "string" - }, - "query": { - "description": "query is a PromQL instant query returning the current metric value as a\nsingle (averaged) scalar. Scaling compares it to target as\n desiredReplicas = ceil(readyReplicas * value / target)\nso it should be a per-replica value — e.g. wrap it in avg(...). Bake any\nlabel filters into the query. Example:\n avg(vllm:kv_cache_usage_perc{model_name=\"opt-125m\"})\nA result of more than one series is an error, not a sample to pick from:\naggregate away every label the source varies on (backend, model, route,\npod). A query that errors, returns no data, or returns NaN/Inf is skipped\nfor that sync rather than read as zero; if every metric is skipped the\nreplica count is held where it is.", - "type": "string" - }, - "target": { - "description": "target is the desired per-replica value of the query result. When the\nmeasured value exceeds target, replicas scale up proportionally. It must be\na finite positive number on the same scale as the query — a \"%\" suffix is\nrejected, since \"80%\" cannot be resolved without knowing whether the query\nreturns a 0-1 fraction (write \"0.8\") or a 0-100 percentage (write \"80\").", - "type": "string" - } - }, - "required": [ - "query", - "target" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array" - }, - "minReplicas": { - "description": "minReplicas is the lower limit for the number of replicas to which the\nautoscaler can scale down. 0 enables scale-to-zero: an idle target is\nscaled all the way down, and wakes back up when a metric evaluates to a\npositive recommendation (under the Prometheus provider the ratio is then\ncomputed against a single-replica baseline, since a fleet of zero has no\nper-replica measurement to scale off).", - "format": "int32", - "minimum": 0, - "type": "integer" - }, - "preemption": { - "description": "preemption defines whether priority-based preemption is enabled", - "properties": { - "enable": { - "type": "boolean" - }, - "priorityClass": { - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "retryPeriodSeconds": { - "default": 10, - "description": "retryPeriodSeconds is the interval at which the autoscaler retries when an error occurs or target is not found. Defaults to 10.", - "format": "int32", - "type": "integer" - }, - "scaleDown": { - "description": "scaleDown defines the behavior for scaling down, e.g. cache-aware teardown", - "properties": { - "behavior": { - "default": "CacheAware", - "description": "behavior controls how pods are chosen when scaling down.\n\"CacheAware\" (default) biases removal toward the coldest-cache pods by\nsetting a low controller.kubernetes.io/pod-deletion-cost on the pods being\nremoved, so the ReplicaSet deletes them first. This is best-effort and only\napplies to Deployment/ReplicaSet targets — StatefulSet/LWS scale-down is\nordinal-based and ignores the hint. \"None\" opts out and uses the workload\ncontroller's default deletion order.", - "enum": [ - "CacheAware", - "None" - ], - "type": "string" - }, - "deletionCostQuery": { - "description": "deletionCostQuery is an optional PromQL instant query used to compute each\npod's controller.kubernetes.io/pod-deletion-cost at scale-down time (only\napplies when behavior is CacheAware). It is evaluated against\nspec.serverAddress and must return one series per pod\ncarrying a \"pod\" label; the sample value becomes that pod's deletion cost.\nLower cost is deleted first, so the expression should yield lower numbers\nfor colder / less valuable pods (e.g. \"vllm:kv_cache_usage_perc * 100\").\nWhen empty, a newest-pod-first heuristic is used instead. It is PromQL, so\nit is only consulted under the Prometheus metric provider — under Custom,\nspec.serverAddress is a decision server with no query API, and the\nheuristic is used regardless of what is set here.", - "type": "string" - }, - "maxStepReplicas": { - "description": "maxStepReplicas caps how many replicas a single scale-down step may remove,\nso the fleet shrinks gradually instead of dropping straight from N to\nminReplicas when the metric collapses. It bounds the size of a step, not how\noften one happens: the next scale-down also waits for the previous one to\nsettle, so steps are at least syncPeriodSeconds apart and can be further\napart while the target is still converging. A full descent therefore takes\nroughly ceil((current-minReplicas)/maxStepReplicas) steps at that spacing —\non a slow-settling workload prefer a larger step. It rate-limits the write\nonly:\nstatus.desiredReplicas keeps reporting the uncapped recommendation, and\nsubsequent syncs keep stepping toward it until they meet. Scaling never goes\nbelow minReplicas, and scale-up is unaffected. 0 (default) means unlimited —\nscale down straight to the recommendation.", - "format": "int32", - "minimum": 0, - "type": "integer" - }, - "stabilizationWindowSeconds": { - "description": "stabilizationWindowSeconds dampens scale-down: replicas are held at the\nhighest recommendation seen within this many seconds, so a brief metric dip\ndoesn't shrink the fleet. Scale-up is immediate. 0 disables stabilization.", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "serverAddress": { - "description": "serverAddress is the metric source endpoint: the Prometheus query API\n(e.g. http://prometheus:9090) under the Prometheus provider, or the\ndecision server's base URL (e.g. http://decisions:80) under Custom.", - "type": "string" - }, - "serverHeaders": { - "additionalProperties": { - "type": "string" - }, - "description": "serverHeaders are additional HTTP headers sent with every metric-fetch\nrequest to the metric source (e.g. Authorization for a secured endpoint).\nValues are used verbatim.", - "type": "object" - }, - "syncPeriodSeconds": { - "default": 15, - "description": "syncPeriodSeconds is the interval at which the autoscaler evaluates metrics and scales. Defaults to 15.", - "format": "int32", - "type": "integer" - }, - "targetRef": { - "description": "targetRef points to the resource (e.g., Deployment) to scale", - "properties": { - "apiVersion": { - "type": "string" - }, - "kind": { - "type": "string" - }, - "name": { - "type": "string" - } - }, - "required": [ - "apiVersion", - "kind", - "name" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "maxReplicas", - "minReplicas", - "serverAddress", - "targetRef" - ], - "type": "object", - "x-kubernetes-validations": [ - { - "message": "spec.metrics must be non-empty unless spec.metricProvider is Custom", - "rule": "(has(self.metricProvider) && self.metricProvider == 'Custom') || (has(self.metrics) && size(self.metrics) > 0)" - }, - { - "message": "spec.customProvider is required when spec.metricProvider is Custom", - "rule": "!(has(self.metricProvider) && self.metricProvider == 'Custom') || has(self.customProvider)" - } - ], - "additionalProperties": false - }, - "status": { - "description": "status defines the observed state of LLMScaler", - "properties": { - "conditions": { - "description": "conditions represent the current state of the LLMScaler resource.", - "items": { - "description": "Condition contains details for one aspect of the current state of this API Resource.", - "properties": { - "lastTransitionTime": { - "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", - "format": "date-time", - "type": "string" - }, - "message": { - "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", - "maxLength": 32768, - "type": "string" - }, - "observedGeneration": { - "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "reason": { - "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", - "maxLength": 1024, - "minLength": 1, - "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", - "type": "string" - }, - "status": { - "description": "status of the condition, one of True, False, Unknown.", - "enum": [ - "True", - "False", - "Unknown" - ], - "type": "string" - }, - "type": { - "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", - "maxLength": 316, - "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", - "type": "string" - } - }, - "required": [ - "lastTransitionTime", - "message", - "reason", - "status", - "type" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "type" - ], - "x-kubernetes-list-type": "map" - }, - "currentReplicas": { - "description": "currentReplicas is the current number of replicas of pods managed by this autoscaler", - "format": "int32", - "type": "integer" - }, - "desiredReplicas": { - "description": "desiredReplicas is the desired number of replicas of pods managed by this autoscaler", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "spec", - "apiVersion", - "kind", - "metadata" - ], - "type": "object", - "additionalProperties": false, - "$schema": "http://json-schema.org/draft-07/schema#", - "definitions": { - "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { - "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", - "type": "object" - }, - "creationTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "deletionGracePeriodSeconds": { - "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", - "format": "int64", - "type": "integer" - }, - "deletionTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "finalizers": { - "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set", - "x-kubernetes-patch-strategy": "merge" - }, - "generateName": { - "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", - "type": "string" - }, - "generation": { - "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", - "format": "int64", - "type": "integer" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", - "type": "object" - }, - "managedFields": { - "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "namespace": { - "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", - "type": "string" - }, - "ownerReferences": { - "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "uid" - ], - "x-kubernetes-list-type": "map", - "x-kubernetes-patch-merge-key": "uid", - "x-kubernetes-patch-strategy": "merge" - }, - "resourceVersion": { - "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", - "type": "string" - }, - "selfLink": { - "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", - "type": "string" - }, - "uid": { - "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { - "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", - "format": "date-time", - "type": "string" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { - "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", - "type": "string" - }, - "fieldsType": { - "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", - "type": "string" - }, - "fieldsV1": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", - "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." - }, - "manager": { - "description": "Manager is an identifier of the workflow managing these fields.", - "type": "string" - }, - "operation": { - "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", - "type": "string" - }, - "subresource": { - "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", - "type": "string" - }, - "time": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { - "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", - "type": "object" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { - "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", - "properties": { - "apiVersion": { - "description": "API version of the referent.", - "type": "string" - }, - "blockOwnerDeletion": { - "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", - "type": "boolean" - }, - "controller": { - "description": "If true, this reference points to the managing controller.", - "type": "boolean" - }, - "kind": { - "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "name": { - "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "uid": { - "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "required": [ - "apiVersion", - "kind", - "name", - "uid" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - } -} diff --git a/schema/helm/crds/inference.modelsphere.dev/llmslorequirement_v1alpha1.json b/schema/helm/crds/inference.modelsphere.dev/llmslorequirement_v1alpha1.json deleted file mode 100644 index 7b015aa..0000000 --- a/schema/helm/crds/inference.modelsphere.dev/llmslorequirement_v1alpha1.json +++ /dev/null @@ -1,474 +0,0 @@ -{ - "properties": { - "spec": { - "properties": { - "maximumDeployment": { - "properties": { - "type": { - "default": "replica", - "enum": [ - "replica" - ], - "type": "string" - }, - "value": { - "description": "Highest replica count the decision service may recommend. 0 (with minimumDeployment.value also 0) turns the service off.", - "minimum": 0, - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "minimumDeployment": { - "default": { - "type": "replica", - "value": 1 - }, - "properties": { - "type": { - "default": "replica", - "enum": [ - "replica", - "concurrency" - ], - "type": "string" - }, - "value": { - "description": "Lowest replica count the decision service may recommend. 0 enables scale-to-zero: an idle service is scaled all the way down.", - "default": 1, - "minimum": 0, - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "otps": { - "description": "Output Tokens Per Second (OTPS) SLO configuration.", - "properties": { - "default": { - "description": "Default fallback metrics applied when input does not hit any specific range.", - "properties": { - "metrics": { - "items": { - "properties": { - "threshold": { - "format": "float", - "minimum": 0, - "type": "number" - }, - "type": { - "enum": [ - "avg", - "p50", - "p80", - "p90", - "p95", - "p99" - ], - "type": "string" - } - }, - "required": [ - "type", - "threshold" - ], - "type": "object", - "additionalProperties": false - }, - "minItems": 1, - "type": "array" - } - }, - "required": [ - "metrics" - ], - "type": "object", - "additionalProperties": false - }, - "ranges": { - "items": { - "properties": { - "contextLengthRangeHigh": { - "minimum": 1, - "type": "integer" - }, - "contextLengthRangeLow": { - "minimum": 0, - "type": "integer" - }, - "metrics": { - "description": "Multiple metric definitions (p50, p90, etc.) for this context range.", - "items": { - "properties": { - "threshold": { - "format": "float", - "minimum": 0, - "type": "number" - }, - "type": { - "enum": [ - "avg", - "p50", - "p80", - "p90", - "p95", - "p99" - ], - "type": "string" - } - }, - "required": [ - "type", - "threshold" - ], - "type": "object", - "additionalProperties": false - }, - "minItems": 1, - "type": "array" - } - }, - "required": [ - "contextLengthRangeLow", - "metrics" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array" - } - }, - "type": "object", - "additionalProperties": false - }, - "priority": { - "default": 0, - "description": "Priority level from 0 to 10. Deployments with higher priority acquire nodes first.", - "maximum": 10, - "minimum": 0, - "type": "integer" - }, - "serviceId": { - "description": "Identifier referencing the target service.", - "type": "string" - }, - "ttft": { - "description": "Time To First Token (TTFT) SLO configuration.", - "properties": { - "default": { - "description": "Default fallback metrics applied when input does not hit any specific range.", - "properties": { - "metrics": { - "items": { - "properties": { - "threshold": { - "format": "float", - "minimum": 0, - "type": "number" - }, - "type": { - "enum": [ - "avg", - "p50", - "p80", - "p90", - "p95", - "p99" - ], - "type": "string" - } - }, - "required": [ - "type", - "threshold" - ], - "type": "object", - "additionalProperties": false - }, - "minItems": 1, - "type": "array" - } - }, - "required": [ - "metrics" - ], - "type": "object", - "additionalProperties": false - }, - "ranges": { - "items": { - "properties": { - "contextLengthRangeHigh": { - "minimum": 1, - "type": "integer" - }, - "contextLengthRangeLow": { - "minimum": 0, - "type": "integer" - }, - "metrics": { - "description": "Multiple metric definitions (p50, p90, etc.) for this context range.", - "items": { - "properties": { - "threshold": { - "format": "float", - "minimum": 0, - "type": "number" - }, - "type": { - "enum": [ - "avg", - "p50", - "p80", - "p90", - "p95", - "p99" - ], - "type": "string" - } - }, - "required": [ - "type", - "threshold" - ], - "type": "object", - "additionalProperties": false - }, - "minItems": 1, - "type": "array" - } - }, - "required": [ - "contextLengthRangeLow", - "metrics" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "serviceId" - ], - "type": "object", - "x-kubernetes-validations": [ - { - "rule": "!has(self.maximumDeployment) || self.minimumDeployment.value <= self.maximumDeployment.value", - "message": "minimumDeployment.value must be less than or equal to maximumDeployment.value" - }, - { - "rule": "!has(self.maximumDeployment) || self.minimumDeployment.value != 0 || self.maximumDeployment.value == 0", - "message": "maximumDeployment.value must be 0 when minimumDeployment.value is 0 (scale-to-zero is only for temporarily suspending the service)" - } - ], - "additionalProperties": false - }, - "apiVersion": { - "type": "string", - "enum": [ - "inference.modelsphere.dev/v1alpha1" - ] - }, - "kind": { - "type": "string", - "enum": [ - "LLMSLORequirement" - ] - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" - } - }, - "type": "object", - "additionalProperties": false, - "$schema": "http://json-schema.org/draft-07/schema#", - "definitions": { - "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { - "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", - "type": "object" - }, - "creationTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "deletionGracePeriodSeconds": { - "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", - "format": "int64", - "type": "integer" - }, - "deletionTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "finalizers": { - "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set", - "x-kubernetes-patch-strategy": "merge" - }, - "generateName": { - "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", - "type": "string" - }, - "generation": { - "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", - "format": "int64", - "type": "integer" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", - "type": "object" - }, - "managedFields": { - "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "namespace": { - "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", - "type": "string" - }, - "ownerReferences": { - "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "uid" - ], - "x-kubernetes-list-type": "map", - "x-kubernetes-patch-merge-key": "uid", - "x-kubernetes-patch-strategy": "merge" - }, - "resourceVersion": { - "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", - "type": "string" - }, - "selfLink": { - "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", - "type": "string" - }, - "uid": { - "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { - "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", - "format": "date-time", - "type": "string" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { - "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", - "type": "string" - }, - "fieldsType": { - "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", - "type": "string" - }, - "fieldsV1": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", - "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." - }, - "manager": { - "description": "Manager is an identifier of the workflow managing these fields.", - "type": "string" - }, - "operation": { - "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", - "type": "string" - }, - "subresource": { - "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", - "type": "string" - }, - "time": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { - "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", - "type": "object" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { - "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", - "properties": { - "apiVersion": { - "description": "API version of the referent.", - "type": "string" - }, - "blockOwnerDeletion": { - "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", - "type": "boolean" - }, - "controller": { - "description": "If true, this reference points to the managing controller.", - "type": "boolean" - }, - "kind": { - "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "name": { - "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "uid": { - "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "required": [ - "apiVersion", - "kind", - "name", - "uid" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "required": [ - "apiVersion", - "kind", - "metadata" - ] -} diff --git a/schema/helm/crds/leaderworkerset.x-k8s.io/leaderworkerset_v1.json b/schema/helm/crds/leaderworkerset.x-k8s.io/leaderworkerset_v1.json deleted file mode 100644 index f1d08a1..0000000 --- a/schema/helm/crds/leaderworkerset.x-k8s.io/leaderworkerset_v1.json +++ /dev/null @@ -1,16589 +0,0 @@ -{ - "description": "LeaderWorkerSet is the Schema for the leaderworkersets API", - "properties": { - "apiVersion": { - "type": "string", - "enum": [ - "leaderworkerset.x-k8s.io/v1" - ] - }, - "kind": { - "type": "string", - "enum": [ - "LeaderWorkerSet" - ] - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" - }, - "spec": { - "description": "spec defines the desired behavior of LeaderWorkerSet.", - "properties": { - "groupIdentity": { - "default": "Ordinal", - "description": "groupIdentity determines how group identities are assigned.\nOrdinal (default) manages leaders through a StatefulSet: groups are named\n-0..-N-1 and scale down always removes the highest ordinal.\nHash manages leaders through a Deployment: group names are hash-suffixed,\nscale down prefers unscheduled and not-ready groups over healthy ones, and\nrollouts are paced by a group readiness gate on the leader pods.\nThis field is immutable.", - "enum": [ - "Ordinal", - "Hash" - ], - "type": "string" - }, - "groupReplacementPolicy": { - "default": "PostTermination", - "description": "groupReplacementPolicy controls when a replacement group may start\nscheduling after a group is deleted, whether by the restart policy\nrecreating a failed group, by a rolling update or by a scale down that\nraces a scale up.\nPostTermination (default) admits a replacement only once a previously\ndeleted group has been fully removed, so the new group lands on the\ncapacity the old one released instead of preempting other workloads.\nThis matches the StatefulSet semantics of groupIdentity Ordinal, where a\nleader pod cannot be recreated until its predecessor is gone, and is the\nonly supported value in that mode.\nImmediate admits replacement groups as soon as the leader Deployment\ncreates them, overlapping with the teardown of the old group. Only\nsupported with groupIdentity Hash.", - "enum": [ - "Immediate", - "PostTermination" - ], - "type": "string" - }, - "leaderWorkerTemplate": { - "description": "leaderWorkerTemplate defines the template for leader/worker pods", - "properties": { - "leaderTemplate": { - "description": "leaderTemplate defines the pod template for leader pods.", - "properties": { - "metadata": { - "description": "Standard object's metadata.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "finalizers": { - "items": { - "type": "string" - }, - "type": "array" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "name": { - "type": "string" - }, - "namespace": { - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "spec": { - "description": "Specification of the desired behavior of the pod.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", - "properties": { - "activeDeadlineSeconds": { - "description": "Optional duration in seconds the pod may be active on the node relative to\nStartTime before the system will actively try to mark it failed and kill associated containers.\nValue must be a positive integer.", - "format": "int64", - "type": "integer" - }, - "affinity": { - "description": "If specified, the pod's scheduling constraints", - "properties": { - "nodeAffinity": { - "description": "Describes node affinity scheduling rules for the pod.", - "properties": { - "preferredDuringSchedulingIgnoredDuringExecution": { - "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node matches the corresponding matchExpressions; the\nnode(s) with the highest sum are the most preferred.", - "items": { - "description": "An empty preferred scheduling term matches all objects with implicit weight 0\n(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).", - "properties": { - "preference": { - "description": "A node selector term, associated with the corresponding weight.", - "properties": { - "matchExpressions": { - "description": "A list of node selector requirements by node's labels.", - "items": { - "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - "properties": { - "key": { - "description": "The label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - "type": "string" - }, - "values": { - "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchFields": { - "description": "A list of node selector requirements by node's fields.", - "items": { - "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - "properties": { - "key": { - "description": "The label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - "type": "string" - }, - "values": { - "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "weight": { - "description": "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.", - "format": "int32", - "type": "integer" - } - }, - "required": [ - "preference", - "weight" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "requiredDuringSchedulingIgnoredDuringExecution": { - "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to an update), the system\nmay or may not try to eventually evict the pod from its node.", - "properties": { - "nodeSelectorTerms": { - "description": "Required. A list of node selector terms. The terms are ORed.", - "items": { - "description": "A null or empty node selector term matches no objects. The requirements of\nthem are ANDed.\nThe TopologySelectorTerm type implements a subset of the NodeSelectorTerm.", - "properties": { - "matchExpressions": { - "description": "A list of node selector requirements by node's labels.", - "items": { - "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - "properties": { - "key": { - "description": "The label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - "type": "string" - }, - "values": { - "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchFields": { - "description": "A list of node selector requirements by node's fields.", - "items": { - "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - "properties": { - "key": { - "description": "The label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - "type": "string" - }, - "values": { - "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "nodeSelectorTerms" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "podAffinity": { - "description": "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).", - "properties": { - "preferredDuringSchedulingIgnoredDuringExecution": { - "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", - "items": { - "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", - "properties": { - "podAffinityTerm": { - "description": "Required. A pod affinity term, associated with the corresponding weight.", - "properties": { - "labelSelector": { - "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "mismatchLabelKeys": { - "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "namespaceSelector": { - "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "namespaces": { - "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologyKey": { - "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - "type": "string" - } - }, - "required": [ - "topologyKey" - ], - "type": "object", - "additionalProperties": false - }, - "weight": { - "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", - "format": "int32", - "type": "integer" - } - }, - "required": [ - "podAffinityTerm", - "weight" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "requiredDuringSchedulingIgnoredDuringExecution": { - "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", - "items": { - "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", - "properties": { - "labelSelector": { - "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "mismatchLabelKeys": { - "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "namespaceSelector": { - "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "namespaces": { - "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologyKey": { - "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - "type": "string" - } - }, - "required": [ - "topologyKey" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "podAntiAffinity": { - "description": "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", - "properties": { - "preferredDuringSchedulingIgnoredDuringExecution": { - "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", - "items": { - "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", - "properties": { - "podAffinityTerm": { - "description": "Required. A pod affinity term, associated with the corresponding weight.", - "properties": { - "labelSelector": { - "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "mismatchLabelKeys": { - "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "namespaceSelector": { - "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "namespaces": { - "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologyKey": { - "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - "type": "string" - } - }, - "required": [ - "topologyKey" - ], - "type": "object", - "additionalProperties": false - }, - "weight": { - "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", - "format": "int32", - "type": "integer" - } - }, - "required": [ - "podAffinityTerm", - "weight" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "requiredDuringSchedulingIgnoredDuringExecution": { - "description": "If the anti-affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the anti-affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", - "items": { - "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", - "properties": { - "labelSelector": { - "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "mismatchLabelKeys": { - "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "namespaceSelector": { - "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "namespaces": { - "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologyKey": { - "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - "type": "string" - } - }, - "required": [ - "topologyKey" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "automountServiceAccountToken": { - "description": "AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.", - "type": "boolean" - }, - "containers": { - "description": "List of containers belonging to the pod.\nContainers cannot currently be added or removed.\nThere must be at least one container in a Pod.\nCannot be updated.", - "items": { - "description": "A single application container that you want to run within a pod.", - "properties": { - "args": { - "description": "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "command": { - "description": "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "env": { - "description": "List of environment variables to set in the container.\nCannot be updated.", - "items": { - "description": "EnvVar represents an environment variable present in a Container.", - "properties": { - "name": { - "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "value": { - "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", - "type": "string" - }, - "valueFrom": { - "description": "Source for the environment variable's value. Cannot be used if value is not empty.", - "properties": { - "configMapKeyRef": { - "description": "Selects a key of a ConfigMap.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fieldRef": { - "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fileKeyRef": { - "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", - "properties": { - "key": { - "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", - "type": "string" - }, - "optional": { - "default": false, - "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", - "type": "boolean" - }, - "path": { - "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", - "type": "string" - }, - "volumeName": { - "description": "The name of the volume mount containing the env file.", - "type": "string" - } - }, - "required": [ - "key", - "path", - "volumeName" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secretKeyRef": { - "description": "Selects a key of a secret in the pod's namespace", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "envFrom": { - "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", - "items": { - "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", - "properties": { - "configMapRef": { - "description": "The ConfigMap to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "prefix": { - "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "secretRef": { - "description": "The Secret to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "image": { - "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", - "type": "string" - }, - "imagePullPolicy": { - "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", - "type": "string" - }, - "lifecycle": { - "description": "Actions that the management system should take in response to container lifecycle events.\nCannot be updated.", - "properties": { - "postStart": { - "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "preStop": { - "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "stopSignal": { - "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "livenessProbe": { - "description": "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "name": { - "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", - "type": "string" - }, - "ports": { - "description": "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", - "items": { - "description": "ContainerPort represents a network port in a single container.", - "properties": { - "containerPort": { - "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", - "format": "int32", - "type": "integer" - }, - "hostIP": { - "description": "What host IP to bind the external port to.", - "type": "string" - }, - "hostPort": { - "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", - "format": "int32", - "type": "integer" - }, - "name": { - "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", - "type": "string" - }, - "protocol": { - "default": "TCP", - "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", - "type": "string" - } - }, - "required": [ - "containerPort" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "containerPort", - "protocol" - ], - "x-kubernetes-list-type": "map" - }, - "readinessProbe": { - "description": "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "resizePolicy": { - "description": "Resources resize policy for the container.\nThis field cannot be set on ephemeral containers.", - "items": { - "description": "ContainerResizePolicy represents resource resize policy for the container.", - "properties": { - "resourceName": { - "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", - "type": "string" - }, - "restartPolicy": { - "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", - "type": "string" - } - }, - "required": [ - "resourceName", - "restartPolicy" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "resources": { - "description": "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "properties": { - "claims": { - "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", - "items": { - "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", - "properties": { - "name": { - "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - "type": "string" - }, - "request": { - "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "restartPolicy": { - "description": "RestartPolicy defines the restart behavior of individual containers in a pod.\nThis overrides the pod-level restart policy. When this field is not specified,\nthe restart behavior is defined by the Pod's restart policy and the container type.\nAdditionally, setting the RestartPolicy as \"Always\" for the init container will\nhave the following effect:\nthis init container will be continually restarted on\nexit until all regular containers have terminated. Once all regular\ncontainers have completed, all init containers with restartPolicy \"Always\"\nwill be shut down. This lifecycle differs from normal init containers and\nis often referred to as a \"sidecar\" container. Although this init\ncontainer still starts in the init container sequence, it does not wait\nfor the container to complete before proceeding to the next init\ncontainer. Instead, the next init container starts immediately after this\ninit container is started, or after any startupProbe has successfully\ncompleted.", - "type": "string" - }, - "restartPolicyRules": { - "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. The rules are evaluated in\norder. Once a rule matches a container exit condition, the remaining\nrules are ignored. If no rule matches the container exit condition,\nthe Container-level restart policy determines the whether the container\nis restarted or not. Constraints on the rules:\n- At most 20 rules are allowed.\n- Rules can have the same action.\n- Identical rules are not forbidden in validations.\nWhen rules are specified, container MUST set RestartPolicy explicitly\neven it if matches the Pod's RestartPolicy.", - "items": { - "description": "ContainerRestartRule describes how a container exit is handled.", - "properties": { - "action": { - "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", - "type": "string" - }, - "exitCodes": { - "description": "Represents the exit codes to check on container exits.", - "properties": { - "operator": { - "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", - "type": "string" - }, - "values": { - "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", - "items": { - "format": "int32", - "type": "integer" - }, - "type": "array", - "x-kubernetes-list-type": "set" - } - }, - "required": [ - "operator" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "action" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "securityContext": { - "description": "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", - "properties": { - "allowPrivilegeEscalation": { - "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "appArmorProfile": { - "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", - "type": "string" - }, - "type": { - "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "capabilities": { - "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "add": { - "description": "Added capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "drop": { - "description": "Removed capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "privileged": { - "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "procMount": { - "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "readOnlyRootFilesystem": { - "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "runAsGroup": { - "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "runAsNonRoot": { - "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "boolean" - }, - "runAsUser": { - "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "seLinuxOptions": { - "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "level": { - "description": "Level is SELinux level label that applies to the container.", - "type": "string" - }, - "role": { - "description": "Role is a SELinux role label that applies to the container.", - "type": "string" - }, - "type": { - "description": "Type is a SELinux type label that applies to the container.", - "type": "string" - }, - "user": { - "description": "User is a SELinux user label that applies to the container.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "seccompProfile": { - "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - "type": "string" - }, - "type": { - "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "windowsOptions": { - "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", - "properties": { - "gmsaCredentialSpec": { - "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", - "type": "string" - }, - "gmsaCredentialSpecName": { - "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", - "type": "string" - }, - "hostProcess": { - "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", - "type": "boolean" - }, - "runAsUserName": { - "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "startupProbe": { - "description": "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "stdin": { - "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", - "type": "boolean" - }, - "stdinOnce": { - "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", - "type": "boolean" - }, - "terminationMessagePath": { - "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", - "type": "string" - }, - "terminationMessagePolicy": { - "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", - "type": "string" - }, - "tty": { - "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", - "type": "boolean" - }, - "volumeDevices": { - "description": "volumeDevices is the list of block devices to be used by the container.", - "items": { - "description": "volumeDevice describes a mapping of a raw block device within a container.", - "properties": { - "devicePath": { - "description": "devicePath is the path inside of the container that the device will be mapped to.", - "type": "string" - }, - "name": { - "description": "name must match the name of a persistentVolumeClaim in the pod", - "type": "string" - } - }, - "required": [ - "devicePath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "devicePath" - ], - "x-kubernetes-list-type": "map" - }, - "volumeMounts": { - "description": "Pod volumes to mount into the container's filesystem.\nCannot be updated.", - "items": { - "description": "VolumeMount describes a mounting of a Volume within a container.", - "properties": { - "bindMountOptions": { - "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set" - }, - "mountPath": { - "description": "Path within the container at which the volume should be mounted.", - "type": "string" - }, - "mountPropagation": { - "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", - "type": "string" - }, - "name": { - "description": "This must match the Name of a Volume.", - "type": "string" - }, - "readOnly": { - "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", - "type": "boolean" - }, - "recursiveReadOnly": { - "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", - "type": "string" - }, - "subPath": { - "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", - "type": "string" - }, - "subPathExpr": { - "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", - "type": "string" - } - }, - "required": [ - "mountPath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "mountPath" - ], - "x-kubernetes-list-type": "map" - }, - "workingDir": { - "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "dnsConfig": { - "description": "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", - "properties": { - "nameservers": { - "description": "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "options": { - "description": "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", - "items": { - "description": "PodDNSConfigOption defines DNS resolver options of a pod.", - "properties": { - "name": { - "description": "Name is this DNS resolver option's name.\nRequired.", - "type": "string" - }, - "value": { - "description": "Value is this DNS resolver option's value.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "searches": { - "description": "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "dnsPolicy": { - "description": "Set DNS policy for the pod.\nDefaults to \"ClusterFirst\".\nValid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'.\nDNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy.\nTo have DNS options set along with hostNetwork, you have to specify DNS policy\nexplicitly to 'ClusterFirstWithHostNet'.", - "type": "string" - }, - "enableServiceLinks": { - "description": "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", - "type": "boolean" - }, - "ephemeralContainers": { - "description": "List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing\npod to perform user-initiated actions such as debugging. This list cannot be specified when\ncreating a pod, and it cannot be modified by updating the pod spec. In order to add an\nephemeral container to an existing pod, use the pod's ephemeralcontainers subresource.", - "items": { - "description": "An EphemeralContainer is a temporary container that you may add to an existing Pod for\nuser-initiated activities such as debugging. Ephemeral containers have no resource or\nscheduling guarantees, and they will not be restarted when they exit or when a Pod is\nremoved or restarted. The kubelet may evict a Pod if an ephemeral container causes the\nPod to exceed its resource allocation.\n\nTo add an ephemeral container, use the ephemeralcontainers subresource of an existing\nPod. Ephemeral containers may not be removed or restarted.", - "properties": { - "args": { - "description": "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "command": { - "description": "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "env": { - "description": "List of environment variables to set in the container.\nCannot be updated.", - "items": { - "description": "EnvVar represents an environment variable present in a Container.", - "properties": { - "name": { - "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "value": { - "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", - "type": "string" - }, - "valueFrom": { - "description": "Source for the environment variable's value. Cannot be used if value is not empty.", - "properties": { - "configMapKeyRef": { - "description": "Selects a key of a ConfigMap.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fieldRef": { - "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fileKeyRef": { - "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", - "properties": { - "key": { - "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", - "type": "string" - }, - "optional": { - "default": false, - "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", - "type": "boolean" - }, - "path": { - "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", - "type": "string" - }, - "volumeName": { - "description": "The name of the volume mount containing the env file.", - "type": "string" - } - }, - "required": [ - "key", - "path", - "volumeName" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secretKeyRef": { - "description": "Selects a key of a secret in the pod's namespace", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "envFrom": { - "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", - "items": { - "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", - "properties": { - "configMapRef": { - "description": "The ConfigMap to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "prefix": { - "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "secretRef": { - "description": "The Secret to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "image": { - "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", - "type": "string" - }, - "imagePullPolicy": { - "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", - "type": "string" - }, - "lifecycle": { - "description": "Lifecycle is not allowed for ephemeral containers.", - "properties": { - "postStart": { - "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "preStop": { - "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "stopSignal": { - "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "livenessProbe": { - "description": "Probes are not allowed for ephemeral containers.", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "name": { - "description": "Name of the ephemeral container specified as a DNS_LABEL.\nThis name must be unique among all containers, init containers and ephemeral containers.", - "type": "string" - }, - "ports": { - "description": "Ports are not allowed for ephemeral containers.", - "items": { - "description": "ContainerPort represents a network port in a single container.", - "properties": { - "containerPort": { - "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", - "format": "int32", - "type": "integer" - }, - "hostIP": { - "description": "What host IP to bind the external port to.", - "type": "string" - }, - "hostPort": { - "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", - "format": "int32", - "type": "integer" - }, - "name": { - "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", - "type": "string" - }, - "protocol": { - "default": "TCP", - "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", - "type": "string" - } - }, - "required": [ - "containerPort" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "containerPort", - "protocol" - ], - "x-kubernetes-list-type": "map" - }, - "readinessProbe": { - "description": "Probes are not allowed for ephemeral containers.", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "resizePolicy": { - "description": "Resources resize policy for the container.", - "items": { - "description": "ContainerResizePolicy represents resource resize policy for the container.", - "properties": { - "resourceName": { - "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", - "type": "string" - }, - "restartPolicy": { - "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", - "type": "string" - } - }, - "required": [ - "resourceName", - "restartPolicy" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "resources": { - "description": "Resources are not allowed for ephemeral containers. Ephemeral containers use spare resources\nalready allocated to the pod.", - "properties": { - "claims": { - "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", - "items": { - "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", - "properties": { - "name": { - "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - "type": "string" - }, - "request": { - "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "restartPolicy": { - "description": "Restart policy for the container to manage the restart behavior of each\ncontainer within a pod.\nYou cannot set this field on ephemeral containers.", - "type": "string" - }, - "restartPolicyRules": { - "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. You cannot set this field on\nephemeral containers.", - "items": { - "description": "ContainerRestartRule describes how a container exit is handled.", - "properties": { - "action": { - "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", - "type": "string" - }, - "exitCodes": { - "description": "Represents the exit codes to check on container exits.", - "properties": { - "operator": { - "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", - "type": "string" - }, - "values": { - "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", - "items": { - "format": "int32", - "type": "integer" - }, - "type": "array", - "x-kubernetes-list-type": "set" - } - }, - "required": [ - "operator" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "action" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "securityContext": { - "description": "Optional: SecurityContext defines the security options the ephemeral container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.", - "properties": { - "allowPrivilegeEscalation": { - "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "appArmorProfile": { - "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", - "type": "string" - }, - "type": { - "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "capabilities": { - "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "add": { - "description": "Added capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "drop": { - "description": "Removed capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "privileged": { - "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "procMount": { - "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "readOnlyRootFilesystem": { - "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "runAsGroup": { - "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "runAsNonRoot": { - "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "boolean" - }, - "runAsUser": { - "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "seLinuxOptions": { - "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "level": { - "description": "Level is SELinux level label that applies to the container.", - "type": "string" - }, - "role": { - "description": "Role is a SELinux role label that applies to the container.", - "type": "string" - }, - "type": { - "description": "Type is a SELinux type label that applies to the container.", - "type": "string" - }, - "user": { - "description": "User is a SELinux user label that applies to the container.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "seccompProfile": { - "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - "type": "string" - }, - "type": { - "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "windowsOptions": { - "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", - "properties": { - "gmsaCredentialSpec": { - "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", - "type": "string" - }, - "gmsaCredentialSpecName": { - "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", - "type": "string" - }, - "hostProcess": { - "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", - "type": "boolean" - }, - "runAsUserName": { - "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "startupProbe": { - "description": "Probes are not allowed for ephemeral containers.", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "stdin": { - "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", - "type": "boolean" - }, - "stdinOnce": { - "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", - "type": "boolean" - }, - "targetContainerName": { - "description": "If set, the name of the container from PodSpec that this ephemeral container targets.\nThe ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.\nIf not set then the ephemeral container uses the namespaces configured in the Pod spec.\n\nThe container runtime must implement support for this feature. If the runtime does not\nsupport namespace targeting then the result of setting this field is undefined.", - "type": "string" - }, - "terminationMessagePath": { - "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", - "type": "string" - }, - "terminationMessagePolicy": { - "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", - "type": "string" - }, - "tty": { - "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", - "type": "boolean" - }, - "volumeDevices": { - "description": "volumeDevices is the list of block devices to be used by the container.", - "items": { - "description": "volumeDevice describes a mapping of a raw block device within a container.", - "properties": { - "devicePath": { - "description": "devicePath is the path inside of the container that the device will be mapped to.", - "type": "string" - }, - "name": { - "description": "name must match the name of a persistentVolumeClaim in the pod", - "type": "string" - } - }, - "required": [ - "devicePath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "devicePath" - ], - "x-kubernetes-list-type": "map" - }, - "volumeMounts": { - "description": "Pod volumes to mount into the container's filesystem. Subpath mounts are not allowed for ephemeral containers.\nCannot be updated.", - "items": { - "description": "VolumeMount describes a mounting of a Volume within a container.", - "properties": { - "bindMountOptions": { - "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set" - }, - "mountPath": { - "description": "Path within the container at which the volume should be mounted.", - "type": "string" - }, - "mountPropagation": { - "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", - "type": "string" - }, - "name": { - "description": "This must match the Name of a Volume.", - "type": "string" - }, - "readOnly": { - "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", - "type": "boolean" - }, - "recursiveReadOnly": { - "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", - "type": "string" - }, - "subPath": { - "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", - "type": "string" - }, - "subPathExpr": { - "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", - "type": "string" - } - }, - "required": [ - "mountPath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "mountPath" - ], - "x-kubernetes-list-type": "map" - }, - "workingDir": { - "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "evictionResponders": { - "description": "evictionResponders reference responders that react to Evictions based on EvictionRequests.\nResponders should observe and communicate through the Eviction Resource API to help with\nthe graceful termination of a pod. The responders are selected sequentially, according to\ntheir specified priority.\n\nResponders should periodically report on an eviction progress by updating the\n.status.responders[].heartbeatTime field of the Eviction object. If this field is not updated\nwithin the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction\nis passed over to the next responder with a lower priority. If there is no other responder,\nthe last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will\nevict the pod using the imperative Eviction API (pods//eviction subresource).\n\nThe maximum length of the responders list is 10.\nResponders are not supported when the pod is part of a PodGroup (.spec.schedulingGroup is set).\nThis field can only be set on creation and is immutable afterwards.", - "items": { - "description": "EvictionResponder allows you to specify the responder reacting to an Eviction.\nResponders should observe and communicate through the Eviction Resource API to help with\nthe graceful eviction of a target (e.g. termination of a pod).", - "properties": { - "name": { - "description": "name allows you to identify the responder responding to the Eviction.\n\nIt must be a valid domain-prefixed key (such as \"acme.io/foo\").\nDomain names *.k8s.io and *.kubernetes.io are reserved.\nThis field must be unique for each responder.\nThis field is required.", - "type": "string" - }, - "priority": { - "description": "priority for this responder. Higher priorities are selected first by the evictionrequest-controller.\nIf there are responders with the same priority, the responder whose domain name comes first in the\nalphabetical higher domain order, will be picked. This means that the top domain labels are compared\nalphabetically first, followed by the lower domain labels. The key is compared last.\n\nThe responder that is the managing controller of the pod should set the value of\nthis field to 10000 to allow both for preemption or fallback registration by other\nresponders.\n\nThe minimum value is 0 and the maximum value is 100000.\nThe interval 0-999 is reserved for responders with *.k8s.io suffix.\nThis field is required.", - "format": "int32", - "type": "integer" - } - }, - "required": [ - "name", - "priority" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "hostAliases": { - "description": "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified.", - "items": { - "description": "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", - "properties": { - "hostnames": { - "description": "Hostnames for the above IP address.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "ip": { - "description": "IP address of the host file entry.", - "type": "string" - } - }, - "required": [ - "ip" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "ip" - ], - "x-kubernetes-list-type": "map" - }, - "hostIPC": { - "description": "Use the host's ipc namespace.\nOptional: Default to false.", - "type": "boolean" - }, - "hostNetwork": { - "description": "Host networking requested for this pod. Use the host's network namespace.\nWhen using HostNetwork you should specify ports so the scheduler is aware.\nWhen `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,\nand unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.\nDefault to false.", - "type": "boolean" - }, - "hostPID": { - "description": "Use the host's pid namespace.\nOptional: Default to false.", - "type": "boolean" - }, - "hostUsers": { - "description": "Use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new userns is created for the pod. Setting false is useful for\nmitigating container breakout vulnerabilities even allowing users to run their\ncontainers as root without actually having root privileges on the host.", - "type": "boolean" - }, - "hostname": { - "description": "Specifies the hostname of the Pod\nIf not specified, the pod's hostname will be set to a system-defined value.", - "type": "string" - }, - "hostnameOverride": { - "description": "HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.\nThis field only specifies the pod's hostname and does not affect its DNS records.\nWhen this field is set to a non-empty string:\n- It takes precedence over the values set in `hostname` and `subdomain`.\n- The Pod's hostname will be set to this value.\n- `setHostnameAsFQDN` must be nil or set to false.\n- `hostNetwork` must be set to false.\n\nThis field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.", - "type": "string" - }, - "imagePullSecrets": { - "description": "ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.\nIf specified, these secrets will be passed to individual puller implementations for them to use.\nMore info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod", - "items": { - "description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "initContainers": { - "description": "List of initialization containers belonging to the pod.\nInit containers are executed in order prior to containers being started. If any\ninit container fails, the pod is considered to have failed and is handled according\nto its restartPolicy. The name for an init container or normal container must be\nunique among all containers.\nInit containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.\nThe resourceRequirements of an init container are taken into account during scheduling\nby finding the highest request/limit for each resource type, and then using the max of\nthat value or the sum of the normal containers. Limits are applied to init containers\nin a similar fashion.\nInit containers cannot currently be added or removed.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/", - "items": { - "description": "A single application container that you want to run within a pod.", - "properties": { - "args": { - "description": "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "command": { - "description": "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "env": { - "description": "List of environment variables to set in the container.\nCannot be updated.", - "items": { - "description": "EnvVar represents an environment variable present in a Container.", - "properties": { - "name": { - "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "value": { - "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", - "type": "string" - }, - "valueFrom": { - "description": "Source for the environment variable's value. Cannot be used if value is not empty.", - "properties": { - "configMapKeyRef": { - "description": "Selects a key of a ConfigMap.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fieldRef": { - "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fileKeyRef": { - "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", - "properties": { - "key": { - "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", - "type": "string" - }, - "optional": { - "default": false, - "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", - "type": "boolean" - }, - "path": { - "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", - "type": "string" - }, - "volumeName": { - "description": "The name of the volume mount containing the env file.", - "type": "string" - } - }, - "required": [ - "key", - "path", - "volumeName" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secretKeyRef": { - "description": "Selects a key of a secret in the pod's namespace", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "envFrom": { - "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", - "items": { - "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", - "properties": { - "configMapRef": { - "description": "The ConfigMap to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "prefix": { - "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "secretRef": { - "description": "The Secret to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "image": { - "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", - "type": "string" - }, - "imagePullPolicy": { - "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", - "type": "string" - }, - "lifecycle": { - "description": "Actions that the management system should take in response to container lifecycle events.\nCannot be updated.", - "properties": { - "postStart": { - "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "preStop": { - "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "stopSignal": { - "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "livenessProbe": { - "description": "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "name": { - "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", - "type": "string" - }, - "ports": { - "description": "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", - "items": { - "description": "ContainerPort represents a network port in a single container.", - "properties": { - "containerPort": { - "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", - "format": "int32", - "type": "integer" - }, - "hostIP": { - "description": "What host IP to bind the external port to.", - "type": "string" - }, - "hostPort": { - "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", - "format": "int32", - "type": "integer" - }, - "name": { - "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", - "type": "string" - }, - "protocol": { - "default": "TCP", - "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", - "type": "string" - } - }, - "required": [ - "containerPort" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "containerPort", - "protocol" - ], - "x-kubernetes-list-type": "map" - }, - "readinessProbe": { - "description": "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "resizePolicy": { - "description": "Resources resize policy for the container.\nThis field cannot be set on ephemeral containers.", - "items": { - "description": "ContainerResizePolicy represents resource resize policy for the container.", - "properties": { - "resourceName": { - "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", - "type": "string" - }, - "restartPolicy": { - "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", - "type": "string" - } - }, - "required": [ - "resourceName", - "restartPolicy" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "resources": { - "description": "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "properties": { - "claims": { - "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", - "items": { - "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", - "properties": { - "name": { - "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - "type": "string" - }, - "request": { - "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "restartPolicy": { - "description": "RestartPolicy defines the restart behavior of individual containers in a pod.\nThis overrides the pod-level restart policy. When this field is not specified,\nthe restart behavior is defined by the Pod's restart policy and the container type.\nAdditionally, setting the RestartPolicy as \"Always\" for the init container will\nhave the following effect:\nthis init container will be continually restarted on\nexit until all regular containers have terminated. Once all regular\ncontainers have completed, all init containers with restartPolicy \"Always\"\nwill be shut down. This lifecycle differs from normal init containers and\nis often referred to as a \"sidecar\" container. Although this init\ncontainer still starts in the init container sequence, it does not wait\nfor the container to complete before proceeding to the next init\ncontainer. Instead, the next init container starts immediately after this\ninit container is started, or after any startupProbe has successfully\ncompleted.", - "type": "string" - }, - "restartPolicyRules": { - "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. The rules are evaluated in\norder. Once a rule matches a container exit condition, the remaining\nrules are ignored. If no rule matches the container exit condition,\nthe Container-level restart policy determines the whether the container\nis restarted or not. Constraints on the rules:\n- At most 20 rules are allowed.\n- Rules can have the same action.\n- Identical rules are not forbidden in validations.\nWhen rules are specified, container MUST set RestartPolicy explicitly\neven it if matches the Pod's RestartPolicy.", - "items": { - "description": "ContainerRestartRule describes how a container exit is handled.", - "properties": { - "action": { - "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", - "type": "string" - }, - "exitCodes": { - "description": "Represents the exit codes to check on container exits.", - "properties": { - "operator": { - "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", - "type": "string" - }, - "values": { - "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", - "items": { - "format": "int32", - "type": "integer" - }, - "type": "array", - "x-kubernetes-list-type": "set" - } - }, - "required": [ - "operator" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "action" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "securityContext": { - "description": "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", - "properties": { - "allowPrivilegeEscalation": { - "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "appArmorProfile": { - "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", - "type": "string" - }, - "type": { - "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "capabilities": { - "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "add": { - "description": "Added capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "drop": { - "description": "Removed capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "privileged": { - "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "procMount": { - "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "readOnlyRootFilesystem": { - "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "runAsGroup": { - "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "runAsNonRoot": { - "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "boolean" - }, - "runAsUser": { - "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "seLinuxOptions": { - "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "level": { - "description": "Level is SELinux level label that applies to the container.", - "type": "string" - }, - "role": { - "description": "Role is a SELinux role label that applies to the container.", - "type": "string" - }, - "type": { - "description": "Type is a SELinux type label that applies to the container.", - "type": "string" - }, - "user": { - "description": "User is a SELinux user label that applies to the container.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "seccompProfile": { - "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - "type": "string" - }, - "type": { - "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "windowsOptions": { - "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", - "properties": { - "gmsaCredentialSpec": { - "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", - "type": "string" - }, - "gmsaCredentialSpecName": { - "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", - "type": "string" - }, - "hostProcess": { - "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", - "type": "boolean" - }, - "runAsUserName": { - "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "startupProbe": { - "description": "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "stdin": { - "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", - "type": "boolean" - }, - "stdinOnce": { - "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", - "type": "boolean" - }, - "terminationMessagePath": { - "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", - "type": "string" - }, - "terminationMessagePolicy": { - "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", - "type": "string" - }, - "tty": { - "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", - "type": "boolean" - }, - "volumeDevices": { - "description": "volumeDevices is the list of block devices to be used by the container.", - "items": { - "description": "volumeDevice describes a mapping of a raw block device within a container.", - "properties": { - "devicePath": { - "description": "devicePath is the path inside of the container that the device will be mapped to.", - "type": "string" - }, - "name": { - "description": "name must match the name of a persistentVolumeClaim in the pod", - "type": "string" - } - }, - "required": [ - "devicePath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "devicePath" - ], - "x-kubernetes-list-type": "map" - }, - "volumeMounts": { - "description": "Pod volumes to mount into the container's filesystem.\nCannot be updated.", - "items": { - "description": "VolumeMount describes a mounting of a Volume within a container.", - "properties": { - "bindMountOptions": { - "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set" - }, - "mountPath": { - "description": "Path within the container at which the volume should be mounted.", - "type": "string" - }, - "mountPropagation": { - "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", - "type": "string" - }, - "name": { - "description": "This must match the Name of a Volume.", - "type": "string" - }, - "readOnly": { - "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", - "type": "boolean" - }, - "recursiveReadOnly": { - "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", - "type": "string" - }, - "subPath": { - "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", - "type": "string" - }, - "subPathExpr": { - "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", - "type": "string" - } - }, - "required": [ - "mountPath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "mountPath" - ], - "x-kubernetes-list-type": "map" - }, - "workingDir": { - "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "nodeName": { - "description": "NodeName indicates in which node this pod is scheduled.\nIf empty, this pod is a candidate for scheduling by the scheduler defined in schedulerName.\nOnce this field is set, the kubelet for this node becomes responsible for the lifecycle of this pod.\nThis field should not be used to express a desire for the pod to be scheduled on a specific node.\nhttps://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodename", - "type": "string" - }, - "nodeSelector": { - "additionalProperties": { - "type": "string" - }, - "description": "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", - "type": "object", - "x-kubernetes-map-type": "atomic" - }, - "os": { - "description": "Specifies the OS of the containers in the pod.\nSome pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset:\n-securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset:\n- spec.hostPID\n- spec.hostIPC\n- spec.hostUsers\n- spec.resources\n- spec.securityContext.appArmorProfile\n- spec.securityContext.seLinuxOptions\n- spec.securityContext.seccompProfile\n- spec.securityContext.fsGroup\n- spec.securityContext.fsGroupChangePolicy\n- spec.securityContext.sysctls\n- spec.shareProcessNamespace\n- spec.securityContext.runAsUser\n- spec.securityContext.runAsGroup\n- spec.securityContext.supplementalGroups\n- spec.securityContext.supplementalGroupsPolicy\n- spec.containers[*].securityContext.appArmorProfile\n- spec.containers[*].securityContext.seLinuxOptions\n- spec.containers[*].securityContext.seccompProfile\n- spec.containers[*].securityContext.capabilities\n- spec.containers[*].securityContext.readOnlyRootFilesystem\n- spec.containers[*].securityContext.privileged\n- spec.containers[*].securityContext.allowPrivilegeEscalation\n- spec.containers[*].securityContext.procMount\n- spec.containers[*].securityContext.runAsUser\n- spec.containers[*].securityContext.runAsGroup", - "properties": { - "name": { - "description": "Name is the name of the operating system. The currently supported values are linux and windows.\nAdditional value may be defined in future and can be one of:\nhttps://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration\nClients should expect to handle additional values and treat unrecognized values in this field as os: null", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "overhead": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Overhead represents the resource overhead associated with running a pod for a given RuntimeClass.\nThis field will be autopopulated at admission time by the RuntimeClass admission controller. If\nthe RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests.\nThe RuntimeClass admission controller will reject Pod create requests which have the overhead already\nset. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value\ndefined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md", - "type": "object" - }, - "preemptionPolicy": { - "description": "PreemptionPolicy is the Policy for preempting pods with lower priority.\nOne of Never, PreemptLowerPriority.\nWhen Priority Admission Controller is enabled, it prevents users from setting\nthis field. The admission controller populates this field from PriorityClassName.\nDefaults to PreemptLowerPriority if unset.", - "type": "string" - }, - "priority": { - "description": "The priority value. Various system components use this field to find the\npriority of the pod. When Priority Admission Controller is enabled, it\nprevents users from setting this field. The admission controller populates\nthis field from PriorityClassName.\nThe higher the value, the higher the priority.", - "format": "int32", - "type": "integer" - }, - "priorityClassName": { - "description": "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", - "type": "string" - }, - "readinessGates": { - "description": "If specified, all readiness gates will be evaluated for pod readiness.\nA pod is ready when all its containers are ready AND\nall conditions specified in the readiness gates have status equal to \"True\"\nMore info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates", - "items": { - "description": "PodReadinessGate contains the reference to a pod condition", - "properties": { - "conditionType": { - "description": "ConditionType refers to a condition in the pod's condition list with matching type.", - "type": "string" - } - }, - "required": [ - "conditionType" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "resourceClaims": { - "description": "ResourceClaims defines which ResourceClaims must be allocated\nand reserved before the Pod is allowed to start. The resources\nwill be made available to those containers which consume them\nby name.\n\nThis is a stable field but requires that the\nDynamicResourceAllocation feature gate is enabled.\n\nThis field is immutable.", - "items": { - "description": "PodResourceClaim references exactly one ResourceClaim, either directly\nor by naming a ResourceClaimTemplate which is then turned into a ResourceClaim\nfor the pod.\n\nIt adds a name to it that uniquely identifies the ResourceClaim inside the Pod.\nContainers that need access to the ResourceClaim reference it with this name.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and this Pod\nbelongs to a PodGroup, a PodResourceClaim is matched to a\nPodGroupResourceClaim if all of their fields are equal (Name,\nResourceClaimName, and ResourceClaimTemplateName). A matched claim references\na single ResourceClaim shared across all Pods in the PodGroup, reserved for\nthe PodGroup in ResourceClaimStatus.ReservedFor rather than for individual\nPods.", - "properties": { - "name": { - "description": "Name uniquely identifies this resource claim inside the pod.\nThis must be a DNS_LABEL.", - "type": "string" - }, - "resourceClaimName": { - "description": "ResourceClaimName is the name of a ResourceClaim object in the same\nnamespace as this pod.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.", - "type": "string" - }, - "resourceClaimTemplateName": { - "description": "ResourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace as this pod.\n\nThe template will be used to create a new ResourceClaim, which will\nbe bound to this pod. When this pod is deleted, the ResourceClaim\nwill also be deleted. The pod name and resource name, along with a\ngenerated component, will be used to form a unique name for the\nResourceClaim, which will be recorded in pod.status.resourceClaimStatuses.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and the pod\nbelongs to a PodGroup that defines a PodGroupResourceClaim with the same\nName and ResourceClaimTemplateName, this PodResourceClaim resolves to the\nResourceClaim generated for the PodGroup. All pods in the group that\ndefine an equivalent PodResourceClaim matching the\nPodGroupResourceClaim's Name and ResourceClaimTemplateName share the same\ngenerated ResourceClaim. ResourceClaims generated for a PodGroup are\nowned by the PodGroup and their lifecycles are tied to the PodGroup\ninstead of any individual pod.\n\nThis field is immutable and no changes will be made to the\ncorresponding ResourceClaim by the control plane after creating the\nResourceClaim.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "resources": { - "description": "Resources is the total amount of CPU and Memory resources required by all\ncontainers in the pod. It supports specifying Requests and Limits for\n\"cpu\", \"memory\" and \"hugepages-\" resource names only. ResourceClaims are not supported.\n\nThis field enables fine-grained control over resource allocation for the\nentire pod, allowing resource sharing among containers in a pod.\n\nThis is an alpha field and requires enabling the PodLevelResources feature\ngate.", - "properties": { - "claims": { - "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", - "items": { - "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", - "properties": { - "name": { - "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - "type": "string" - }, - "request": { - "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "restartPolicy": { - "description": "Restart policy for all containers within the pod.\nOne of Always, OnFailure, Never. In some contexts, only a subset of those values may be permitted.\nDefault to Always.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy", - "type": "string" - }, - "runtimeClassName": { - "description": "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used\nto run this pod. If no RuntimeClass resource matches the named class, the pod will not be run.\nIf unset or empty, the \"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class", - "type": "string" - }, - "schedulerName": { - "description": "If specified, the pod will be dispatched by specified scheduler.\nIf not specified, the pod will be dispatched by default scheduler.", - "type": "string" - }, - "schedulingGates": { - "description": "SchedulingGates is an opaque list of values that if specified will block scheduling the pod.\nIf schedulingGates is not empty, the pod will stay in the SchedulingGated state and the\nscheduler will not attempt to schedule the pod.\n\nSchedulingGates can only be set at pod creation time, and be removed only afterwards.", - "items": { - "description": "PodSchedulingGate is associated to a Pod to guard its scheduling.", - "properties": { - "name": { - "description": "Name of the scheduling gate.\nEach scheduling gate must have a unique name field.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "schedulingGroup": { - "description": "SchedulingGroup provides a reference to the immediate scheduling runtime\ngrouping object that this Pod belongs to.\nThis field is used by the scheduler to identify the group and apply the\ncorrect group scheduling policies. The association with a group also\nimpacts other lifecycle aspects of a Pod that are relevant in a wider context\nof scheduling like preemption, resource attachment, etc. If not specified,\nthe Pod is treated as a single unit in all of these aspects.\nThe group object referenced by this field may not exist at the time the\nPod is created.\nThis field is immutable, but a group object with the same name may be\nrecreated with different policies. Doing this during pod scheduling\nmay result in the placement not conforming to the expected policies.", - "properties": { - "podGroupName": { - "description": "PodGroupName specifies the name of the standalone PodGroup object\nthat represents the runtime instance of this group.\nMust be a DNS subdomain.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "securityContext": { - "description": "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.", - "properties": { - "appArmorProfile": { - "description": "appArmorProfile is the AppArmor options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", - "type": "string" - }, - "type": { - "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "fsGroup": { - "description": "A special supplemental group that applies to all containers in a pod.\nSome volume types allow the Kubelet to change the ownership of that volume\nto be owned by the pod:\n\n1. The owning GID will be the FSGroup\n2. The setgid bit is set (new files created in the volume will be owned by FSGroup)\n3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "fsGroupChangePolicy": { - "description": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume\nbefore being exposed inside Pod. This field will only apply to\nvolume types which support fsGroup based ownership(and permissions).\nIt will have no effect on ephemeral volume types such as: secret, configmaps\nand emptydir.\nValid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "runAsGroup": { - "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "runAsNonRoot": { - "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "boolean" - }, - "runAsUser": { - "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "seLinuxChangePolicy": { - "description": "seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.\nIt has no effect on nodes that do not support SELinux or to volumes does not support SELinux.\nValid values are \"MountOption\" and \"Recursive\".\n\n\"Recursive\" means relabeling of all files on all Pod volumes by the container runtime.\nThis may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.\n\n\"MountOption\" mounts all eligible Pod volumes with `-o context` mount option.\nThis requires all Pods that share the same volume to use the same SELinux label.\nIt is not possible to share the same volume among privileged and unprivileged Pods.\nEligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes\nwhose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their\nCSIDriver instance. Other volumes are always re-labelled recursively.\n\nIf not specified, \"MountOption\" is used.\n\nThis field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.\n\nAll Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "seLinuxOptions": { - "description": "The SELinux context to be applied to all containers.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in SecurityContext. If set in\nboth SecurityContext and PodSecurityContext, the value specified in SecurityContext\ntakes precedence for that container.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "level": { - "description": "Level is SELinux level label that applies to the container.", - "type": "string" - }, - "role": { - "description": "Role is a SELinux role label that applies to the container.", - "type": "string" - }, - "type": { - "description": "Type is a SELinux type label that applies to the container.", - "type": "string" - }, - "user": { - "description": "User is a SELinux user label that applies to the container.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "seccompProfile": { - "description": "The seccomp options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - "type": "string" - }, - "type": { - "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "supplementalGroups": { - "description": "A list of groups applied to the first process run in each container, in\naddition to the container's primary GID and fsGroup (if specified). If\nthe SupplementalGroupsPolicy feature is enabled, the\nsupplementalGroupsPolicy field determines whether these are in addition\nto or instead of any group memberships defined in the container image.\nIf unspecified, no additional groups are added, though group memberships\ndefined in the container image may still be used, depending on the\nsupplementalGroupsPolicy field.\nNote that this field cannot be set when spec.os.name is windows.", - "items": { - "format": "int64", - "type": "integer" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "supplementalGroupsPolicy": { - "description": "Defines how supplemental groups of the first container processes are calculated.\nValid values are \"Merge\" and \"Strict\". If not specified, \"Merge\" is used.\n(Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled\nand the container runtime must implement support for this feature.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "sysctls": { - "description": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", - "items": { - "description": "Sysctl defines a kernel parameter to be set", - "properties": { - "name": { - "description": "Name of a property to set", - "type": "string" - }, - "value": { - "description": "Value of a property to set", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "windowsOptions": { - "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options within a container's SecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", - "properties": { - "gmsaCredentialSpec": { - "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", - "type": "string" - }, - "gmsaCredentialSpecName": { - "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", - "type": "string" - }, - "hostProcess": { - "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", - "type": "boolean" - }, - "runAsUserName": { - "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "serviceAccount": { - "description": "DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.\nDeprecated: Use serviceAccountName instead.", - "type": "string" - }, - "serviceAccountName": { - "description": "ServiceAccountName is the name of the ServiceAccount to use to run this pod.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/", - "type": "string" - }, - "setHostnameAsFQDN": { - "description": "If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default).\nIn Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname).\nIn Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters to FQDN.\nIf a pod does not have FQDN, this has no effect.\nDefault to false.", - "type": "boolean" - }, - "shareProcessNamespace": { - "description": "Share a single process namespace between all of the containers in a pod.\nWhen this is set containers will be able to view and signal processes from other containers\nin the same pod, and the first process in each container will not be assigned PID 1.\nHostPID and ShareProcessNamespace cannot both be set.\nOptional: Default to false.", - "type": "boolean" - }, - "subdomain": { - "description": "If specified, the fully qualified Pod hostname will be \"...svc.\".\nIf not specified, the pod will not have a domainname at all.", - "type": "string" - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nIf this value is nil, the default grace period will be used instead.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nDefaults to 30 seconds.", - "format": "int64", - "type": "integer" - }, - "tolerations": { - "description": "If specified, the pod's tolerations.", - "items": { - "description": "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", - "properties": { - "effect": { - "description": "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", - "type": "string" - }, - "key": { - "description": "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", - "type": "string" - }, - "operator": { - "description": "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", - "type": "string" - }, - "tolerationSeconds": { - "description": "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", - "format": "int64", - "type": "integer" - }, - "value": { - "description": "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologySpreadConstraints": { - "description": "TopologySpreadConstraints describes how a group of pods ought to spread across topology\ndomains. Scheduler will schedule pods in a way which abides by the constraints.\nAll topologySpreadConstraints are ANDed.", - "items": { - "description": "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", - "properties": { - "labelSelector": { - "description": "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "maxSkew": { - "description": "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", - "format": "int32", - "type": "integer" - }, - "minDomains": { - "description": "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", - "format": "int32", - "type": "integer" - }, - "nodeAffinityPolicy": { - "description": "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", - "type": "string" - }, - "nodeTaintsPolicy": { - "description": "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", - "type": "string" - }, - "topologyKey": { - "description": "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", - "type": "string" - }, - "whenUnsatisfiable": { - "description": "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", - "type": "string" - } - }, - "required": [ - "maxSkew", - "topologyKey", - "whenUnsatisfiable" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "topologyKey", - "whenUnsatisfiable" - ], - "x-kubernetes-list-type": "map" - }, - "volumes": { - "description": "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes", - "items": { - "description": "Volume represents a named volume in a pod that may be accessed by any container in the pod.", - "properties": { - "awsElasticBlockStore": { - "description": "awsElasticBlockStore represents an AWS Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nDeprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree\nawsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", - "properties": { - "fsType": { - "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", - "type": "string" - }, - "partition": { - "description": "partition is the partition in the volume that you want to mount.\nIf omitted, the default is to mount by volume name.\nExamples: For volume /dev/sda1, you specify the partition as \"1\".\nSimilarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).", - "format": "int32", - "type": "integer" - }, - "readOnly": { - "description": "readOnly value true will force the readOnly setting in VolumeMounts.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", - "type": "boolean" - }, - "volumeID": { - "description": "volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume).\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", - "type": "string" - } - }, - "required": [ - "volumeID" - ], - "type": "object", - "additionalProperties": false - }, - "azureDisk": { - "description": "azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.\nDeprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type\nare redirected to the disk.csi.azure.com CSI driver.", - "properties": { - "cachingMode": { - "description": "cachingMode is the Host Caching mode: None, Read Only, Read Write.", - "type": "string" - }, - "diskName": { - "description": "diskName is the Name of the data disk in the blob storage", - "type": "string" - }, - "diskURI": { - "description": "diskURI is the URI of data disk in the blob storage", - "type": "string" - }, - "fsType": { - "default": "ext4", - "description": "fsType is Filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "kind": { - "description": "kind expected values are Shared: multiple blob disks per storage account Dedicated: single blob disk per storage account Managed: azure managed data disk (only in managed availability set). defaults to shared", - "type": "string" - }, - "readOnly": { - "default": false, - "description": "readOnly Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - } - }, - "required": [ - "diskName", - "diskURI" - ], - "type": "object", - "additionalProperties": false - }, - "azureFile": { - "description": "azureFile represents an Azure File Service mount on the host and bind mount to the pod.\nDeprecated: AzureFile is deprecated. All operations for the in-tree azureFile type\nare redirected to the file.csi.azure.com CSI driver.", - "properties": { - "readOnly": { - "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "secretName": { - "description": "secretName is the name of secret that contains Azure Storage Account Name and Key", - "type": "string" - }, - "shareName": { - "description": "shareName is the azure share Name", - "type": "string" - } - }, - "required": [ - "secretName", - "shareName" - ], - "type": "object", - "additionalProperties": false - }, - "cephfs": { - "description": "cephFS represents a Ceph FS mount on the host that shares a pod's lifetime.\nDeprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported.", - "properties": { - "monitors": { - "description": "monitors is Required: Monitors is a collection of Ceph monitors\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "path is Optional: Used as the mounted root, rather than the full Ceph tree, default is /", - "type": "string" - }, - "readOnly": { - "description": "readOnly is Optional: Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "type": "boolean" - }, - "secretFile": { - "description": "secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "type": "string" - }, - "secretRef": { - "description": "secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty.\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "user": { - "description": "user is optional: User is the rados user name, default is admin\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "type": "string" - } - }, - "required": [ - "monitors" - ], - "type": "object", - "additionalProperties": false - }, - "cinder": { - "description": "cinder represents a cinder volume attached and mounted on kubelets host machine.\nDeprecated: Cinder is deprecated. All operations for the in-tree cinder type\nare redirected to the cinder.csi.openstack.org CSI driver.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", - "properties": { - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", - "type": "string" - }, - "readOnly": { - "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef is optional: points to a secret object containing parameters used to connect\nto OpenStack.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "volumeID": { - "description": "volumeID used to identify the volume in cinder.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", - "type": "string" - } - }, - "required": [ - "volumeID" - ], - "type": "object", - "additionalProperties": false - }, - "configMap": { - "description": "configMap represents a configMap that should populate this volume", - "properties": { - "defaultMode": { - "description": "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "defaultUser": { - "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "items": { - "description": "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", - "items": { - "description": "Maps a string key to a path within a volume.", - "properties": { - "key": { - "description": "key is the key to project.", - "type": "string" - }, - "mode": { - "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "key", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "optional specify whether the ConfigMap or its keys must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "csi": { - "description": "csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.", - "properties": { - "driver": { - "description": "driver is the name of the CSI driver that handles this volume.\nConsult with your admin for the correct name as registered in the cluster.", - "type": "string" - }, - "fsType": { - "description": "fsType to mount. Ex. \"ext4\", \"xfs\", \"ntfs\".\nIf not provided, the empty value is passed to the associated CSI driver\nwhich will determine the default filesystem to apply.", - "type": "string" - }, - "nodePublishSecretRef": { - "description": "nodePublishSecretRef is a reference to the secret object containing\nsensitive information to pass to the CSI driver to complete the CSI\nNodePublishVolume and NodeUnpublishVolume calls.\nThis field is optional, and may be empty if no secret is required. If the\nsecret object contains more than one secret, all secret references are passed.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "readOnly": { - "description": "readOnly specifies a read-only configuration for the volume.\nDefaults to false (read/write).", - "type": "boolean" - }, - "volumeAttributes": { - "additionalProperties": { - "type": "string" - }, - "description": "volumeAttributes stores driver-specific properties that are passed to the CSI\ndriver. Consult your driver's documentation for supported values.", - "type": "object" - } - }, - "required": [ - "driver" - ], - "type": "object", - "additionalProperties": false - }, - "downwardAPI": { - "description": "downwardAPI represents downward API about the pod that should populate this volume", - "properties": { - "defaultMode": { - "description": "Optional: mode bits to use on created files by default. Must be a\nOptional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "defaultUser": { - "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "items": { - "description": "Items is a list of downward API volume file", - "items": { - "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field", - "properties": { - "fieldRef": { - "description": "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "mode": { - "description": "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", - "type": "string" - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "emptyDir": { - "description": "emptyDir represents a temporary directory that shares a pod's lifetime.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", - "properties": { - "medium": { - "description": "medium represents what type of storage medium should back this directory.\nThe default is \"\" which means to use the node's default medium.\nMust be an empty string (default) or Memory.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", - "type": "string" - }, - "mode": { - "description": "mode specifies the permission bits for the emptyDir directory, in numeric\nnotation (e.g., 0755, 01777). Must be a value between 0000 and 01777.\nIf not specified, defaults to 0777.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup. If fsGroup is specified, the fsGroup permissions\nwill override the mode specified here.\nThis field has no effect on Windows.\nThis field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.", - "format": "int32", - "type": "integer" - }, - "sizeLimit": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "sizeLimit is the total amount of local storage required for this EmptyDir volume.\nThe size limit is also applicable for memory medium.\nThe maximum usage on memory medium EmptyDir would be the minimum value between\nthe SizeLimit specified here and the sum of memory limits of all containers in a pod.\nThe default is nil which means that the limit is undefined.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "type": "object", - "additionalProperties": false - }, - "ephemeral": { - "description": "ephemeral represents a volume that is handled by a cluster storage driver.\nThe volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,\nand deleted when the pod is removed.\n\nUse this if:\na) the volume is only needed while the pod runs,\nb) features of normal volumes like restoring from snapshot or capacity\n tracking are needed,\nc) the storage driver is specified through a storage class, and\nd) the storage driver supports dynamic volume provisioning through\n a PersistentVolumeClaim (see EphemeralVolumeSource for more\n information on the connection between this volume type\n and PersistentVolumeClaim).\n\nUse PersistentVolumeClaim or one of the vendor-specific\nAPIs for volumes that persist for longer than the lifecycle\nof an individual pod.\n\nUse CSI for light-weight local ephemeral volumes if the CSI driver is meant to\nbe used that way - see the documentation of the driver for\nmore information.\n\nA pod can use both types of ephemeral volumes and\npersistent volumes at the same time.", - "properties": { - "volumeClaimTemplate": { - "description": "Will be used to create a stand-alone PVC to provision the volume.\nThe pod in which this EphemeralVolumeSource is embedded will be the\nowner of the PVC, i.e. the PVC will be deleted together with the\npod. The name of the PVC will be `-` where\n`` is the name from the `PodSpec.Volumes` array\nentry. Pod validation will reject the pod if the concatenated name\nis not valid for a PVC (for example, too long).\n\nAn existing PVC with that name that is not owned by the pod\nwill *not* be used for the pod to avoid using an unrelated\nvolume by mistake. Starting the pod is then blocked until\nthe unrelated PVC is removed. If such a pre-created PVC is\nmeant to be used by the pod, the PVC has to updated with an\nowner reference to the pod once the pod exists. Normally\nthis should not be necessary, but it may be useful when\nmanually reconstructing a broken cluster.\n\nThis field is read-only and no changes will be made by Kubernetes\nto the PVC after it has been created.\n\nRequired, must not be nil.", - "properties": { - "metadata": { - "description": "May contain labels and annotations that will be copied into the PVC\nwhen creating it. No other fields are allowed and will be rejected during\nvalidation.", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "finalizers": { - "items": { - "type": "string" - }, - "type": "array" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "name": { - "type": "string" - }, - "namespace": { - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "spec": { - "description": "The specification for the PersistentVolumeClaim. The entire content is\ncopied unchanged into the PVC that gets created from this\ntemplate. The same fields as in a PersistentVolumeClaim\nare also valid here.", - "properties": { - "accessModes": { - "description": "accessModes contains the desired access modes the volume should have.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "dataSource": { - "description": "dataSource field can be used to specify either:\n* An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)\n* An existing PVC (PersistentVolumeClaim)\nIf the provisioner or an external controller can support the specified data source,\nit will create a new volume based on the contents of the specified data source.\ndataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be\ncopied to dataSource when dataSourceRef.namespace is not specified.\nIf the namespace is specified, then dataSourceRef will not be copied to dataSource.", - "properties": { - "apiGroup": { - "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", - "type": "string" - }, - "kind": { - "description": "Kind is the type of resource being referenced", - "type": "string" - }, - "name": { - "description": "Name is the name of resource being referenced", - "type": "string" - } - }, - "required": [ - "kind", - "name" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "dataSourceRef": { - "description": "dataSourceRef specifies the object from which to populate the volume with data, if a non-empty\nvolume is desired. This may be any object from a non-empty API group (non\ncore object) or a PersistentVolumeClaim object.\nWhen this field is specified, volume binding will only succeed if the type of\nthe specified object matches some installed volume populator or dynamic\nprovisioner.\nThis field will replace the functionality of the dataSource field and as such\nif both fields are non-empty, they must have the same value. For backwards\ncompatibility, when namespace isn't specified in dataSourceRef,\nboth fields (dataSource and dataSourceRef) will be set to the same\nvalue automatically if one of them is empty and the other is non-empty.\nWhen namespace is specified in dataSourceRef,\ndataSource isn't set to the same value and must be empty.\nThere are three important differences between dataSource and dataSourceRef:\n* While dataSource only allows two specific types of objects, dataSourceRef\n allows any non-core object, as well as PersistentVolumeClaim objects.\n* While dataSource ignores disallowed values (dropping them), dataSourceRef\n preserves all values, and generates an error if a disallowed value is\n specified.\n* While dataSource only allows local objects, dataSourceRef allows objects\n in any namespaces.\n(Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", - "properties": { - "apiGroup": { - "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", - "type": "string" - }, - "kind": { - "description": "Kind is the type of resource being referenced", - "type": "string" - }, - "name": { - "description": "Name is the name of resource being referenced", - "type": "string" - }, - "namespace": { - "description": "Namespace is the namespace of resource being referenced\nNote that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n(Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", - "type": "string" - } - }, - "required": [ - "kind", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "resources": { - "description": "resources represents the minimum resources the volume should have.\nUsers are allowed to specify resource requirements\nthat are lower than previous value but must still be higher than capacity recorded in the\nstatus field of the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources", - "properties": { - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "selector": { - "description": "selector is a label query over volumes to consider for binding.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "storageClassName": { - "description": "storageClassName is the name of the StorageClass required by the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1", - "type": "string" - }, - "volumeAttributesClassName": { - "description": "volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.\nIf specified, the CSI driver will create or update the volume with the attributes defined\nin the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,\nit can be changed after the claim is created. An empty string or nil value indicates that no\nVolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,\nthis field can be reset to its previous value (including nil) to cancel the modification.\nIf the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be\nset to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource\nexists.\nMore info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/", - "type": "string" - }, - "volumeMode": { - "description": "volumeMode defines what type of volume is required by the claim.\nValue of Filesystem is implied when not included in claim spec.", - "type": "string" - }, - "volumeName": { - "description": "volumeName is the binding reference to the PersistentVolume backing this claim.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "spec" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "fc": { - "description": "fc represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.", - "properties": { - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "lun": { - "description": "lun is Optional: FC target lun number", - "format": "int32", - "type": "integer" - }, - "readOnly": { - "description": "readOnly is Optional: Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "targetWWNs": { - "description": "targetWWNs is Optional: FC target worldwide names (WWNs)", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "wwids": { - "description": "wwids Optional: FC volume world wide identifiers (wwids)\nEither wwids or combination of targetWWNs and lun must be set, but not both simultaneously.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "flexVolume": { - "description": "flexVolume represents a generic volume resource that is\nprovisioned/attached using an exec based plugin.\nDeprecated: FlexVolume is deprecated. Consider using a CSIDriver instead.", - "properties": { - "driver": { - "description": "driver is the name of the driver to use for this volume.", - "type": "string" - }, - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". The default filesystem depends on FlexVolume script.", - "type": "string" - }, - "options": { - "additionalProperties": { - "type": "string" - }, - "description": "options is Optional: this field holds extra command options if any.", - "type": "object" - }, - "readOnly": { - "description": "readOnly is Optional: defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef is Optional: secretRef is reference to the secret object containing\nsensitive information to pass to the plugin scripts. This may be\nempty if no secret object is specified. If the secret object\ncontains more than one secret, all secrets are passed to the plugin\nscripts.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "required": [ - "driver" - ], - "type": "object", - "additionalProperties": false - }, - "flocker": { - "description": "flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running.\nDeprecated: Flocker is deprecated and the in-tree flocker type is no longer supported.", - "properties": { - "datasetName": { - "description": "datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker\nshould be considered as deprecated", - "type": "string" - }, - "datasetUUID": { - "description": "datasetUUID is the UUID of the dataset. This is unique identifier of a Flocker dataset", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "gcePersistentDisk": { - "description": "gcePersistentDisk represents a GCE Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nDeprecated: GCEPersistentDisk is deprecated. All operations for the in-tree\ngcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "properties": { - "fsType": { - "description": "fsType is filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "type": "string" - }, - "partition": { - "description": "partition is the partition in the volume that you want to mount.\nIf omitted, the default is to mount by volume name.\nExamples: For volume /dev/sda1, you specify the partition as \"1\".\nSimilarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "format": "int32", - "type": "integer" - }, - "pdName": { - "description": "pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "type": "boolean" - } - }, - "required": [ - "pdName" - ], - "type": "object", - "additionalProperties": false - }, - "gitRepo": { - "description": "gitRepo represents a git repository at a particular revision.\nDeprecated: GitRepo is deprecated. To provision a container with a git repo, mount an\nEmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir\ninto the Pod's container.", - "properties": { - "directory": { - "description": "directory is the target directory name.\nMust not contain or start with '..'. If '.' is supplied, the volume directory will be the\ngit repository. Otherwise, if specified, the volume will contain the git repository in\nthe subdirectory with the given name.", - "type": "string" - }, - "repository": { - "description": "repository is the URL", - "type": "string" - }, - "revision": { - "description": "revision is the commit hash for the specified revision.", - "type": "string" - } - }, - "required": [ - "repository" - ], - "type": "object", - "additionalProperties": false - }, - "glusterfs": { - "description": "glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.\nDeprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.", - "properties": { - "endpoints": { - "description": "endpoints is the endpoint name that details Glusterfs topology.", - "type": "string" - }, - "path": { - "description": "path is the Glusterfs volume path.\nMore info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the Glusterfs volume to be mounted with read-only permissions.\nDefaults to false.\nMore info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod", - "type": "boolean" - } - }, - "required": [ - "endpoints", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "hostPath": { - "description": "hostPath represents a pre-existing file or directory on the host\nmachine that is directly exposed to the container. This is generally\nused for system agents or other privileged things that are allowed\nto see the host machine. Most containers will NOT need this.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", - "properties": { - "path": { - "description": "path of the directory on the host.\nIf the path is a symlink, it will follow the link to the real path.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", - "type": "string" - }, - "type": { - "description": "type for HostPath Volume\nDefaults to \"\"\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", - "type": "string" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - }, - "image": { - "description": "image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.\nThe volume is resolved at pod startup depending on which PullPolicy value is provided:\n\n- Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\n- Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\n- IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\n\nThe volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.\nA failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.\nThe types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.\nThe OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.\nThe volume will be mounted read-only (ro).\nSub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.\nThe field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.", - "properties": { - "pullPolicy": { - "description": "Policy for pulling OCI objects. Possible values are:\nAlways: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\nNever: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\nIfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.", - "type": "string" - }, - "reference": { - "description": "Required: Image or artifact reference to be used.\nBehaves in the same way as pod.spec.containers[*].image.\nPull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "iscsi": { - "description": "iscsi represents an ISCSI Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi", - "properties": { - "chapAuthDiscovery": { - "description": "chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication", - "type": "boolean" - }, - "chapAuthSession": { - "description": "chapAuthSession defines whether support iSCSI Session CHAP authentication", - "type": "boolean" - }, - "fsType": { - "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi", - "type": "string" - }, - "initiatorName": { - "description": "initiatorName is the custom iSCSI Initiator Name.\nIf initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface\n: will be created for the connection.", - "type": "string" - }, - "iqn": { - "description": "iqn is the target iSCSI Qualified Name.", - "type": "string" - }, - "iscsiInterface": { - "default": "default", - "description": "iscsiInterface is the interface Name that uses an iSCSI transport.\nDefaults to 'default' (tcp).", - "type": "string" - }, - "lun": { - "description": "lun represents iSCSI Target Lun number.", - "format": "int32", - "type": "integer" - }, - "portals": { - "description": "portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port\nis other than default (typically TCP ports 860 and 3260).", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "readOnly": { - "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef is the CHAP Secret for iSCSI target and initiator authentication", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "targetPortal": { - "description": "targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port\nis other than default (typically TCP ports 860 and 3260).", - "type": "string" - } - }, - "required": [ - "iqn", - "lun", - "targetPortal" - ], - "type": "object", - "additionalProperties": false - }, - "name": { - "description": "name of the volume.\nMust be a DNS_LABEL and unique within the pod.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "nfs": { - "description": "nfs represents an NFS mount on the host that shares a pod's lifetime\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", - "properties": { - "path": { - "description": "path that is exported by the NFS server.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the NFS export to be mounted with read-only permissions.\nDefaults to false.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", - "type": "boolean" - }, - "server": { - "description": "server is the hostname or IP address of the NFS server.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", - "type": "string" - } - }, - "required": [ - "path", - "server" - ], - "type": "object", - "additionalProperties": false - }, - "persistentVolumeClaim": { - "description": "persistentVolumeClaimVolumeSource represents a reference to a\nPersistentVolumeClaim in the same namespace.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", - "properties": { - "claimName": { - "description": "claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", - "type": "string" - }, - "readOnly": { - "description": "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.", - "type": "boolean" - } - }, - "required": [ - "claimName" - ], - "type": "object", - "additionalProperties": false - }, - "photonPersistentDisk": { - "description": "photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine.\nDeprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported.", - "properties": { - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "pdID": { - "description": "pdID is the ID that identifies Photon Controller persistent disk", - "type": "string" - } - }, - "required": [ - "pdID" - ], - "type": "object", - "additionalProperties": false - }, - "portworxVolume": { - "description": "portworxVolume represents a portworx volume attached and mounted on kubelets host machine.\nDeprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type\nare redirected to the pxd.portworx.com CSI driver.", - "properties": { - "fsType": { - "description": "fSType represents the filesystem type to mount\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "readOnly": { - "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "volumeID": { - "description": "volumeID uniquely identifies a Portworx volume", - "type": "string" - } - }, - "required": [ - "volumeID" - ], - "type": "object", - "additionalProperties": false - }, - "projected": { - "description": "projected items for all in one resources secrets, configmaps, and downward API", - "properties": { - "defaultMode": { - "description": "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "defaultUser": { - "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "sources": { - "description": "sources is the list of volume projections. Each entry in this list\nhandles one source.", - "items": { - "description": "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", - "properties": { - "clusterTrustBundle": { - "description": "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field\nof ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the\ncombination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written\ninto the pod filesystem. Esoteric PEM features such as inter-block\ncomments and block headers are stripped. Certificates are deduplicated.\nThe ordering of certificates within the file is arbitrary, and Kubelet\nmay change the order over time.", - "properties": { - "labelSelector": { - "description": "Select all ClusterTrustBundles that match this label selector. Only has\neffect if signerName is set. Mutually-exclusive with name. If unset,\ninterpreted as \"match nothing\". If set but empty, interpreted as \"match\neverything\".", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "name": { - "description": "Select a single ClusterTrustBundle by object name. Mutually-exclusive\nwith signerName and labelSelector.", - "type": "string" - }, - "optional": { - "description": "If true, don't block pod startup if the referenced ClusterTrustBundle(s)\naren't available. If using name, then the named ClusterTrustBundle is\nallowed not to exist. If using signerName, then the combination of\nsignerName and labelSelector is allowed to match zero\nClusterTrustBundles.", - "type": "boolean" - }, - "path": { - "description": "Relative path from the volume root to write the bundle.", - "type": "string" - }, - "signerName": { - "description": "Select all ClusterTrustBundles that match this signer name.\nMutually-exclusive with name. The contents of all selected\nClusterTrustBundles will be unified and deduplicated.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - }, - "configMap": { - "description": "configMap information about the configMap data to project", - "properties": { - "items": { - "description": "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", - "items": { - "description": "Maps a string key to a path within a volume.", - "properties": { - "key": { - "description": "key is the key to project.", - "type": "string" - }, - "mode": { - "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "key", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "optional specify whether the ConfigMap or its keys must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "downwardAPI": { - "description": "downwardAPI information about the downwardAPI data to project", - "properties": { - "items": { - "description": "Items is a list of DownwardAPIVolume file", - "items": { - "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field", - "properties": { - "fieldRef": { - "description": "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "mode": { - "description": "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", - "type": "string" - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "podCertificate": { - "description": "Projects an auto-rotating credential bundle (private key and certificate\nchain) that the pod can use either as a TLS client or server.\n\nKubelet generates a private key and uses it to send a\nPodCertificateRequest to the named signer. Once the signer approves the\nrequest and issues a certificate chain, Kubelet writes the key and\ncertificate chain to the pod filesystem. The pod does not start until\ncertificates have been issued for each podCertificate projected volume\nsource in its spec.\n\nKubelet will begin trying to rotate the certificate at the time indicated\nby the signer using the PodCertificateRequest.Status.BeginRefreshAt\ntimestamp.\n\nKubelet can write a single file, indicated by the credentialBundlePath\nfield, or separate files, indicated by the keyPath and\ncertificateChainPath fields.\n\nThe credential bundle is a single file in PEM format. The first PEM\nentry is the private key (in PKCS#8 format), and the remaining PEM\nentries are the certificate chain issued by the signer (typically,\nsigners will return their certificate chain in leaf-to-root order).\n\nPrefer using the credential bundle format, since your application code\ncan read it atomically. If you use keyPath and certificateChainPath,\nyour application must make two separate file reads. If these coincide\nwith a certificate rotation, it is possible that the private key and leaf\ncertificate you read may not correspond to each other. Your application\nwill need to check for this condition, and re-read until they are\nconsistent.\n\nThe named signer controls chooses the format of the certificate it\nissues; consult the signer implementation's documentation to learn how to\nuse the certificates it issues.", - "properties": { - "certificateChainPath": { - "description": "Write the certificate chain at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", - "type": "string" - }, - "credentialBundlePath": { - "description": "Write the credential bundle at this path in the projected volume.\n\nThe credential bundle is a single file that contains multiple PEM blocks.\nThe first PEM block is a PRIVATE KEY block, containing a PKCS#8 private\nkey.\n\nThe remaining blocks are CERTIFICATE blocks, containing the issued\ncertificate chain from the signer (leaf and any intermediates).\n\nUsing credentialBundlePath lets your Pod's application code make a single\natomic read that retrieves a consistent key and certificate chain. If you\nproject them to separate files, your application code will need to\nadditionally check that the leaf certificate was issued to the key.", - "type": "string" - }, - "keyPath": { - "description": "Write the key at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", - "type": "string" - }, - "keyType": { - "description": "The type of keypair Kubelet will generate for the pod.\n\nValid values are \"RSA3072\", \"RSA4096\", \"ECDSAP256\", \"ECDSAP384\",\n\"ECDSAP521\", and \"ED25519\".", - "type": "string" - }, - "maxExpirationSeconds": { - "description": "maxExpirationSeconds is the maximum lifetime permitted for the\ncertificate.\n\nKubelet copies this value verbatim into the PodCertificateRequests it\ngenerates for this projection.\n\nIf omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver\nwill reject values shorter than 3600 (1 hour). The maximum allowable\nvalue is 7862400 (91 days).\n\nThe signer implementation is then free to issue a certificate with any\nlifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600\nseconds (1 hour). This constraint is enforced by kube-apiserver.\n`kubernetes.io` signers will never issue certificates with a lifetime\nlonger than 24 hours.", - "format": "int32", - "type": "integer" - }, - "signerName": { - "description": "Kubelet's generated CSRs will be addressed to this signer.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "userAnnotations": { - "additionalProperties": { - "type": "string" - }, - "description": "userAnnotations allow pod authors to pass additional information to\nthe signer implementation. Kubernetes does not restrict or validate this\nmetadata in any way.\n\nThese values are copied verbatim into the `spec.unverifiedUserAnnotations` field of\nthe PodCertificateRequest objects that Kubelet creates.\n\nEntries are subject to the same validation as object metadata annotations,\nwith the addition that all keys must be domain-prefixed. No restrictions\nare placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support. Signers should\ndeny requests that contain keys they do not recognize.", - "type": "object" - } - }, - "required": [ - "keyType", - "signerName" - ], - "type": "object", - "additionalProperties": false - }, - "secret": { - "description": "secret information about the secret data to project", - "properties": { - "items": { - "description": "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", - "items": { - "description": "Maps a string key to a path within a volume.", - "properties": { - "key": { - "description": "key is the key to project.", - "type": "string" - }, - "mode": { - "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "key", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "optional field specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "serviceAccountToken": { - "description": "serviceAccountToken is information about the serviceAccountToken data to project", - "properties": { - "audience": { - "description": "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", - "type": "string" - }, - "expirationSeconds": { - "description": "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", - "format": "int64", - "type": "integer" - }, - "path": { - "description": "path is the path relative to the mount point of the file to project the\ntoken into.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "quobyte": { - "description": "quobyte represents a Quobyte mount on the host that shares a pod's lifetime.\nDeprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported.", - "properties": { - "group": { - "description": "group to map volume access to\nDefault is no group", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the Quobyte volume to be mounted with read-only permissions.\nDefaults to false.", - "type": "boolean" - }, - "registry": { - "description": "registry represents a single or multiple Quobyte Registry services\nspecified as a string as host:port pair (multiple entries are separated with commas)\nwhich acts as the central registry for volumes", - "type": "string" - }, - "tenant": { - "description": "tenant owning the given Quobyte volume in the Backend\nUsed with dynamically provisioned Quobyte volumes, value is set by the plugin", - "type": "string" - }, - "user": { - "description": "user to map volume access to\nDefaults to serivceaccount user", - "type": "string" - }, - "volume": { - "description": "volume is a string that references an already created Quobyte volume by name.", - "type": "string" - } - }, - "required": [ - "registry", - "volume" - ], - "type": "object", - "additionalProperties": false - }, - "rbd": { - "description": "rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.\nDeprecated: RBD is deprecated and the in-tree rbd type is no longer supported.", - "properties": { - "fsType": { - "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#rbd", - "type": "string" - }, - "image": { - "description": "image is the rados image name.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "string" - }, - "keyring": { - "default": "/etc/ceph/keyring", - "description": "keyring is the path to key ring for RBDUser.\nDefault is /etc/ceph/keyring.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "string" - }, - "monitors": { - "description": "monitors is a collection of Ceph monitors.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "pool": { - "default": "rbd", - "description": "pool is the rados pool name.\nDefault is rbd.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef is name of the authentication secret for RBDUser. If provided\noverrides keyring.\nDefault is nil.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "user": { - "default": "admin", - "description": "user is the rados user name.\nDefault is admin.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "string" - } - }, - "required": [ - "image", - "monitors" - ], - "type": "object", - "additionalProperties": false - }, - "scaleIO": { - "description": "scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.\nDeprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported.", - "properties": { - "fsType": { - "default": "xfs", - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\".\nDefault is \"xfs\".", - "type": "string" - }, - "gateway": { - "description": "gateway is the host address of the ScaleIO API Gateway.", - "type": "string" - }, - "protectionDomain": { - "description": "protectionDomain is the name of the ScaleIO Protection Domain for the configured storage.", - "type": "string" - }, - "readOnly": { - "description": "readOnly Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef references to the secret for ScaleIO user and other\nsensitive information. If this is not provided, Login operation will fail.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "sslEnabled": { - "description": "sslEnabled Flag enable/disable SSL communication with Gateway, default false", - "type": "boolean" - }, - "storageMode": { - "default": "ThinProvisioned", - "description": "storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.\nDefault is ThinProvisioned.", - "type": "string" - }, - "storagePool": { - "description": "storagePool is the ScaleIO Storage Pool associated with the protection domain.", - "type": "string" - }, - "system": { - "description": "system is the name of the storage system as configured in ScaleIO.", - "type": "string" - }, - "volumeName": { - "description": "volumeName is the name of a volume already created in the ScaleIO system\nthat is associated with this volume source.", - "type": "string" - } - }, - "required": [ - "gateway", - "secretRef", - "system" - ], - "type": "object", - "additionalProperties": false - }, - "secret": { - "description": "secret represents a secret that should populate this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", - "properties": { - "defaultMode": { - "description": "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "defaultUser": { - "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "items": { - "description": "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", - "items": { - "description": "Maps a string key to a path within a volume.", - "properties": { - "key": { - "description": "key is the key to project.", - "type": "string" - }, - "mode": { - "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "key", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "optional": { - "description": "optional field specify whether the Secret or its keys must be defined", - "type": "boolean" - }, - "secretName": { - "description": "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "storageos": { - "description": "storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.\nDeprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported.", - "properties": { - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "readOnly": { - "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef specifies the secret to use for obtaining the StorageOS API\ncredentials. If not specified, default values will be attempted.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "volumeName": { - "description": "volumeName is the human-readable name of the StorageOS volume. Volume\nnames are only unique within a namespace.", - "type": "string" - }, - "volumeNamespace": { - "description": "volumeNamespace specifies the scope of the volume within StorageOS. If no\nnamespace is specified then the Pod's namespace will be used. This allows the\nKubernetes name scoping to be mirrored within StorageOS for tighter integration.\nSet VolumeName to any name to override the default behaviour.\nSet to \"default\" if you are not using namespaces within StorageOS.\nNamespaces that do not pre-exist within StorageOS will be created.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "vsphereVolume": { - "description": "vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine.\nDeprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type\nare redirected to the csi.vsphere.vmware.com CSI driver.", - "properties": { - "fsType": { - "description": "fsType is filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "storagePolicyID": { - "description": "storagePolicyID is the storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName.", - "type": "string" - }, - "storagePolicyName": { - "description": "storagePolicyName is the storage Policy Based Management (SPBM) profile name.", - "type": "string" - }, - "volumePath": { - "description": "volumePath is the path that identifies vSphere volume vmdk", - "type": "string" - } - }, - "required": [ - "volumePath" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - } - }, - "required": [ - "containers" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "maxGroupRestarts": { - "description": "maxGroupRestarts bounds how many times the controller can recreate a group\nunder RecreateGroupOnPodRestart or RecreateGroupAfterStart. Once exhausted,\nthe controller terminates the group, retains Pod API objects that can still\nreceive finalizers, and stops automatic group recreation. Setting\nleaderworkerset.sigs.k8s.io/recover=true on the retained leader Pod resets\nthat revision/group's budget and allows recovery. Changing this value does\nnot resume an exhausted group. It is opt-in: when unset (nil), group\nrecreation is unlimited.\nBudget exhaustion handling requires Kubernetes 1.27 or later because it\nrelies on deleted Pods reaching a terminal phase while finalizers retain\ntheir API objects.", - "format": "int32", - "minimum": 0, - "type": "integer" - }, - "persistentVolumeClaimRetentionPolicy": { - "description": "persistentVolumeClaimRetentionPolicy describes the policy used for PVCs created from\nthe VolumeClaimTemplates.", - "properties": { - "whenDeleted": { - "description": "WhenDeleted specifies what happens to PVCs created from StatefulSet\nVolumeClaimTemplates when the StatefulSet is deleted. The default policy\nof `Retain` causes PVCs to not be affected by StatefulSet deletion. The\n`Delete` policy causes those PVCs to be deleted.", - "type": "string" - }, - "whenScaled": { - "description": "WhenScaled specifies what happens to PVCs created from StatefulSet\nVolumeClaimTemplates when the StatefulSet is scaled down. The default\npolicy of `Retain` causes PVCs to not be affected by a scaledown. The\n`Delete` policy causes the associated PVCs for any excess pods above\nthe replica count to be deleted.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "restartPolicy": { - "default": "RecreateGroupOnPodRestart", - "description": "restartPolicy defines the restart policy when pod failures happen.\nThe former named Default policy is deprecated, will be removed in the future,\nreplace with None policy for the same behavior.", - "enum": [ - "Default", - "RecreateGroupOnPodRestart", - "RecreateGroupAfterStart", - "None" - ], - "type": "string" - }, - "size": { - "default": 1, - "description": "size is the number of pods to create. It is the total number of pods in each group.\nThe minimum is 1 which represent the leader. When set to 1, the leader\npod is created for each group as well as a 0-replica StatefulSet for the workers.\nDefault to 1.", - "format": "int32", - "type": "integer" - }, - "subGroupPolicy": { - "description": "subGroupPolicy describes the policy that will be applied when creating subgroups\nin each replica.", - "properties": { - "subGroupPolicyType": { - "default": "LeaderWorker", - "description": "subGroupPolicyType defines what type of Subgroups to create. Defaults to\nLeaderWorker", - "enum": [ - "LeaderWorker", - "LeaderExcluded" - ], - "type": "string" - }, - "subGroupSize": { - "description": "subGroupSize is the number of pods per subgroup. This value is immutable,\nand must not be greater than LeaderWorkerSet.Spec.Size.\nSize must be divisible by subGroupSize in which case the\nsubgroups will be of equal size. Or size - 1 is divisible\nby subGroupSize, in which case the leader is considered as\nthe extra pod, and will be part of the first subgroup.", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "volumeClaimTemplates": { - "description": "volumeClaimTemplates is a list of claims that pods are allowed to reference.\nEvery claim in this list must have at least one matching (by name) volumeMount\nin one container in the template. A claim in this list takes precedence over\nany volumes in the template, with the same name.", - "items": { - "description": "PersistentVolumeClaim is a user's request for and claim to a persistent volume", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "description": "Standard object's metadata.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "finalizers": { - "items": { - "type": "string" - }, - "type": "array" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "name": { - "type": "string" - }, - "namespace": { - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "spec": { - "description": "spec defines the desired characteristics of a volume requested by a pod author.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", - "properties": { - "accessModes": { - "description": "accessModes contains the desired access modes the volume should have.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "dataSource": { - "description": "dataSource field can be used to specify either:\n* An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)\n* An existing PVC (PersistentVolumeClaim)\nIf the provisioner or an external controller can support the specified data source,\nit will create a new volume based on the contents of the specified data source.\ndataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be\ncopied to dataSource when dataSourceRef.namespace is not specified.\nIf the namespace is specified, then dataSourceRef will not be copied to dataSource.", - "properties": { - "apiGroup": { - "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", - "type": "string" - }, - "kind": { - "description": "Kind is the type of resource being referenced", - "type": "string" - }, - "name": { - "description": "Name is the name of resource being referenced", - "type": "string" - } - }, - "required": [ - "kind", - "name" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "dataSourceRef": { - "description": "dataSourceRef specifies the object from which to populate the volume with data, if a non-empty\nvolume is desired. This may be any object from a non-empty API group (non\ncore object) or a PersistentVolumeClaim object.\nWhen this field is specified, volume binding will only succeed if the type of\nthe specified object matches some installed volume populator or dynamic\nprovisioner.\nThis field will replace the functionality of the dataSource field and as such\nif both fields are non-empty, they must have the same value. For backwards\ncompatibility, when namespace isn't specified in dataSourceRef,\nboth fields (dataSource and dataSourceRef) will be set to the same\nvalue automatically if one of them is empty and the other is non-empty.\nWhen namespace is specified in dataSourceRef,\ndataSource isn't set to the same value and must be empty.\nThere are three important differences between dataSource and dataSourceRef:\n* While dataSource only allows two specific types of objects, dataSourceRef\n allows any non-core object, as well as PersistentVolumeClaim objects.\n* While dataSource ignores disallowed values (dropping them), dataSourceRef\n preserves all values, and generates an error if a disallowed value is\n specified.\n* While dataSource only allows local objects, dataSourceRef allows objects\n in any namespaces.\n(Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", - "properties": { - "apiGroup": { - "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", - "type": "string" - }, - "kind": { - "description": "Kind is the type of resource being referenced", - "type": "string" - }, - "name": { - "description": "Name is the name of resource being referenced", - "type": "string" - }, - "namespace": { - "description": "Namespace is the namespace of resource being referenced\nNote that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n(Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", - "type": "string" - } - }, - "required": [ - "kind", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "resources": { - "description": "resources represents the minimum resources the volume should have.\nUsers are allowed to specify resource requirements\nthat are lower than previous value but must still be higher than capacity recorded in the\nstatus field of the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources", - "properties": { - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "selector": { - "description": "selector is a label query over volumes to consider for binding.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "storageClassName": { - "description": "storageClassName is the name of the StorageClass required by the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1", - "type": "string" - }, - "volumeAttributesClassName": { - "description": "volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.\nIf specified, the CSI driver will create or update the volume with the attributes defined\nin the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,\nit can be changed after the claim is created. An empty string or nil value indicates that no\nVolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,\nthis field can be reset to its previous value (including nil) to cancel the modification.\nIf the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be\nset to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource\nexists.\nMore info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/", - "type": "string" - }, - "volumeMode": { - "description": "volumeMode defines what type of volume is required by the claim.\nValue of Filesystem is implied when not included in claim spec.", - "type": "string" - }, - "volumeName": { - "description": "volumeName is the binding reference to the PersistentVolume backing this claim.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "status": { - "description": "status represents the current information/status of a persistent volume claim.\nRead-only.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", - "properties": { - "accessModes": { - "description": "accessModes contains the actual access modes the volume backing the PVC has.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "allocatedResourceStatuses": { - "additionalProperties": { - "description": "When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource\nthat it does not recognizes, then it should ignore that update and let other controllers\nhandle it.", - "type": "string" - }, - "description": "allocatedResourceStatuses stores status of resource being resized for the given PVC.\nKey names follow standard Kubernetes label syntax. Valid values are either:\n\t* Un-prefixed keys:\n\t\t- storage - the capacity of the volume.\n\t* Custom resources must use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart from above values - keys that are unprefixed or have kubernetes.io prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState set when resize controller starts resizing the volume in control-plane.\n\t- ControllerResizeFailed:\n\t\tState set when resize has failed in resize controller with a terminal error.\n\t- NodeResizePending:\n\t\tState set when resize controller has finished resizing the volume but further resizing of\n\t\tvolume is needed on the node.\n\t- NodeResizeInProgress:\n\t\tState set when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState set when resizing has failed in kubelet with a terminal error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor example: if expanding a PVC for more capacity - this field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizeFailed\"\nWhen this field is not set, it means that no resize operation is in progress for the given PVC.\n\nA controller that receives PVC update with previously unknown resourceName or ClaimResourceStatus\nshould ignore the update for the purpose it was designed. For example - a controller that\nonly is responsible for resizing capacity of the volume, should ignore PVC updates that change other valid\nresources associated with PVC.", - "type": "object", - "x-kubernetes-map-type": "granular" - }, - "allocatedResources": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "allocatedResources tracks the resources allocated to a PVC including its capacity.\nKey names follow standard Kubernetes label syntax. Valid values are either:\n\t* Un-prefixed keys:\n\t\t- storage - the capacity of the volume.\n\t* Custom resources must use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart from above values - keys that are unprefixed or have kubernetes.io prefix are considered\nreserved and hence may not be used.\n\nCapacity reported here may be larger than the actual capacity when a volume expansion operation\nis requested.\nFor storage quota, the larger value from allocatedResources and PVC.spec.resources is used.\nIf allocatedResources is not set, PVC.spec.resources alone is used for quota calculation.\nIf a volume expansion capacity request is lowered, allocatedResources is only\nlowered if there are no expansion operations in progress and if the actual volume capacity\nis equal or lower than the requested capacity.\n\nA controller that receives PVC update with previously unknown resourceName\nshould ignore the update for the purpose it was designed. For example - a controller that\nonly is responsible for resizing capacity of the volume, should ignore PVC updates that change other valid\nresources associated with PVC.", - "type": "object" - }, - "capacity": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "capacity represents the actual resources of the underlying volume.", - "type": "object" - }, - "conditions": { - "description": "conditions is the current Condition of persistent volume claim. If underlying persistent volume is being\nresized then the Condition will be set to 'Resizing'.", - "items": { - "description": "PersistentVolumeClaimCondition contains details about state of pvc", - "properties": { - "lastProbeTime": { - "description": "lastProbeTime is the time we probed the condition.", - "format": "date-time", - "type": "string" - }, - "lastTransitionTime": { - "description": "lastTransitionTime is the time the condition transitioned from one status to another.", - "format": "date-time", - "type": "string" - }, - "message": { - "description": "message is the human-readable message indicating details about last transition.", - "type": "string" - }, - "reason": { - "description": "reason is a unique, this should be a short, machine understandable string that gives the reason\nfor condition's last transition. If it reports \"Resizing\" that means the underlying\npersistent volume is being resized.", - "type": "string" - }, - "status": { - "description": "Status is the status of the condition.\nCan be True, False, Unknown.\nMore info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required", - "type": "string" - }, - "type": { - "description": "Type is the type of the condition.\nMore info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about", - "type": "string" - } - }, - "required": [ - "status", - "type" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "type" - ], - "x-kubernetes-list-type": "map" - }, - "currentVolumeAttributesClassName": { - "description": "currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.\nWhen unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim", - "type": "string" - }, - "healthStatus": { - "description": "healthStatus contains the latest controller-reported health information\nfor the volume bound to this claim.", - "properties": { - "healthConditions": { - "description": "conditions is the set of adverse conditions reported by\nthe CSI controller plugin. An empty list means no adverse condition.\nAt most 16 conditions may be reported.", - "items": { - "description": "VolumeHealthCondition represents an adverse health condition reported for a volume.", - "properties": { - "message": { - "description": "message is a human-readable description.\nMaximum permitted length of a message is 1024 bytes.", - "type": "string" - }, - "reason": { - "description": "reason is a brief CamelCase machine-parseable reason.\nTogether with status it forms the unique identity of a condition entry.\nMaximum permitted length of a reason is 256 bytes.", - "type": "string" - }, - "status": { - "description": "status is the machine-parseable health category.\nPossible values:\n- \"Inaccessible\": the volume cannot be accessed.\n- \"DataLoss\": data loss has been detected on the volume.\n- \"Degraded\": the volume is functioning with reduced capability.", - "enum": [ - "DataLoss", - "Degraded", - "Inaccessible" - ], - "type": "string" - } - }, - "required": [ - "reason", - "status" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "status", - "reason" - ], - "x-kubernetes-list-type": "map" - }, - "lastTransitionTime": { - "description": "lastTransitionTime is when the current set of conditions first appeared.", - "format": "date-time", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "modifyVolumeStatus": { - "description": "ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.\nWhen this is unset, there is no ModifyVolume operation being attempted.", - "properties": { - "status": { - "description": "status is the status of the ControllerModifyVolume operation. It can be in any of following states:\n - Pending\n Pending indicates that the PersistentVolumeClaim cannot be modified due to unmet requirements, such as\n the specified VolumeAttributesClass not existing.\n - InProgress\n InProgress indicates that the volume is being modified.\n - Infeasible\n Infeasible indicates that the request has been rejected as invalid by the CSI driver. To\n\t resolve the error, a valid VolumeAttributesClass needs to be specified.\nNote: New statuses can be added in the future. Consumers should check for unknown statuses and fail appropriately.", - "type": "string" - }, - "targetVolumeAttributesClassName": { - "description": "targetVolumeAttributesClassName is the name of the VolumeAttributesClass the PVC currently being reconciled", - "type": "string" - } - }, - "required": [ - "status" - ], - "type": "object", - "additionalProperties": false - }, - "phase": { - "description": "phase represents the current phase of PersistentVolumeClaim.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array" - }, - "workerTemplate": { - "description": "workerTemplate defines the pod template for worker pods.", - "properties": { - "metadata": { - "description": "Standard object's metadata.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "finalizers": { - "items": { - "type": "string" - }, - "type": "array" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "name": { - "type": "string" - }, - "namespace": { - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "spec": { - "description": "Specification of the desired behavior of the pod.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", - "properties": { - "activeDeadlineSeconds": { - "description": "Optional duration in seconds the pod may be active on the node relative to\nStartTime before the system will actively try to mark it failed and kill associated containers.\nValue must be a positive integer.", - "format": "int64", - "type": "integer" - }, - "affinity": { - "description": "If specified, the pod's scheduling constraints", - "properties": { - "nodeAffinity": { - "description": "Describes node affinity scheduling rules for the pod.", - "properties": { - "preferredDuringSchedulingIgnoredDuringExecution": { - "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node matches the corresponding matchExpressions; the\nnode(s) with the highest sum are the most preferred.", - "items": { - "description": "An empty preferred scheduling term matches all objects with implicit weight 0\n(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).", - "properties": { - "preference": { - "description": "A node selector term, associated with the corresponding weight.", - "properties": { - "matchExpressions": { - "description": "A list of node selector requirements by node's labels.", - "items": { - "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - "properties": { - "key": { - "description": "The label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - "type": "string" - }, - "values": { - "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchFields": { - "description": "A list of node selector requirements by node's fields.", - "items": { - "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - "properties": { - "key": { - "description": "The label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - "type": "string" - }, - "values": { - "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "weight": { - "description": "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.", - "format": "int32", - "type": "integer" - } - }, - "required": [ - "preference", - "weight" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "requiredDuringSchedulingIgnoredDuringExecution": { - "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to an update), the system\nmay or may not try to eventually evict the pod from its node.", - "properties": { - "nodeSelectorTerms": { - "description": "Required. A list of node selector terms. The terms are ORed.", - "items": { - "description": "A null or empty node selector term matches no objects. The requirements of\nthem are ANDed.\nThe TopologySelectorTerm type implements a subset of the NodeSelectorTerm.", - "properties": { - "matchExpressions": { - "description": "A list of node selector requirements by node's labels.", - "items": { - "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - "properties": { - "key": { - "description": "The label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - "type": "string" - }, - "values": { - "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchFields": { - "description": "A list of node selector requirements by node's fields.", - "items": { - "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - "properties": { - "key": { - "description": "The label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - "type": "string" - }, - "values": { - "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "nodeSelectorTerms" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "podAffinity": { - "description": "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).", - "properties": { - "preferredDuringSchedulingIgnoredDuringExecution": { - "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", - "items": { - "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", - "properties": { - "podAffinityTerm": { - "description": "Required. A pod affinity term, associated with the corresponding weight.", - "properties": { - "labelSelector": { - "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "mismatchLabelKeys": { - "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "namespaceSelector": { - "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "namespaces": { - "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologyKey": { - "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - "type": "string" - } - }, - "required": [ - "topologyKey" - ], - "type": "object", - "additionalProperties": false - }, - "weight": { - "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", - "format": "int32", - "type": "integer" - } - }, - "required": [ - "podAffinityTerm", - "weight" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "requiredDuringSchedulingIgnoredDuringExecution": { - "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", - "items": { - "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", - "properties": { - "labelSelector": { - "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "mismatchLabelKeys": { - "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "namespaceSelector": { - "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "namespaces": { - "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologyKey": { - "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - "type": "string" - } - }, - "required": [ - "topologyKey" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "podAntiAffinity": { - "description": "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", - "properties": { - "preferredDuringSchedulingIgnoredDuringExecution": { - "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", - "items": { - "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", - "properties": { - "podAffinityTerm": { - "description": "Required. A pod affinity term, associated with the corresponding weight.", - "properties": { - "labelSelector": { - "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "mismatchLabelKeys": { - "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "namespaceSelector": { - "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "namespaces": { - "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologyKey": { - "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - "type": "string" - } - }, - "required": [ - "topologyKey" - ], - "type": "object", - "additionalProperties": false - }, - "weight": { - "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", - "format": "int32", - "type": "integer" - } - }, - "required": [ - "podAffinityTerm", - "weight" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "requiredDuringSchedulingIgnoredDuringExecution": { - "description": "If the anti-affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the anti-affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", - "items": { - "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", - "properties": { - "labelSelector": { - "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "mismatchLabelKeys": { - "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "namespaceSelector": { - "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "namespaces": { - "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologyKey": { - "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - "type": "string" - } - }, - "required": [ - "topologyKey" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "automountServiceAccountToken": { - "description": "AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.", - "type": "boolean" - }, - "containers": { - "description": "List of containers belonging to the pod.\nContainers cannot currently be added or removed.\nThere must be at least one container in a Pod.\nCannot be updated.", - "items": { - "description": "A single application container that you want to run within a pod.", - "properties": { - "args": { - "description": "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "command": { - "description": "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "env": { - "description": "List of environment variables to set in the container.\nCannot be updated.", - "items": { - "description": "EnvVar represents an environment variable present in a Container.", - "properties": { - "name": { - "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "value": { - "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", - "type": "string" - }, - "valueFrom": { - "description": "Source for the environment variable's value. Cannot be used if value is not empty.", - "properties": { - "configMapKeyRef": { - "description": "Selects a key of a ConfigMap.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fieldRef": { - "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fileKeyRef": { - "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", - "properties": { - "key": { - "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", - "type": "string" - }, - "optional": { - "default": false, - "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", - "type": "boolean" - }, - "path": { - "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", - "type": "string" - }, - "volumeName": { - "description": "The name of the volume mount containing the env file.", - "type": "string" - } - }, - "required": [ - "key", - "path", - "volumeName" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secretKeyRef": { - "description": "Selects a key of a secret in the pod's namespace", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "envFrom": { - "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", - "items": { - "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", - "properties": { - "configMapRef": { - "description": "The ConfigMap to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "prefix": { - "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "secretRef": { - "description": "The Secret to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "image": { - "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", - "type": "string" - }, - "imagePullPolicy": { - "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", - "type": "string" - }, - "lifecycle": { - "description": "Actions that the management system should take in response to container lifecycle events.\nCannot be updated.", - "properties": { - "postStart": { - "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "preStop": { - "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "stopSignal": { - "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "livenessProbe": { - "description": "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "name": { - "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", - "type": "string" - }, - "ports": { - "description": "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", - "items": { - "description": "ContainerPort represents a network port in a single container.", - "properties": { - "containerPort": { - "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", - "format": "int32", - "type": "integer" - }, - "hostIP": { - "description": "What host IP to bind the external port to.", - "type": "string" - }, - "hostPort": { - "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", - "format": "int32", - "type": "integer" - }, - "name": { - "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", - "type": "string" - }, - "protocol": { - "default": "TCP", - "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", - "type": "string" - } - }, - "required": [ - "containerPort" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "containerPort", - "protocol" - ], - "x-kubernetes-list-type": "map" - }, - "readinessProbe": { - "description": "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "resizePolicy": { - "description": "Resources resize policy for the container.\nThis field cannot be set on ephemeral containers.", - "items": { - "description": "ContainerResizePolicy represents resource resize policy for the container.", - "properties": { - "resourceName": { - "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", - "type": "string" - }, - "restartPolicy": { - "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", - "type": "string" - } - }, - "required": [ - "resourceName", - "restartPolicy" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "resources": { - "description": "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "properties": { - "claims": { - "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", - "items": { - "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", - "properties": { - "name": { - "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - "type": "string" - }, - "request": { - "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "restartPolicy": { - "description": "RestartPolicy defines the restart behavior of individual containers in a pod.\nThis overrides the pod-level restart policy. When this field is not specified,\nthe restart behavior is defined by the Pod's restart policy and the container type.\nAdditionally, setting the RestartPolicy as \"Always\" for the init container will\nhave the following effect:\nthis init container will be continually restarted on\nexit until all regular containers have terminated. Once all regular\ncontainers have completed, all init containers with restartPolicy \"Always\"\nwill be shut down. This lifecycle differs from normal init containers and\nis often referred to as a \"sidecar\" container. Although this init\ncontainer still starts in the init container sequence, it does not wait\nfor the container to complete before proceeding to the next init\ncontainer. Instead, the next init container starts immediately after this\ninit container is started, or after any startupProbe has successfully\ncompleted.", - "type": "string" - }, - "restartPolicyRules": { - "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. The rules are evaluated in\norder. Once a rule matches a container exit condition, the remaining\nrules are ignored. If no rule matches the container exit condition,\nthe Container-level restart policy determines the whether the container\nis restarted or not. Constraints on the rules:\n- At most 20 rules are allowed.\n- Rules can have the same action.\n- Identical rules are not forbidden in validations.\nWhen rules are specified, container MUST set RestartPolicy explicitly\neven it if matches the Pod's RestartPolicy.", - "items": { - "description": "ContainerRestartRule describes how a container exit is handled.", - "properties": { - "action": { - "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", - "type": "string" - }, - "exitCodes": { - "description": "Represents the exit codes to check on container exits.", - "properties": { - "operator": { - "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", - "type": "string" - }, - "values": { - "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", - "items": { - "format": "int32", - "type": "integer" - }, - "type": "array", - "x-kubernetes-list-type": "set" - } - }, - "required": [ - "operator" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "action" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "securityContext": { - "description": "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", - "properties": { - "allowPrivilegeEscalation": { - "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "appArmorProfile": { - "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", - "type": "string" - }, - "type": { - "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "capabilities": { - "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "add": { - "description": "Added capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "drop": { - "description": "Removed capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "privileged": { - "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "procMount": { - "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "readOnlyRootFilesystem": { - "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "runAsGroup": { - "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "runAsNonRoot": { - "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "boolean" - }, - "runAsUser": { - "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "seLinuxOptions": { - "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "level": { - "description": "Level is SELinux level label that applies to the container.", - "type": "string" - }, - "role": { - "description": "Role is a SELinux role label that applies to the container.", - "type": "string" - }, - "type": { - "description": "Type is a SELinux type label that applies to the container.", - "type": "string" - }, - "user": { - "description": "User is a SELinux user label that applies to the container.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "seccompProfile": { - "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - "type": "string" - }, - "type": { - "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "windowsOptions": { - "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", - "properties": { - "gmsaCredentialSpec": { - "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", - "type": "string" - }, - "gmsaCredentialSpecName": { - "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", - "type": "string" - }, - "hostProcess": { - "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", - "type": "boolean" - }, - "runAsUserName": { - "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "startupProbe": { - "description": "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "stdin": { - "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", - "type": "boolean" - }, - "stdinOnce": { - "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", - "type": "boolean" - }, - "terminationMessagePath": { - "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", - "type": "string" - }, - "terminationMessagePolicy": { - "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", - "type": "string" - }, - "tty": { - "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", - "type": "boolean" - }, - "volumeDevices": { - "description": "volumeDevices is the list of block devices to be used by the container.", - "items": { - "description": "volumeDevice describes a mapping of a raw block device within a container.", - "properties": { - "devicePath": { - "description": "devicePath is the path inside of the container that the device will be mapped to.", - "type": "string" - }, - "name": { - "description": "name must match the name of a persistentVolumeClaim in the pod", - "type": "string" - } - }, - "required": [ - "devicePath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "devicePath" - ], - "x-kubernetes-list-type": "map" - }, - "volumeMounts": { - "description": "Pod volumes to mount into the container's filesystem.\nCannot be updated.", - "items": { - "description": "VolumeMount describes a mounting of a Volume within a container.", - "properties": { - "bindMountOptions": { - "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set" - }, - "mountPath": { - "description": "Path within the container at which the volume should be mounted.", - "type": "string" - }, - "mountPropagation": { - "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", - "type": "string" - }, - "name": { - "description": "This must match the Name of a Volume.", - "type": "string" - }, - "readOnly": { - "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", - "type": "boolean" - }, - "recursiveReadOnly": { - "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", - "type": "string" - }, - "subPath": { - "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", - "type": "string" - }, - "subPathExpr": { - "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", - "type": "string" - } - }, - "required": [ - "mountPath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "mountPath" - ], - "x-kubernetes-list-type": "map" - }, - "workingDir": { - "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "dnsConfig": { - "description": "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", - "properties": { - "nameservers": { - "description": "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "options": { - "description": "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", - "items": { - "description": "PodDNSConfigOption defines DNS resolver options of a pod.", - "properties": { - "name": { - "description": "Name is this DNS resolver option's name.\nRequired.", - "type": "string" - }, - "value": { - "description": "Value is this DNS resolver option's value.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "searches": { - "description": "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "dnsPolicy": { - "description": "Set DNS policy for the pod.\nDefaults to \"ClusterFirst\".\nValid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'.\nDNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy.\nTo have DNS options set along with hostNetwork, you have to specify DNS policy\nexplicitly to 'ClusterFirstWithHostNet'.", - "type": "string" - }, - "enableServiceLinks": { - "description": "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", - "type": "boolean" - }, - "ephemeralContainers": { - "description": "List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing\npod to perform user-initiated actions such as debugging. This list cannot be specified when\ncreating a pod, and it cannot be modified by updating the pod spec. In order to add an\nephemeral container to an existing pod, use the pod's ephemeralcontainers subresource.", - "items": { - "description": "An EphemeralContainer is a temporary container that you may add to an existing Pod for\nuser-initiated activities such as debugging. Ephemeral containers have no resource or\nscheduling guarantees, and they will not be restarted when they exit or when a Pod is\nremoved or restarted. The kubelet may evict a Pod if an ephemeral container causes the\nPod to exceed its resource allocation.\n\nTo add an ephemeral container, use the ephemeralcontainers subresource of an existing\nPod. Ephemeral containers may not be removed or restarted.", - "properties": { - "args": { - "description": "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "command": { - "description": "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "env": { - "description": "List of environment variables to set in the container.\nCannot be updated.", - "items": { - "description": "EnvVar represents an environment variable present in a Container.", - "properties": { - "name": { - "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "value": { - "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", - "type": "string" - }, - "valueFrom": { - "description": "Source for the environment variable's value. Cannot be used if value is not empty.", - "properties": { - "configMapKeyRef": { - "description": "Selects a key of a ConfigMap.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fieldRef": { - "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fileKeyRef": { - "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", - "properties": { - "key": { - "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", - "type": "string" - }, - "optional": { - "default": false, - "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", - "type": "boolean" - }, - "path": { - "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", - "type": "string" - }, - "volumeName": { - "description": "The name of the volume mount containing the env file.", - "type": "string" - } - }, - "required": [ - "key", - "path", - "volumeName" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secretKeyRef": { - "description": "Selects a key of a secret in the pod's namespace", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "envFrom": { - "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", - "items": { - "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", - "properties": { - "configMapRef": { - "description": "The ConfigMap to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "prefix": { - "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "secretRef": { - "description": "The Secret to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "image": { - "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", - "type": "string" - }, - "imagePullPolicy": { - "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", - "type": "string" - }, - "lifecycle": { - "description": "Lifecycle is not allowed for ephemeral containers.", - "properties": { - "postStart": { - "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "preStop": { - "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "stopSignal": { - "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "livenessProbe": { - "description": "Probes are not allowed for ephemeral containers.", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "name": { - "description": "Name of the ephemeral container specified as a DNS_LABEL.\nThis name must be unique among all containers, init containers and ephemeral containers.", - "type": "string" - }, - "ports": { - "description": "Ports are not allowed for ephemeral containers.", - "items": { - "description": "ContainerPort represents a network port in a single container.", - "properties": { - "containerPort": { - "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", - "format": "int32", - "type": "integer" - }, - "hostIP": { - "description": "What host IP to bind the external port to.", - "type": "string" - }, - "hostPort": { - "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", - "format": "int32", - "type": "integer" - }, - "name": { - "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", - "type": "string" - }, - "protocol": { - "default": "TCP", - "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", - "type": "string" - } - }, - "required": [ - "containerPort" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "containerPort", - "protocol" - ], - "x-kubernetes-list-type": "map" - }, - "readinessProbe": { - "description": "Probes are not allowed for ephemeral containers.", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "resizePolicy": { - "description": "Resources resize policy for the container.", - "items": { - "description": "ContainerResizePolicy represents resource resize policy for the container.", - "properties": { - "resourceName": { - "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", - "type": "string" - }, - "restartPolicy": { - "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", - "type": "string" - } - }, - "required": [ - "resourceName", - "restartPolicy" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "resources": { - "description": "Resources are not allowed for ephemeral containers. Ephemeral containers use spare resources\nalready allocated to the pod.", - "properties": { - "claims": { - "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", - "items": { - "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", - "properties": { - "name": { - "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - "type": "string" - }, - "request": { - "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "restartPolicy": { - "description": "Restart policy for the container to manage the restart behavior of each\ncontainer within a pod.\nYou cannot set this field on ephemeral containers.", - "type": "string" - }, - "restartPolicyRules": { - "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. You cannot set this field on\nephemeral containers.", - "items": { - "description": "ContainerRestartRule describes how a container exit is handled.", - "properties": { - "action": { - "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", - "type": "string" - }, - "exitCodes": { - "description": "Represents the exit codes to check on container exits.", - "properties": { - "operator": { - "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", - "type": "string" - }, - "values": { - "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", - "items": { - "format": "int32", - "type": "integer" - }, - "type": "array", - "x-kubernetes-list-type": "set" - } - }, - "required": [ - "operator" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "action" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "securityContext": { - "description": "Optional: SecurityContext defines the security options the ephemeral container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.", - "properties": { - "allowPrivilegeEscalation": { - "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "appArmorProfile": { - "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", - "type": "string" - }, - "type": { - "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "capabilities": { - "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "add": { - "description": "Added capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "drop": { - "description": "Removed capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "privileged": { - "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "procMount": { - "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "readOnlyRootFilesystem": { - "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "runAsGroup": { - "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "runAsNonRoot": { - "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "boolean" - }, - "runAsUser": { - "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "seLinuxOptions": { - "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "level": { - "description": "Level is SELinux level label that applies to the container.", - "type": "string" - }, - "role": { - "description": "Role is a SELinux role label that applies to the container.", - "type": "string" - }, - "type": { - "description": "Type is a SELinux type label that applies to the container.", - "type": "string" - }, - "user": { - "description": "User is a SELinux user label that applies to the container.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "seccompProfile": { - "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - "type": "string" - }, - "type": { - "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "windowsOptions": { - "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", - "properties": { - "gmsaCredentialSpec": { - "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", - "type": "string" - }, - "gmsaCredentialSpecName": { - "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", - "type": "string" - }, - "hostProcess": { - "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", - "type": "boolean" - }, - "runAsUserName": { - "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "startupProbe": { - "description": "Probes are not allowed for ephemeral containers.", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "stdin": { - "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", - "type": "boolean" - }, - "stdinOnce": { - "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", - "type": "boolean" - }, - "targetContainerName": { - "description": "If set, the name of the container from PodSpec that this ephemeral container targets.\nThe ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.\nIf not set then the ephemeral container uses the namespaces configured in the Pod spec.\n\nThe container runtime must implement support for this feature. If the runtime does not\nsupport namespace targeting then the result of setting this field is undefined.", - "type": "string" - }, - "terminationMessagePath": { - "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", - "type": "string" - }, - "terminationMessagePolicy": { - "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", - "type": "string" - }, - "tty": { - "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", - "type": "boolean" - }, - "volumeDevices": { - "description": "volumeDevices is the list of block devices to be used by the container.", - "items": { - "description": "volumeDevice describes a mapping of a raw block device within a container.", - "properties": { - "devicePath": { - "description": "devicePath is the path inside of the container that the device will be mapped to.", - "type": "string" - }, - "name": { - "description": "name must match the name of a persistentVolumeClaim in the pod", - "type": "string" - } - }, - "required": [ - "devicePath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "devicePath" - ], - "x-kubernetes-list-type": "map" - }, - "volumeMounts": { - "description": "Pod volumes to mount into the container's filesystem. Subpath mounts are not allowed for ephemeral containers.\nCannot be updated.", - "items": { - "description": "VolumeMount describes a mounting of a Volume within a container.", - "properties": { - "bindMountOptions": { - "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set" - }, - "mountPath": { - "description": "Path within the container at which the volume should be mounted.", - "type": "string" - }, - "mountPropagation": { - "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", - "type": "string" - }, - "name": { - "description": "This must match the Name of a Volume.", - "type": "string" - }, - "readOnly": { - "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", - "type": "boolean" - }, - "recursiveReadOnly": { - "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", - "type": "string" - }, - "subPath": { - "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", - "type": "string" - }, - "subPathExpr": { - "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", - "type": "string" - } - }, - "required": [ - "mountPath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "mountPath" - ], - "x-kubernetes-list-type": "map" - }, - "workingDir": { - "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "evictionResponders": { - "description": "evictionResponders reference responders that react to Evictions based on EvictionRequests.\nResponders should observe and communicate through the Eviction Resource API to help with\nthe graceful termination of a pod. The responders are selected sequentially, according to\ntheir specified priority.\n\nResponders should periodically report on an eviction progress by updating the\n.status.responders[].heartbeatTime field of the Eviction object. If this field is not updated\nwithin the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction\nis passed over to the next responder with a lower priority. If there is no other responder,\nthe last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will\nevict the pod using the imperative Eviction API (pods//eviction subresource).\n\nThe maximum length of the responders list is 10.\nResponders are not supported when the pod is part of a PodGroup (.spec.schedulingGroup is set).\nThis field can only be set on creation and is immutable afterwards.", - "items": { - "description": "EvictionResponder allows you to specify the responder reacting to an Eviction.\nResponders should observe and communicate through the Eviction Resource API to help with\nthe graceful eviction of a target (e.g. termination of a pod).", - "properties": { - "name": { - "description": "name allows you to identify the responder responding to the Eviction.\n\nIt must be a valid domain-prefixed key (such as \"acme.io/foo\").\nDomain names *.k8s.io and *.kubernetes.io are reserved.\nThis field must be unique for each responder.\nThis field is required.", - "type": "string" - }, - "priority": { - "description": "priority for this responder. Higher priorities are selected first by the evictionrequest-controller.\nIf there are responders with the same priority, the responder whose domain name comes first in the\nalphabetical higher domain order, will be picked. This means that the top domain labels are compared\nalphabetically first, followed by the lower domain labels. The key is compared last.\n\nThe responder that is the managing controller of the pod should set the value of\nthis field to 10000 to allow both for preemption or fallback registration by other\nresponders.\n\nThe minimum value is 0 and the maximum value is 100000.\nThe interval 0-999 is reserved for responders with *.k8s.io suffix.\nThis field is required.", - "format": "int32", - "type": "integer" - } - }, - "required": [ - "name", - "priority" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "hostAliases": { - "description": "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified.", - "items": { - "description": "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", - "properties": { - "hostnames": { - "description": "Hostnames for the above IP address.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "ip": { - "description": "IP address of the host file entry.", - "type": "string" - } - }, - "required": [ - "ip" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "ip" - ], - "x-kubernetes-list-type": "map" - }, - "hostIPC": { - "description": "Use the host's ipc namespace.\nOptional: Default to false.", - "type": "boolean" - }, - "hostNetwork": { - "description": "Host networking requested for this pod. Use the host's network namespace.\nWhen using HostNetwork you should specify ports so the scheduler is aware.\nWhen `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,\nand unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.\nDefault to false.", - "type": "boolean" - }, - "hostPID": { - "description": "Use the host's pid namespace.\nOptional: Default to false.", - "type": "boolean" - }, - "hostUsers": { - "description": "Use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new userns is created for the pod. Setting false is useful for\nmitigating container breakout vulnerabilities even allowing users to run their\ncontainers as root without actually having root privileges on the host.", - "type": "boolean" - }, - "hostname": { - "description": "Specifies the hostname of the Pod\nIf not specified, the pod's hostname will be set to a system-defined value.", - "type": "string" - }, - "hostnameOverride": { - "description": "HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.\nThis field only specifies the pod's hostname and does not affect its DNS records.\nWhen this field is set to a non-empty string:\n- It takes precedence over the values set in `hostname` and `subdomain`.\n- The Pod's hostname will be set to this value.\n- `setHostnameAsFQDN` must be nil or set to false.\n- `hostNetwork` must be set to false.\n\nThis field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.", - "type": "string" - }, - "imagePullSecrets": { - "description": "ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.\nIf specified, these secrets will be passed to individual puller implementations for them to use.\nMore info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod", - "items": { - "description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "initContainers": { - "description": "List of initialization containers belonging to the pod.\nInit containers are executed in order prior to containers being started. If any\ninit container fails, the pod is considered to have failed and is handled according\nto its restartPolicy. The name for an init container or normal container must be\nunique among all containers.\nInit containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.\nThe resourceRequirements of an init container are taken into account during scheduling\nby finding the highest request/limit for each resource type, and then using the max of\nthat value or the sum of the normal containers. Limits are applied to init containers\nin a similar fashion.\nInit containers cannot currently be added or removed.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/", - "items": { - "description": "A single application container that you want to run within a pod.", - "properties": { - "args": { - "description": "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "command": { - "description": "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "env": { - "description": "List of environment variables to set in the container.\nCannot be updated.", - "items": { - "description": "EnvVar represents an environment variable present in a Container.", - "properties": { - "name": { - "description": "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "value": { - "description": "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", - "type": "string" - }, - "valueFrom": { - "description": "Source for the environment variable's value. Cannot be used if value is not empty.", - "properties": { - "configMapKeyRef": { - "description": "Selects a key of a ConfigMap.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fieldRef": { - "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "fileKeyRef": { - "description": "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", - "properties": { - "key": { - "description": "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", - "type": "string" - }, - "optional": { - "default": false, - "description": "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", - "type": "boolean" - }, - "path": { - "description": "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", - "type": "string" - }, - "volumeName": { - "description": "The name of the volume mount containing the env file.", - "type": "string" - } - }, - "required": [ - "key", - "path", - "volumeName" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secretKeyRef": { - "description": "Selects a key of a secret in the pod's namespace", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "envFrom": { - "description": "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", - "items": { - "description": "EnvFromSource represents the source of a set of ConfigMaps or Secrets", - "properties": { - "configMapRef": { - "description": "The ConfigMap to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "prefix": { - "description": "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", - "type": "string" - }, - "secretRef": { - "description": "The Secret to select from", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "image": { - "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", - "type": "string" - }, - "imagePullPolicy": { - "description": "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", - "type": "string" - }, - "lifecycle": { - "description": "Actions that the management system should take in response to container lifecycle events.\nCannot be updated.", - "properties": { - "postStart": { - "description": "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "preStop": { - "description": "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "sleep": { - "description": "Sleep represents a duration that the container should sleep.", - "properties": { - "seconds": { - "description": "Seconds is the number of seconds to sleep.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "seconds" - ], - "type": "object", - "additionalProperties": false - }, - "tcpSocket": { - "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "stopSignal": { - "description": "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "livenessProbe": { - "description": "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "name": { - "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", - "type": "string" - }, - "ports": { - "description": "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", - "items": { - "description": "ContainerPort represents a network port in a single container.", - "properties": { - "containerPort": { - "description": "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", - "format": "int32", - "type": "integer" - }, - "hostIP": { - "description": "What host IP to bind the external port to.", - "type": "string" - }, - "hostPort": { - "description": "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", - "format": "int32", - "type": "integer" - }, - "name": { - "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", - "type": "string" - }, - "protocol": { - "default": "TCP", - "description": "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", - "type": "string" - } - }, - "required": [ - "containerPort" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "containerPort", - "protocol" - ], - "x-kubernetes-list-type": "map" - }, - "readinessProbe": { - "description": "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "resizePolicy": { - "description": "Resources resize policy for the container.\nThis field cannot be set on ephemeral containers.", - "items": { - "description": "ContainerResizePolicy represents resource resize policy for the container.", - "properties": { - "resourceName": { - "description": "Name of the resource to which this resource resize policy applies.\nSupported values: cpu, memory.", - "type": "string" - }, - "restartPolicy": { - "description": "Restart policy to apply when specified resource is resized.\nIf not specified, it defaults to NotRequired.", - "type": "string" - } - }, - "required": [ - "resourceName", - "restartPolicy" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "resources": { - "description": "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "properties": { - "claims": { - "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", - "items": { - "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", - "properties": { - "name": { - "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - "type": "string" - }, - "request": { - "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "restartPolicy": { - "description": "RestartPolicy defines the restart behavior of individual containers in a pod.\nThis overrides the pod-level restart policy. When this field is not specified,\nthe restart behavior is defined by the Pod's restart policy and the container type.\nAdditionally, setting the RestartPolicy as \"Always\" for the init container will\nhave the following effect:\nthis init container will be continually restarted on\nexit until all regular containers have terminated. Once all regular\ncontainers have completed, all init containers with restartPolicy \"Always\"\nwill be shut down. This lifecycle differs from normal init containers and\nis often referred to as a \"sidecar\" container. Although this init\ncontainer still starts in the init container sequence, it does not wait\nfor the container to complete before proceeding to the next init\ncontainer. Instead, the next init container starts immediately after this\ninit container is started, or after any startupProbe has successfully\ncompleted.", - "type": "string" - }, - "restartPolicyRules": { - "description": "Represents a list of rules to be checked to determine if the\ncontainer should be restarted on exit. The rules are evaluated in\norder. Once a rule matches a container exit condition, the remaining\nrules are ignored. If no rule matches the container exit condition,\nthe Container-level restart policy determines the whether the container\nis restarted or not. Constraints on the rules:\n- At most 20 rules are allowed.\n- Rules can have the same action.\n- Identical rules are not forbidden in validations.\nWhen rules are specified, container MUST set RestartPolicy explicitly\neven it if matches the Pod's RestartPolicy.", - "items": { - "description": "ContainerRestartRule describes how a container exit is handled.", - "properties": { - "action": { - "description": "Specifies the action taken on a container exit if the requirements\nare satisfied. The only possible value is \"Restart\" to restart the\ncontainer.", - "type": "string" - }, - "exitCodes": { - "description": "Represents the exit codes to check on container exits.", - "properties": { - "operator": { - "description": "Represents the relationship between the container exit code(s) and the\nspecified values. Possible values are:\n- In: the requirement is satisfied if the container exit code is in the\n set of specified values.\n- NotIn: the requirement is satisfied if the container exit code is\n not in the set of specified values.", - "type": "string" - }, - "values": { - "description": "Specifies the set of values to check for container exit codes.\nAt most 255 elements are allowed.", - "items": { - "format": "int32", - "type": "integer" - }, - "type": "array", - "x-kubernetes-list-type": "set" - } - }, - "required": [ - "operator" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "action" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "securityContext": { - "description": "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", - "properties": { - "allowPrivilegeEscalation": { - "description": "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "appArmorProfile": { - "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", - "type": "string" - }, - "type": { - "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "capabilities": { - "description": "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "add": { - "description": "Added capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "drop": { - "description": "Removed capabilities", - "items": { - "description": "Capability represent POSIX capabilities type", - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "privileged": { - "description": "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "procMount": { - "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "readOnlyRootFilesystem": { - "description": "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "boolean" - }, - "runAsGroup": { - "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "runAsNonRoot": { - "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "boolean" - }, - "runAsUser": { - "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "seLinuxOptions": { - "description": "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "level": { - "description": "Level is SELinux level label that applies to the container.", - "type": "string" - }, - "role": { - "description": "Role is a SELinux role label that applies to the container.", - "type": "string" - }, - "type": { - "description": "Type is a SELinux type label that applies to the container.", - "type": "string" - }, - "user": { - "description": "User is a SELinux user label that applies to the container.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "seccompProfile": { - "description": "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - "type": "string" - }, - "type": { - "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "windowsOptions": { - "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", - "properties": { - "gmsaCredentialSpec": { - "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", - "type": "string" - }, - "gmsaCredentialSpecName": { - "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", - "type": "string" - }, - "hostProcess": { - "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", - "type": "boolean" - }, - "runAsUserName": { - "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "startupProbe": { - "description": "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "properties": { - "exec": { - "description": "Exec specifies a command to execute in the container.", - "properties": { - "command": { - "description": "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "failureThreshold": { - "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "grpc": { - "description": "GRPC specifies a GRPC HealthCheckRequest.", - "properties": { - "mode": { - "description": "mode specifies the connection mode for the gRPC health probe.\nSet to \"TLS\" to use TLS without certificate verification.\nSet to \"Plaintext\" to use a plaintext (insecure) connection explicitly.\nIf not specified, the probe uses a plaintext (insecure) connection.", - "type": "string" - }, - "port": { - "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", - "format": "int32", - "type": "integer" - }, - "service": { - "default": "", - "description": "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "httpGet": { - "description": "HTTPGet specifies an HTTP GET request to perform.", - "properties": { - "host": { - "description": "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", - "type": "string" - }, - "httpHeaders": { - "description": "Custom headers to set in the request. HTTP allows repeated headers.", - "items": { - "description": "HTTPHeader describes a custom header to be used in HTTP probes", - "properties": { - "name": { - "description": "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", - "type": "string" - }, - "value": { - "description": "The header field value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "Path to access on the HTTP server.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "protocol": { - "description": "Protocol selects the wire protocol for the probe connection.\nNil defaults to HTTP/1.1.", - "type": "string" - }, - "scheme": { - "description": "Scheme to use for connecting to the host.\nDefaults to HTTP.", - "type": "string" - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "initialDelaySeconds": { - "description": "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - }, - "periodSeconds": { - "description": "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "successThreshold": { - "description": "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", - "format": "int32", - "type": "integer" - }, - "tcpSocket": { - "description": "TCPSocket specifies a connection to a TCP port.", - "properties": { - "host": { - "description": "Optional: Host name to connect to, defaults to the pod IP.", - "type": "string" - }, - "port": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "required": [ - "port" - ], - "type": "object", - "additionalProperties": false - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", - "format": "int64", - "type": "integer" - }, - "timeoutSeconds": { - "description": "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "stdin": { - "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the container will always result in EOF.\nDefault is false.", - "type": "boolean" - }, - "stdinOnce": { - "description": "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the container is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", - "type": "boolean" - }, - "terminationMessagePath": { - "description": "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", - "type": "string" - }, - "terminationMessagePolicy": { - "description": "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", - "type": "string" - }, - "tty": { - "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", - "type": "boolean" - }, - "volumeDevices": { - "description": "volumeDevices is the list of block devices to be used by the container.", - "items": { - "description": "volumeDevice describes a mapping of a raw block device within a container.", - "properties": { - "devicePath": { - "description": "devicePath is the path inside of the container that the device will be mapped to.", - "type": "string" - }, - "name": { - "description": "name must match the name of a persistentVolumeClaim in the pod", - "type": "string" - } - }, - "required": [ - "devicePath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "devicePath" - ], - "x-kubernetes-list-type": "map" - }, - "volumeMounts": { - "description": "Pod volumes to mount into the container's filesystem.\nCannot be updated.", - "items": { - "description": "VolumeMount describes a mounting of a Volume within a container.", - "properties": { - "bindMountOptions": { - "description": "bindMountOptions is the list of additional bind mount options to apply when\nmounting this volume into the container. Allowed values are noexec,\nnodev, and nosuid. These are Linux mount options and have no effect on\nWindows nodes.\nThis field is not supported with image volumes.\nThis is an alpha field and requires enabling the VolumeBindMountOptions feature gate.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set" - }, - "mountPath": { - "description": "Path within the container at which the volume should be mounted.", - "type": "string" - }, - "mountPropagation": { - "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", - "type": "string" - }, - "name": { - "description": "This must match the Name of a Volume.", - "type": "string" - }, - "readOnly": { - "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", - "type": "boolean" - }, - "recursiveReadOnly": { - "description": "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", - "type": "string" - }, - "subPath": { - "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", - "type": "string" - }, - "subPathExpr": { - "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", - "type": "string" - } - }, - "required": [ - "mountPath", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "mountPath" - ], - "x-kubernetes-list-type": "map" - }, - "workingDir": { - "description": "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "nodeName": { - "description": "NodeName indicates in which node this pod is scheduled.\nIf empty, this pod is a candidate for scheduling by the scheduler defined in schedulerName.\nOnce this field is set, the kubelet for this node becomes responsible for the lifecycle of this pod.\nThis field should not be used to express a desire for the pod to be scheduled on a specific node.\nhttps://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodename", - "type": "string" - }, - "nodeSelector": { - "additionalProperties": { - "type": "string" - }, - "description": "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", - "type": "object", - "x-kubernetes-map-type": "atomic" - }, - "os": { - "description": "Specifies the OS of the containers in the pod.\nSome pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset:\n-securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset:\n- spec.hostPID\n- spec.hostIPC\n- spec.hostUsers\n- spec.resources\n- spec.securityContext.appArmorProfile\n- spec.securityContext.seLinuxOptions\n- spec.securityContext.seccompProfile\n- spec.securityContext.fsGroup\n- spec.securityContext.fsGroupChangePolicy\n- spec.securityContext.sysctls\n- spec.shareProcessNamespace\n- spec.securityContext.runAsUser\n- spec.securityContext.runAsGroup\n- spec.securityContext.supplementalGroups\n- spec.securityContext.supplementalGroupsPolicy\n- spec.containers[*].securityContext.appArmorProfile\n- spec.containers[*].securityContext.seLinuxOptions\n- spec.containers[*].securityContext.seccompProfile\n- spec.containers[*].securityContext.capabilities\n- spec.containers[*].securityContext.readOnlyRootFilesystem\n- spec.containers[*].securityContext.privileged\n- spec.containers[*].securityContext.allowPrivilegeEscalation\n- spec.containers[*].securityContext.procMount\n- spec.containers[*].securityContext.runAsUser\n- spec.containers[*].securityContext.runAsGroup", - "properties": { - "name": { - "description": "Name is the name of the operating system. The currently supported values are linux and windows.\nAdditional value may be defined in future and can be one of:\nhttps://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration\nClients should expect to handle additional values and treat unrecognized values in this field as os: null", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "overhead": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Overhead represents the resource overhead associated with running a pod for a given RuntimeClass.\nThis field will be autopopulated at admission time by the RuntimeClass admission controller. If\nthe RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests.\nThe RuntimeClass admission controller will reject Pod create requests which have the overhead already\nset. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value\ndefined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md", - "type": "object" - }, - "preemptionPolicy": { - "description": "PreemptionPolicy is the Policy for preempting pods with lower priority.\nOne of Never, PreemptLowerPriority.\nWhen Priority Admission Controller is enabled, it prevents users from setting\nthis field. The admission controller populates this field from PriorityClassName.\nDefaults to PreemptLowerPriority if unset.", - "type": "string" - }, - "priority": { - "description": "The priority value. Various system components use this field to find the\npriority of the pod. When Priority Admission Controller is enabled, it\nprevents users from setting this field. The admission controller populates\nthis field from PriorityClassName.\nThe higher the value, the higher the priority.", - "format": "int32", - "type": "integer" - }, - "priorityClassName": { - "description": "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", - "type": "string" - }, - "readinessGates": { - "description": "If specified, all readiness gates will be evaluated for pod readiness.\nA pod is ready when all its containers are ready AND\nall conditions specified in the readiness gates have status equal to \"True\"\nMore info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates", - "items": { - "description": "PodReadinessGate contains the reference to a pod condition", - "properties": { - "conditionType": { - "description": "ConditionType refers to a condition in the pod's condition list with matching type.", - "type": "string" - } - }, - "required": [ - "conditionType" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "resourceClaims": { - "description": "ResourceClaims defines which ResourceClaims must be allocated\nand reserved before the Pod is allowed to start. The resources\nwill be made available to those containers which consume them\nby name.\n\nThis is a stable field but requires that the\nDynamicResourceAllocation feature gate is enabled.\n\nThis field is immutable.", - "items": { - "description": "PodResourceClaim references exactly one ResourceClaim, either directly\nor by naming a ResourceClaimTemplate which is then turned into a ResourceClaim\nfor the pod.\n\nIt adds a name to it that uniquely identifies the ResourceClaim inside the Pod.\nContainers that need access to the ResourceClaim reference it with this name.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and this Pod\nbelongs to a PodGroup, a PodResourceClaim is matched to a\nPodGroupResourceClaim if all of their fields are equal (Name,\nResourceClaimName, and ResourceClaimTemplateName). A matched claim references\na single ResourceClaim shared across all Pods in the PodGroup, reserved for\nthe PodGroup in ResourceClaimStatus.ReservedFor rather than for individual\nPods.", - "properties": { - "name": { - "description": "Name uniquely identifies this resource claim inside the pod.\nThis must be a DNS_LABEL.", - "type": "string" - }, - "resourceClaimName": { - "description": "ResourceClaimName is the name of a ResourceClaim object in the same\nnamespace as this pod.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.", - "type": "string" - }, - "resourceClaimTemplateName": { - "description": "ResourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace as this pod.\n\nThe template will be used to create a new ResourceClaim, which will\nbe bound to this pod. When this pod is deleted, the ResourceClaim\nwill also be deleted. The pod name and resource name, along with a\ngenerated component, will be used to form a unique name for the\nResourceClaim, which will be recorded in pod.status.resourceClaimStatuses.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and the pod\nbelongs to a PodGroup that defines a PodGroupResourceClaim with the same\nName and ResourceClaimTemplateName, this PodResourceClaim resolves to the\nResourceClaim generated for the PodGroup. All pods in the group that\ndefine an equivalent PodResourceClaim matching the\nPodGroupResourceClaim's Name and ResourceClaimTemplateName share the same\ngenerated ResourceClaim. ResourceClaims generated for a PodGroup are\nowned by the PodGroup and their lifecycles are tied to the PodGroup\ninstead of any individual pod.\n\nThis field is immutable and no changes will be made to the\ncorresponding ResourceClaim by the control plane after creating the\nResourceClaim.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "resources": { - "description": "Resources is the total amount of CPU and Memory resources required by all\ncontainers in the pod. It supports specifying Requests and Limits for\n\"cpu\", \"memory\" and \"hugepages-\" resource names only. ResourceClaims are not supported.\n\nThis field enables fine-grained control over resource allocation for the\nentire pod, allowing resource sharing among containers in a pod.\n\nThis is an alpha field and requires enabling the PodLevelResources feature\ngate.", - "properties": { - "claims": { - "description": "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", - "items": { - "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.", - "properties": { - "name": { - "description": "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - "type": "string" - }, - "request": { - "description": "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "restartPolicy": { - "description": "Restart policy for all containers within the pod.\nOne of Always, OnFailure, Never. In some contexts, only a subset of those values may be permitted.\nDefault to Always.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy", - "type": "string" - }, - "runtimeClassName": { - "description": "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used\nto run this pod. If no RuntimeClass resource matches the named class, the pod will not be run.\nIf unset or empty, the \"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class", - "type": "string" - }, - "schedulerName": { - "description": "If specified, the pod will be dispatched by specified scheduler.\nIf not specified, the pod will be dispatched by default scheduler.", - "type": "string" - }, - "schedulingGates": { - "description": "SchedulingGates is an opaque list of values that if specified will block scheduling the pod.\nIf schedulingGates is not empty, the pod will stay in the SchedulingGated state and the\nscheduler will not attempt to schedule the pod.\n\nSchedulingGates can only be set at pod creation time, and be removed only afterwards.", - "items": { - "description": "PodSchedulingGate is associated to a Pod to guard its scheduling.", - "properties": { - "name": { - "description": "Name of the scheduling gate.\nEach scheduling gate must have a unique name field.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "schedulingGroup": { - "description": "SchedulingGroup provides a reference to the immediate scheduling runtime\ngrouping object that this Pod belongs to.\nThis field is used by the scheduler to identify the group and apply the\ncorrect group scheduling policies. The association with a group also\nimpacts other lifecycle aspects of a Pod that are relevant in a wider context\nof scheduling like preemption, resource attachment, etc. If not specified,\nthe Pod is treated as a single unit in all of these aspects.\nThe group object referenced by this field may not exist at the time the\nPod is created.\nThis field is immutable, but a group object with the same name may be\nrecreated with different policies. Doing this during pod scheduling\nmay result in the placement not conforming to the expected policies.", - "properties": { - "podGroupName": { - "description": "PodGroupName specifies the name of the standalone PodGroup object\nthat represents the runtime instance of this group.\nMust be a DNS subdomain.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "securityContext": { - "description": "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.", - "properties": { - "appArmorProfile": { - "description": "appArmorProfile is the AppArmor options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", - "type": "string" - }, - "type": { - "description": "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "fsGroup": { - "description": "A special supplemental group that applies to all containers in a pod.\nSome volume types allow the Kubelet to change the ownership of that volume\nto be owned by the pod:\n\n1. The owning GID will be the FSGroup\n2. The setgid bit is set (new files created in the volume will be owned by FSGroup)\n3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "fsGroupChangePolicy": { - "description": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume\nbefore being exposed inside Pod. This field will only apply to\nvolume types which support fsGroup based ownership(and permissions).\nIt will have no effect on ephemeral volume types such as: secret, configmaps\nand emptydir.\nValid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "runAsGroup": { - "description": "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "runAsNonRoot": { - "description": "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "boolean" - }, - "runAsUser": { - "description": "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", - "format": "int64", - "type": "integer" - }, - "seLinuxChangePolicy": { - "description": "seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.\nIt has no effect on nodes that do not support SELinux or to volumes does not support SELinux.\nValid values are \"MountOption\" and \"Recursive\".\n\n\"Recursive\" means relabeling of all files on all Pod volumes by the container runtime.\nThis may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.\n\n\"MountOption\" mounts all eligible Pod volumes with `-o context` mount option.\nThis requires all Pods that share the same volume to use the same SELinux label.\nIt is not possible to share the same volume among privileged and unprivileged Pods.\nEligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes\nwhose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their\nCSIDriver instance. Other volumes are always re-labelled recursively.\n\nIf not specified, \"MountOption\" is used.\n\nThis field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.\n\nAll Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "seLinuxOptions": { - "description": "The SELinux context to be applied to all containers.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in SecurityContext. If set in\nboth SecurityContext and PodSecurityContext, the value specified in SecurityContext\ntakes precedence for that container.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "level": { - "description": "Level is SELinux level label that applies to the container.", - "type": "string" - }, - "role": { - "description": "Role is a SELinux role label that applies to the container.", - "type": "string" - }, - "type": { - "description": "Type is a SELinux type label that applies to the container.", - "type": "string" - }, - "user": { - "description": "User is a SELinux user label that applies to the container.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "seccompProfile": { - "description": "The seccomp options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", - "properties": { - "localhostProfile": { - "description": "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - "type": "string" - }, - "type": { - "description": "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "supplementalGroups": { - "description": "A list of groups applied to the first process run in each container, in\naddition to the container's primary GID and fsGroup (if specified). If\nthe SupplementalGroupsPolicy feature is enabled, the\nsupplementalGroupsPolicy field determines whether these are in addition\nto or instead of any group memberships defined in the container image.\nIf unspecified, no additional groups are added, though group memberships\ndefined in the container image may still be used, depending on the\nsupplementalGroupsPolicy field.\nNote that this field cannot be set when spec.os.name is windows.", - "items": { - "format": "int64", - "type": "integer" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "supplementalGroupsPolicy": { - "description": "Defines how supplemental groups of the first container processes are calculated.\nValid values are \"Merge\" and \"Strict\". If not specified, \"Merge\" is used.\n(Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled\nand the container runtime must implement support for this feature.\nNote that this field cannot be set when spec.os.name is windows.", - "type": "string" - }, - "sysctls": { - "description": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", - "items": { - "description": "Sysctl defines a kernel parameter to be set", - "properties": { - "name": { - "description": "Name of a property to set", - "type": "string" - }, - "value": { - "description": "Value of a property to set", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "windowsOptions": { - "description": "The Windows specific settings applied to all containers.\nIf unspecified, the options within a container's SecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", - "properties": { - "gmsaCredentialSpec": { - "description": "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", - "type": "string" - }, - "gmsaCredentialSpecName": { - "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use.", - "type": "string" - }, - "hostProcess": { - "description": "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", - "type": "boolean" - }, - "runAsUserName": { - "description": "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "serviceAccount": { - "description": "DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.\nDeprecated: Use serviceAccountName instead.", - "type": "string" - }, - "serviceAccountName": { - "description": "ServiceAccountName is the name of the ServiceAccount to use to run this pod.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/", - "type": "string" - }, - "setHostnameAsFQDN": { - "description": "If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default).\nIn Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname).\nIn Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters to FQDN.\nIf a pod does not have FQDN, this has no effect.\nDefault to false.", - "type": "boolean" - }, - "shareProcessNamespace": { - "description": "Share a single process namespace between all of the containers in a pod.\nWhen this is set containers will be able to view and signal processes from other containers\nin the same pod, and the first process in each container will not be assigned PID 1.\nHostPID and ShareProcessNamespace cannot both be set.\nOptional: Default to false.", - "type": "boolean" - }, - "subdomain": { - "description": "If specified, the fully qualified Pod hostname will be \"...svc.\".\nIf not specified, the pod will not have a domainname at all.", - "type": "string" - }, - "terminationGracePeriodSeconds": { - "description": "Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nIf this value is nil, the default grace period will be used instead.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nDefaults to 30 seconds.", - "format": "int64", - "type": "integer" - }, - "tolerations": { - "description": "If specified, the pod's tolerations.", - "items": { - "description": "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", - "properties": { - "effect": { - "description": "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", - "type": "string" - }, - "key": { - "description": "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", - "type": "string" - }, - "operator": { - "description": "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", - "type": "string" - }, - "tolerationSeconds": { - "description": "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", - "format": "int64", - "type": "integer" - }, - "value": { - "description": "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "topologySpreadConstraints": { - "description": "TopologySpreadConstraints describes how a group of pods ought to spread across topology\ndomains. Scheduler will schedule pods in a way which abides by the constraints.\nAll topologySpreadConstraints are ANDed.", - "items": { - "description": "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", - "properties": { - "labelSelector": { - "description": "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "matchLabelKeys": { - "description": "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "maxSkew": { - "description": "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", - "format": "int32", - "type": "integer" - }, - "minDomains": { - "description": "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", - "format": "int32", - "type": "integer" - }, - "nodeAffinityPolicy": { - "description": "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", - "type": "string" - }, - "nodeTaintsPolicy": { - "description": "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", - "type": "string" - }, - "topologyKey": { - "description": "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", - "type": "string" - }, - "whenUnsatisfiable": { - "description": "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", - "type": "string" - } - }, - "required": [ - "maxSkew", - "topologyKey", - "whenUnsatisfiable" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "topologyKey", - "whenUnsatisfiable" - ], - "x-kubernetes-list-type": "map" - }, - "volumes": { - "description": "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes", - "items": { - "description": "Volume represents a named volume in a pod that may be accessed by any container in the pod.", - "properties": { - "awsElasticBlockStore": { - "description": "awsElasticBlockStore represents an AWS Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nDeprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree\nawsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", - "properties": { - "fsType": { - "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", - "type": "string" - }, - "partition": { - "description": "partition is the partition in the volume that you want to mount.\nIf omitted, the default is to mount by volume name.\nExamples: For volume /dev/sda1, you specify the partition as \"1\".\nSimilarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).", - "format": "int32", - "type": "integer" - }, - "readOnly": { - "description": "readOnly value true will force the readOnly setting in VolumeMounts.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", - "type": "boolean" - }, - "volumeID": { - "description": "volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume).\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore", - "type": "string" - } - }, - "required": [ - "volumeID" - ], - "type": "object", - "additionalProperties": false - }, - "azureDisk": { - "description": "azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.\nDeprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type\nare redirected to the disk.csi.azure.com CSI driver.", - "properties": { - "cachingMode": { - "description": "cachingMode is the Host Caching mode: None, Read Only, Read Write.", - "type": "string" - }, - "diskName": { - "description": "diskName is the Name of the data disk in the blob storage", - "type": "string" - }, - "diskURI": { - "description": "diskURI is the URI of data disk in the blob storage", - "type": "string" - }, - "fsType": { - "default": "ext4", - "description": "fsType is Filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "kind": { - "description": "kind expected values are Shared: multiple blob disks per storage account Dedicated: single blob disk per storage account Managed: azure managed data disk (only in managed availability set). defaults to shared", - "type": "string" - }, - "readOnly": { - "default": false, - "description": "readOnly Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - } - }, - "required": [ - "diskName", - "diskURI" - ], - "type": "object", - "additionalProperties": false - }, - "azureFile": { - "description": "azureFile represents an Azure File Service mount on the host and bind mount to the pod.\nDeprecated: AzureFile is deprecated. All operations for the in-tree azureFile type\nare redirected to the file.csi.azure.com CSI driver.", - "properties": { - "readOnly": { - "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "secretName": { - "description": "secretName is the name of secret that contains Azure Storage Account Name and Key", - "type": "string" - }, - "shareName": { - "description": "shareName is the azure share Name", - "type": "string" - } - }, - "required": [ - "secretName", - "shareName" - ], - "type": "object", - "additionalProperties": false - }, - "cephfs": { - "description": "cephFS represents a Ceph FS mount on the host that shares a pod's lifetime.\nDeprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported.", - "properties": { - "monitors": { - "description": "monitors is Required: Monitors is a collection of Ceph monitors\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "path": { - "description": "path is Optional: Used as the mounted root, rather than the full Ceph tree, default is /", - "type": "string" - }, - "readOnly": { - "description": "readOnly is Optional: Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "type": "boolean" - }, - "secretFile": { - "description": "secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "type": "string" - }, - "secretRef": { - "description": "secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty.\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "user": { - "description": "user is optional: User is the rados user name, default is admin\nMore info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it", - "type": "string" - } - }, - "required": [ - "monitors" - ], - "type": "object", - "additionalProperties": false - }, - "cinder": { - "description": "cinder represents a cinder volume attached and mounted on kubelets host machine.\nDeprecated: Cinder is deprecated. All operations for the in-tree cinder type\nare redirected to the cinder.csi.openstack.org CSI driver.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", - "properties": { - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", - "type": "string" - }, - "readOnly": { - "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef is optional: points to a secret object containing parameters used to connect\nto OpenStack.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "volumeID": { - "description": "volumeID used to identify the volume in cinder.\nMore info: https://examples.k8s.io/mysql-cinder-pd/README.md", - "type": "string" - } - }, - "required": [ - "volumeID" - ], - "type": "object", - "additionalProperties": false - }, - "configMap": { - "description": "configMap represents a configMap that should populate this volume", - "properties": { - "defaultMode": { - "description": "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "defaultUser": { - "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "items": { - "description": "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", - "items": { - "description": "Maps a string key to a path within a volume.", - "properties": { - "key": { - "description": "key is the key to project.", - "type": "string" - }, - "mode": { - "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "key", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "optional specify whether the ConfigMap or its keys must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "csi": { - "description": "csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.", - "properties": { - "driver": { - "description": "driver is the name of the CSI driver that handles this volume.\nConsult with your admin for the correct name as registered in the cluster.", - "type": "string" - }, - "fsType": { - "description": "fsType to mount. Ex. \"ext4\", \"xfs\", \"ntfs\".\nIf not provided, the empty value is passed to the associated CSI driver\nwhich will determine the default filesystem to apply.", - "type": "string" - }, - "nodePublishSecretRef": { - "description": "nodePublishSecretRef is a reference to the secret object containing\nsensitive information to pass to the CSI driver to complete the CSI\nNodePublishVolume and NodeUnpublishVolume calls.\nThis field is optional, and may be empty if no secret is required. If the\nsecret object contains more than one secret, all secret references are passed.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "readOnly": { - "description": "readOnly specifies a read-only configuration for the volume.\nDefaults to false (read/write).", - "type": "boolean" - }, - "volumeAttributes": { - "additionalProperties": { - "type": "string" - }, - "description": "volumeAttributes stores driver-specific properties that are passed to the CSI\ndriver. Consult your driver's documentation for supported values.", - "type": "object" - } - }, - "required": [ - "driver" - ], - "type": "object", - "additionalProperties": false - }, - "downwardAPI": { - "description": "downwardAPI represents downward API about the pod that should populate this volume", - "properties": { - "defaultMode": { - "description": "Optional: mode bits to use on created files by default. Must be a\nOptional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "defaultUser": { - "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "items": { - "description": "Items is a list of downward API volume file", - "items": { - "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field", - "properties": { - "fieldRef": { - "description": "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "mode": { - "description": "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", - "type": "string" - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "emptyDir": { - "description": "emptyDir represents a temporary directory that shares a pod's lifetime.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", - "properties": { - "medium": { - "description": "medium represents what type of storage medium should back this directory.\nThe default is \"\" which means to use the node's default medium.\nMust be an empty string (default) or Memory.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", - "type": "string" - }, - "mode": { - "description": "mode specifies the permission bits for the emptyDir directory, in numeric\nnotation (e.g., 0755, 01777). Must be a value between 0000 and 01777.\nIf not specified, defaults to 0777.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup. If fsGroup is specified, the fsGroup permissions\nwill override the mode specified here.\nThis field has no effect on Windows.\nThis field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.", - "format": "int32", - "type": "integer" - }, - "sizeLimit": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "sizeLimit is the total amount of local storage required for this EmptyDir volume.\nThe size limit is also applicable for memory medium.\nThe maximum usage on memory medium EmptyDir would be the minimum value between\nthe SizeLimit specified here and the sum of memory limits of all containers in a pod.\nThe default is nil which means that the limit is undefined.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - } - }, - "type": "object", - "additionalProperties": false - }, - "ephemeral": { - "description": "ephemeral represents a volume that is handled by a cluster storage driver.\nThe volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,\nand deleted when the pod is removed.\n\nUse this if:\na) the volume is only needed while the pod runs,\nb) features of normal volumes like restoring from snapshot or capacity\n tracking are needed,\nc) the storage driver is specified through a storage class, and\nd) the storage driver supports dynamic volume provisioning through\n a PersistentVolumeClaim (see EphemeralVolumeSource for more\n information on the connection between this volume type\n and PersistentVolumeClaim).\n\nUse PersistentVolumeClaim or one of the vendor-specific\nAPIs for volumes that persist for longer than the lifecycle\nof an individual pod.\n\nUse CSI for light-weight local ephemeral volumes if the CSI driver is meant to\nbe used that way - see the documentation of the driver for\nmore information.\n\nA pod can use both types of ephemeral volumes and\npersistent volumes at the same time.", - "properties": { - "volumeClaimTemplate": { - "description": "Will be used to create a stand-alone PVC to provision the volume.\nThe pod in which this EphemeralVolumeSource is embedded will be the\nowner of the PVC, i.e. the PVC will be deleted together with the\npod. The name of the PVC will be `-` where\n`` is the name from the `PodSpec.Volumes` array\nentry. Pod validation will reject the pod if the concatenated name\nis not valid for a PVC (for example, too long).\n\nAn existing PVC with that name that is not owned by the pod\nwill *not* be used for the pod to avoid using an unrelated\nvolume by mistake. Starting the pod is then blocked until\nthe unrelated PVC is removed. If such a pre-created PVC is\nmeant to be used by the pod, the PVC has to updated with an\nowner reference to the pod once the pod exists. Normally\nthis should not be necessary, but it may be useful when\nmanually reconstructing a broken cluster.\n\nThis field is read-only and no changes will be made by Kubernetes\nto the PVC after it has been created.\n\nRequired, must not be nil.", - "properties": { - "metadata": { - "description": "May contain labels and annotations that will be copied into the PVC\nwhen creating it. No other fields are allowed and will be rejected during\nvalidation.", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "finalizers": { - "items": { - "type": "string" - }, - "type": "array" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "name": { - "type": "string" - }, - "namespace": { - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "spec": { - "description": "The specification for the PersistentVolumeClaim. The entire content is\ncopied unchanged into the PVC that gets created from this\ntemplate. The same fields as in a PersistentVolumeClaim\nare also valid here.", - "properties": { - "accessModes": { - "description": "accessModes contains the desired access modes the volume should have.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "dataSource": { - "description": "dataSource field can be used to specify either:\n* An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)\n* An existing PVC (PersistentVolumeClaim)\nIf the provisioner or an external controller can support the specified data source,\nit will create a new volume based on the contents of the specified data source.\ndataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be\ncopied to dataSource when dataSourceRef.namespace is not specified.\nIf the namespace is specified, then dataSourceRef will not be copied to dataSource.", - "properties": { - "apiGroup": { - "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", - "type": "string" - }, - "kind": { - "description": "Kind is the type of resource being referenced", - "type": "string" - }, - "name": { - "description": "Name is the name of resource being referenced", - "type": "string" - } - }, - "required": [ - "kind", - "name" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "dataSourceRef": { - "description": "dataSourceRef specifies the object from which to populate the volume with data, if a non-empty\nvolume is desired. This may be any object from a non-empty API group (non\ncore object) or a PersistentVolumeClaim object.\nWhen this field is specified, volume binding will only succeed if the type of\nthe specified object matches some installed volume populator or dynamic\nprovisioner.\nThis field will replace the functionality of the dataSource field and as such\nif both fields are non-empty, they must have the same value. For backwards\ncompatibility, when namespace isn't specified in dataSourceRef,\nboth fields (dataSource and dataSourceRef) will be set to the same\nvalue automatically if one of them is empty and the other is non-empty.\nWhen namespace is specified in dataSourceRef,\ndataSource isn't set to the same value and must be empty.\nThere are three important differences between dataSource and dataSourceRef:\n* While dataSource only allows two specific types of objects, dataSourceRef\n allows any non-core object, as well as PersistentVolumeClaim objects.\n* While dataSource ignores disallowed values (dropping them), dataSourceRef\n preserves all values, and generates an error if a disallowed value is\n specified.\n* While dataSource only allows local objects, dataSourceRef allows objects\n in any namespaces.\n(Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", - "properties": { - "apiGroup": { - "description": "APIGroup is the group for the resource being referenced.\nIf APIGroup is not specified, the specified Kind must be in the core API group.\nFor any other third-party types, APIGroup is required.", - "type": "string" - }, - "kind": { - "description": "Kind is the type of resource being referenced", - "type": "string" - }, - "name": { - "description": "Name is the name of resource being referenced", - "type": "string" - }, - "namespace": { - "description": "Namespace is the namespace of resource being referenced\nNote that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n(Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.", - "type": "string" - } - }, - "required": [ - "kind", - "name" - ], - "type": "object", - "additionalProperties": false - }, - "resources": { - "description": "resources represents the minimum resources the volume should have.\nUsers are allowed to specify resource requirements\nthat are lower than previous value but must still be higher than capacity recorded in the\nstatus field of the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources", - "properties": { - "limits": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - }, - "requests": { - "additionalProperties": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "description": "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "selector": { - "description": "selector is a label query over volumes to consider for binding.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "storageClassName": { - "description": "storageClassName is the name of the StorageClass required by the claim.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1", - "type": "string" - }, - "volumeAttributesClassName": { - "description": "volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.\nIf specified, the CSI driver will create or update the volume with the attributes defined\nin the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,\nit can be changed after the claim is created. An empty string or nil value indicates that no\nVolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,\nthis field can be reset to its previous value (including nil) to cancel the modification.\nIf the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be\nset to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource\nexists.\nMore info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/", - "type": "string" - }, - "volumeMode": { - "description": "volumeMode defines what type of volume is required by the claim.\nValue of Filesystem is implied when not included in claim spec.", - "type": "string" - }, - "volumeName": { - "description": "volumeName is the binding reference to the PersistentVolume backing this claim.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "spec" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "fc": { - "description": "fc represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.", - "properties": { - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "lun": { - "description": "lun is Optional: FC target lun number", - "format": "int32", - "type": "integer" - }, - "readOnly": { - "description": "readOnly is Optional: Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "targetWWNs": { - "description": "targetWWNs is Optional: FC target worldwide names (WWNs)", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "wwids": { - "description": "wwids Optional: FC volume world wide identifiers (wwids)\nEither wwids or combination of targetWWNs and lun must be set, but not both simultaneously.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "flexVolume": { - "description": "flexVolume represents a generic volume resource that is\nprovisioned/attached using an exec based plugin.\nDeprecated: FlexVolume is deprecated. Consider using a CSIDriver instead.", - "properties": { - "driver": { - "description": "driver is the name of the driver to use for this volume.", - "type": "string" - }, - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". The default filesystem depends on FlexVolume script.", - "type": "string" - }, - "options": { - "additionalProperties": { - "type": "string" - }, - "description": "options is Optional: this field holds extra command options if any.", - "type": "object" - }, - "readOnly": { - "description": "readOnly is Optional: defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef is Optional: secretRef is reference to the secret object containing\nsensitive information to pass to the plugin scripts. This may be\nempty if no secret object is specified. If the secret object\ncontains more than one secret, all secrets are passed to the plugin\nscripts.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "required": [ - "driver" - ], - "type": "object", - "additionalProperties": false - }, - "flocker": { - "description": "flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running.\nDeprecated: Flocker is deprecated and the in-tree flocker type is no longer supported.", - "properties": { - "datasetName": { - "description": "datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker\nshould be considered as deprecated", - "type": "string" - }, - "datasetUUID": { - "description": "datasetUUID is the UUID of the dataset. This is unique identifier of a Flocker dataset", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "gcePersistentDisk": { - "description": "gcePersistentDisk represents a GCE Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nDeprecated: GCEPersistentDisk is deprecated. All operations for the in-tree\ngcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "properties": { - "fsType": { - "description": "fsType is filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "type": "string" - }, - "partition": { - "description": "partition is the partition in the volume that you want to mount.\nIf omitted, the default is to mount by volume name.\nExamples: For volume /dev/sda1, you specify the partition as \"1\".\nSimilarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "format": "int32", - "type": "integer" - }, - "pdName": { - "description": "pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk", - "type": "boolean" - } - }, - "required": [ - "pdName" - ], - "type": "object", - "additionalProperties": false - }, - "gitRepo": { - "description": "gitRepo represents a git repository at a particular revision.\nDeprecated: GitRepo is deprecated. To provision a container with a git repo, mount an\nEmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir\ninto the Pod's container.", - "properties": { - "directory": { - "description": "directory is the target directory name.\nMust not contain or start with '..'. If '.' is supplied, the volume directory will be the\ngit repository. Otherwise, if specified, the volume will contain the git repository in\nthe subdirectory with the given name.", - "type": "string" - }, - "repository": { - "description": "repository is the URL", - "type": "string" - }, - "revision": { - "description": "revision is the commit hash for the specified revision.", - "type": "string" - } - }, - "required": [ - "repository" - ], - "type": "object", - "additionalProperties": false - }, - "glusterfs": { - "description": "glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.\nDeprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.", - "properties": { - "endpoints": { - "description": "endpoints is the endpoint name that details Glusterfs topology.", - "type": "string" - }, - "path": { - "description": "path is the Glusterfs volume path.\nMore info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the Glusterfs volume to be mounted with read-only permissions.\nDefaults to false.\nMore info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod", - "type": "boolean" - } - }, - "required": [ - "endpoints", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "hostPath": { - "description": "hostPath represents a pre-existing file or directory on the host\nmachine that is directly exposed to the container. This is generally\nused for system agents or other privileged things that are allowed\nto see the host machine. Most containers will NOT need this.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", - "properties": { - "path": { - "description": "path of the directory on the host.\nIf the path is a symlink, it will follow the link to the real path.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", - "type": "string" - }, - "type": { - "description": "type for HostPath Volume\nDefaults to \"\"\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath", - "type": "string" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - }, - "image": { - "description": "image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.\nThe volume is resolved at pod startup depending on which PullPolicy value is provided:\n\n- Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\n- Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\n- IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\n\nThe volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.\nA failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.\nThe types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.\nThe OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.\nThe volume will be mounted read-only (ro).\nSub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.\nThe field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.", - "properties": { - "pullPolicy": { - "description": "Policy for pulling OCI objects. Possible values are:\nAlways: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\nNever: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\nIfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.", - "type": "string" - }, - "reference": { - "description": "Required: Image or artifact reference to be used.\nBehaves in the same way as pod.spec.containers[*].image.\nPull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "iscsi": { - "description": "iscsi represents an ISCSI Disk resource that is attached to a\nkubelet's host machine and then exposed to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi", - "properties": { - "chapAuthDiscovery": { - "description": "chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication", - "type": "boolean" - }, - "chapAuthSession": { - "description": "chapAuthSession defines whether support iSCSI Session CHAP authentication", - "type": "boolean" - }, - "fsType": { - "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi", - "type": "string" - }, - "initiatorName": { - "description": "initiatorName is the custom iSCSI Initiator Name.\nIf initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface\n: will be created for the connection.", - "type": "string" - }, - "iqn": { - "description": "iqn is the target iSCSI Qualified Name.", - "type": "string" - }, - "iscsiInterface": { - "default": "default", - "description": "iscsiInterface is the interface Name that uses an iSCSI transport.\nDefaults to 'default' (tcp).", - "type": "string" - }, - "lun": { - "description": "lun represents iSCSI Target Lun number.", - "format": "int32", - "type": "integer" - }, - "portals": { - "description": "portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port\nis other than default (typically TCP ports 860 and 3260).", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "readOnly": { - "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef is the CHAP Secret for iSCSI target and initiator authentication", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "targetPortal": { - "description": "targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port\nis other than default (typically TCP ports 860 and 3260).", - "type": "string" - } - }, - "required": [ - "iqn", - "lun", - "targetPortal" - ], - "type": "object", - "additionalProperties": false - }, - "name": { - "description": "name of the volume.\nMust be a DNS_LABEL and unique within the pod.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "nfs": { - "description": "nfs represents an NFS mount on the host that shares a pod's lifetime\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", - "properties": { - "path": { - "description": "path that is exported by the NFS server.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the NFS export to be mounted with read-only permissions.\nDefaults to false.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", - "type": "boolean" - }, - "server": { - "description": "server is the hostname or IP address of the NFS server.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#nfs", - "type": "string" - } - }, - "required": [ - "path", - "server" - ], - "type": "object", - "additionalProperties": false - }, - "persistentVolumeClaim": { - "description": "persistentVolumeClaimVolumeSource represents a reference to a\nPersistentVolumeClaim in the same namespace.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", - "properties": { - "claimName": { - "description": "claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", - "type": "string" - }, - "readOnly": { - "description": "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.", - "type": "boolean" - } - }, - "required": [ - "claimName" - ], - "type": "object", - "additionalProperties": false - }, - "photonPersistentDisk": { - "description": "photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine.\nDeprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported.", - "properties": { - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "pdID": { - "description": "pdID is the ID that identifies Photon Controller persistent disk", - "type": "string" - } - }, - "required": [ - "pdID" - ], - "type": "object", - "additionalProperties": false - }, - "portworxVolume": { - "description": "portworxVolume represents a portworx volume attached and mounted on kubelets host machine.\nDeprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type\nare redirected to the pxd.portworx.com CSI driver.", - "properties": { - "fsType": { - "description": "fSType represents the filesystem type to mount\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "readOnly": { - "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "volumeID": { - "description": "volumeID uniquely identifies a Portworx volume", - "type": "string" - } - }, - "required": [ - "volumeID" - ], - "type": "object", - "additionalProperties": false - }, - "projected": { - "description": "projected items for all in one resources secrets, configmaps, and downward API", - "properties": { - "defaultMode": { - "description": "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "defaultUser": { - "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "sources": { - "description": "sources is the list of volume projections. Each entry in this list\nhandles one source.", - "items": { - "description": "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", - "properties": { - "clusterTrustBundle": { - "description": "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field\nof ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the\ncombination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written\ninto the pod filesystem. Esoteric PEM features such as inter-block\ncomments and block headers are stripped. Certificates are deduplicated.\nThe ordering of certificates within the file is arbitrary, and Kubelet\nmay change the order over time.", - "properties": { - "labelSelector": { - "description": "Select all ClusterTrustBundles that match this label selector. Only has\neffect if signerName is set. Mutually-exclusive with name. If unset,\ninterpreted as \"match nothing\". If set but empty, interpreted as \"match\neverything\".", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "name": { - "description": "Select a single ClusterTrustBundle by object name. Mutually-exclusive\nwith signerName and labelSelector.", - "type": "string" - }, - "optional": { - "description": "If true, don't block pod startup if the referenced ClusterTrustBundle(s)\naren't available. If using name, then the named ClusterTrustBundle is\nallowed not to exist. If using signerName, then the combination of\nsignerName and labelSelector is allowed to match zero\nClusterTrustBundles.", - "type": "boolean" - }, - "path": { - "description": "Relative path from the volume root to write the bundle.", - "type": "string" - }, - "signerName": { - "description": "Select all ClusterTrustBundles that match this signer name.\nMutually-exclusive with name. The contents of all selected\nClusterTrustBundles will be unified and deduplicated.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - }, - "configMap": { - "description": "configMap information about the configMap data to project", - "properties": { - "items": { - "description": "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", - "items": { - "description": "Maps a string key to a path within a volume.", - "properties": { - "key": { - "description": "key is the key to project.", - "type": "string" - }, - "mode": { - "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "key", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "optional specify whether the ConfigMap or its keys must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "downwardAPI": { - "description": "downwardAPI information about the downwardAPI data to project", - "properties": { - "items": { - "description": "Items is a list of DownwardAPIVolume file", - "items": { - "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field", - "properties": { - "fieldRef": { - "description": "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", - "properties": { - "apiVersion": { - "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", - "type": "string" - }, - "fieldPath": { - "description": "Path of the field to select in the specified API version.", - "type": "string" - } - }, - "required": [ - "fieldPath" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "mode": { - "description": "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", - "type": "string" - }, - "resourceFieldRef": { - "description": "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", - "properties": { - "containerName": { - "description": "Container name: required for volumes, optional for env vars", - "type": "string" - }, - "divisor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "Specifies the output format of the exposed resources, defaults to \"1\"", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "resource": { - "description": "Required: resource to select", - "type": "string" - } - }, - "required": [ - "resource" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "podCertificate": { - "description": "Projects an auto-rotating credential bundle (private key and certificate\nchain) that the pod can use either as a TLS client or server.\n\nKubelet generates a private key and uses it to send a\nPodCertificateRequest to the named signer. Once the signer approves the\nrequest and issues a certificate chain, Kubelet writes the key and\ncertificate chain to the pod filesystem. The pod does not start until\ncertificates have been issued for each podCertificate projected volume\nsource in its spec.\n\nKubelet will begin trying to rotate the certificate at the time indicated\nby the signer using the PodCertificateRequest.Status.BeginRefreshAt\ntimestamp.\n\nKubelet can write a single file, indicated by the credentialBundlePath\nfield, or separate files, indicated by the keyPath and\ncertificateChainPath fields.\n\nThe credential bundle is a single file in PEM format. The first PEM\nentry is the private key (in PKCS#8 format), and the remaining PEM\nentries are the certificate chain issued by the signer (typically,\nsigners will return their certificate chain in leaf-to-root order).\n\nPrefer using the credential bundle format, since your application code\ncan read it atomically. If you use keyPath and certificateChainPath,\nyour application must make two separate file reads. If these coincide\nwith a certificate rotation, it is possible that the private key and leaf\ncertificate you read may not correspond to each other. Your application\nwill need to check for this condition, and re-read until they are\nconsistent.\n\nThe named signer controls chooses the format of the certificate it\nissues; consult the signer implementation's documentation to learn how to\nuse the certificates it issues.", - "properties": { - "certificateChainPath": { - "description": "Write the certificate chain at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", - "type": "string" - }, - "credentialBundlePath": { - "description": "Write the credential bundle at this path in the projected volume.\n\nThe credential bundle is a single file that contains multiple PEM blocks.\nThe first PEM block is a PRIVATE KEY block, containing a PKCS#8 private\nkey.\n\nThe remaining blocks are CERTIFICATE blocks, containing the issued\ncertificate chain from the signer (leaf and any intermediates).\n\nUsing credentialBundlePath lets your Pod's application code make a single\natomic read that retrieves a consistent key and certificate chain. If you\nproject them to separate files, your application code will need to\nadditionally check that the leaf certificate was issued to the key.", - "type": "string" - }, - "keyPath": { - "description": "Write the key at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", - "type": "string" - }, - "keyType": { - "description": "The type of keypair Kubelet will generate for the pod.\n\nValid values are \"RSA3072\", \"RSA4096\", \"ECDSAP256\", \"ECDSAP384\",\n\"ECDSAP521\", and \"ED25519\".", - "type": "string" - }, - "maxExpirationSeconds": { - "description": "maxExpirationSeconds is the maximum lifetime permitted for the\ncertificate.\n\nKubelet copies this value verbatim into the PodCertificateRequests it\ngenerates for this projection.\n\nIf omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver\nwill reject values shorter than 3600 (1 hour). The maximum allowable\nvalue is 7862400 (91 days).\n\nThe signer implementation is then free to issue a certificate with any\nlifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600\nseconds (1 hour). This constraint is enforced by kube-apiserver.\n`kubernetes.io` signers will never issue certificates with a lifetime\nlonger than 24 hours.", - "format": "int32", - "type": "integer" - }, - "signerName": { - "description": "Kubelet's generated CSRs will be addressed to this signer.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "userAnnotations": { - "additionalProperties": { - "type": "string" - }, - "description": "userAnnotations allow pod authors to pass additional information to\nthe signer implementation. Kubernetes does not restrict or validate this\nmetadata in any way.\n\nThese values are copied verbatim into the `spec.unverifiedUserAnnotations` field of\nthe PodCertificateRequest objects that Kubelet creates.\n\nEntries are subject to the same validation as object metadata annotations,\nwith the addition that all keys must be domain-prefixed. No restrictions\nare placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support. Signers should\ndeny requests that contain keys they do not recognize.", - "type": "object" - } - }, - "required": [ - "keyType", - "signerName" - ], - "type": "object", - "additionalProperties": false - }, - "secret": { - "description": "secret information about the secret data to project", - "properties": { - "items": { - "description": "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", - "items": { - "description": "Maps a string key to a path within a volume.", - "properties": { - "key": { - "description": "key is the key to project.", - "type": "string" - }, - "mode": { - "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "key", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "optional field specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "serviceAccountToken": { - "description": "serviceAccountToken is information about the serviceAccountToken data to project", - "properties": { - "audience": { - "description": "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", - "type": "string" - }, - "expirationSeconds": { - "description": "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", - "format": "int64", - "type": "integer" - }, - "path": { - "description": "path is the path relative to the mount point of the file to project the\ntoken into.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "path" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "quobyte": { - "description": "quobyte represents a Quobyte mount on the host that shares a pod's lifetime.\nDeprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported.", - "properties": { - "group": { - "description": "group to map volume access to\nDefault is no group", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the Quobyte volume to be mounted with read-only permissions.\nDefaults to false.", - "type": "boolean" - }, - "registry": { - "description": "registry represents a single or multiple Quobyte Registry services\nspecified as a string as host:port pair (multiple entries are separated with commas)\nwhich acts as the central registry for volumes", - "type": "string" - }, - "tenant": { - "description": "tenant owning the given Quobyte volume in the Backend\nUsed with dynamically provisioned Quobyte volumes, value is set by the plugin", - "type": "string" - }, - "user": { - "description": "user to map volume access to\nDefaults to serivceaccount user", - "type": "string" - }, - "volume": { - "description": "volume is a string that references an already created Quobyte volume by name.", - "type": "string" - } - }, - "required": [ - "registry", - "volume" - ], - "type": "object", - "additionalProperties": false - }, - "rbd": { - "description": "rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.\nDeprecated: RBD is deprecated and the in-tree rbd type is no longer supported.", - "properties": { - "fsType": { - "description": "fsType is the filesystem type of the volume that you want to mount.\nTip: Ensure that the filesystem type is supported by the host operating system.\nExamples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#rbd", - "type": "string" - }, - "image": { - "description": "image is the rados image name.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "string" - }, - "keyring": { - "default": "/etc/ceph/keyring", - "description": "keyring is the path to key ring for RBDUser.\nDefault is /etc/ceph/keyring.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "string" - }, - "monitors": { - "description": "monitors is a collection of Ceph monitors.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "pool": { - "default": "rbd", - "description": "pool is the rados pool name.\nDefault is rbd.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "string" - }, - "readOnly": { - "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef is name of the authentication secret for RBDUser. If provided\noverrides keyring.\nDefault is nil.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "user": { - "default": "admin", - "description": "user is the rados user name.\nDefault is admin.\nMore info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it", - "type": "string" - } - }, - "required": [ - "image", - "monitors" - ], - "type": "object", - "additionalProperties": false - }, - "scaleIO": { - "description": "scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.\nDeprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported.", - "properties": { - "fsType": { - "default": "xfs", - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\".\nDefault is \"xfs\".", - "type": "string" - }, - "gateway": { - "description": "gateway is the host address of the ScaleIO API Gateway.", - "type": "string" - }, - "protectionDomain": { - "description": "protectionDomain is the name of the ScaleIO Protection Domain for the configured storage.", - "type": "string" - }, - "readOnly": { - "description": "readOnly Defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef references to the secret for ScaleIO user and other\nsensitive information. If this is not provided, Login operation will fail.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "sslEnabled": { - "description": "sslEnabled Flag enable/disable SSL communication with Gateway, default false", - "type": "boolean" - }, - "storageMode": { - "default": "ThinProvisioned", - "description": "storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.\nDefault is ThinProvisioned.", - "type": "string" - }, - "storagePool": { - "description": "storagePool is the ScaleIO Storage Pool associated with the protection domain.", - "type": "string" - }, - "system": { - "description": "system is the name of the storage system as configured in ScaleIO.", - "type": "string" - }, - "volumeName": { - "description": "volumeName is the name of a volume already created in the ScaleIO system\nthat is associated with this volume source.", - "type": "string" - } - }, - "required": [ - "gateway", - "secretRef", - "system" - ], - "type": "object", - "additionalProperties": false - }, - "secret": { - "description": "secret represents a secret that should populate this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", - "properties": { - "defaultMode": { - "description": "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "defaultUser": { - "description": "defaultUser is Optional: The owner UID of the created files by default.\nThe defaultUser field is only used as a fallback when the item-level user field is unset.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - }, - "items": { - "description": "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", - "items": { - "description": "Maps a string key to a path within a volume.", - "properties": { - "key": { - "description": "key is the key to project.", - "type": "string" - }, - "mode": { - "description": "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", - "format": "int32", - "type": "integer" - }, - "path": { - "description": "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", - "type": "string" - }, - "user": { - "description": "user is Optional: The owner UID of the created file.\nIf specified, the item-level user field takes precedence over defaultUser.\n(Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.", - "format": "int64", - "type": "integer" - } - }, - "required": [ - "key", - "path" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "optional": { - "description": "optional field specify whether the Secret or its keys must be defined", - "type": "boolean" - }, - "secretName": { - "description": "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "storageos": { - "description": "storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.\nDeprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported.", - "properties": { - "fsType": { - "description": "fsType is the filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "readOnly": { - "description": "readOnly defaults to false (read/write). ReadOnly here will force\nthe ReadOnly setting in VolumeMounts.", - "type": "boolean" - }, - "secretRef": { - "description": "secretRef specifies the secret to use for obtaining the StorageOS API\ncredentials. If not specified, default values will be attempted.", - "properties": { - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "volumeName": { - "description": "volumeName is the human-readable name of the StorageOS volume. Volume\nnames are only unique within a namespace.", - "type": "string" - }, - "volumeNamespace": { - "description": "volumeNamespace specifies the scope of the volume within StorageOS. If no\nnamespace is specified then the Pod's namespace will be used. This allows the\nKubernetes name scoping to be mirrored within StorageOS for tighter integration.\nSet VolumeName to any name to override the default behaviour.\nSet to \"default\" if you are not using namespaces within StorageOS.\nNamespaces that do not pre-exist within StorageOS will be created.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "vsphereVolume": { - "description": "vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine.\nDeprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type\nare redirected to the csi.vsphere.vmware.com CSI driver.", - "properties": { - "fsType": { - "description": "fsType is filesystem type to mount.\nMust be a filesystem type supported by the host operating system.\nEx. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.", - "type": "string" - }, - "storagePolicyID": { - "description": "storagePolicyID is the storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName.", - "type": "string" - }, - "storagePolicyName": { - "description": "storagePolicyName is the storage Policy Based Management (SPBM) profile name.", - "type": "string" - }, - "volumePath": { - "description": "volumePath is the path that identifies vSphere volume vmdk", - "type": "string" - } - }, - "required": [ - "volumePath" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - } - }, - "required": [ - "containers" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "workerTemplate" - ], - "type": "object", - "additionalProperties": false - }, - "networkConfig": { - "description": "networkConfig defines the network configuration of the group", - "properties": { - "subdomainPolicy": { - "description": "subdomainPolicy determines the policy that will be used when creating\nthe headless service, defaults to shared", - "enum": [ - "Shared", - "UniquePerReplica" - ], - "type": "string" - } - }, - "required": [ - "subdomainPolicy" - ], - "type": "object", - "additionalProperties": false - }, - "replicas": { - "default": 1, - "description": "replicas is the number of leader-workers groups. A scale subresource is available to enable HPA. The\nselector for HPA will be that of the leader pod, and so practically HPA will be looking up the\nleader pod metrics. Note that the leader pod could aggregate metrics from\nthe rest of the group and expose them as a summary custom metric representing the whole\ngroup.\nOn scale down, the leader pod as well as the workers statefulset will be deleted.\nDefault to 1.", - "format": "int32", - "maximum": 1000000, - "minimum": 0, - "type": "integer" - }, - "rolloutStrategy": { - "description": "rolloutStrategy defines the strategy that will be applied to update replicas\nwhen a revision is made to the leaderWorkerTemplate.", - "properties": { - "rollingUpdateConfiguration": { - "description": "rollingUpdateConfiguration defines the parameters to be used when type is RollingUpdateStrategyType.", - "properties": { - "maxSurge": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "default": 0, - "description": "maxSurge is the maximum number of replicas that can be scheduled above the original number of\nreplicas.\nValue can be an absolute number (ex: 5) or a percentage of total replicas at\nthe start of the update (ex: 10%).\nAbsolute number is calculated from percentage by rounding up.\nBy default, a value of 0 is used.\nExample: when this is set to 30%, the new replicas can be scaled up by 30%\nimmediately when the rolling update starts. Once old replicas have been deleted,\nnew replicas can be scaled up further, ensuring that total number of replicas running\nat any time during the update is at most 130% of original replicas.\nWhen rolling update completes, replicas will fall back to the original replicas.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "maxUnavailable": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "default": 1, - "description": "maxUnavailable is the maximum number of replicas that can be unavailable during the update.\nValue can be an absolute number (ex: 5) or a percentage of total replicas at the start of update (ex: 10%).\nAbsolute number is calculated from percentage by rounding down.\nThis can not be 0 if MaxSurge is 0.\nBy default, a fixed value of 1 is used.\nExample: when this is set to 30%, the old replicas can be scaled down by 30%\nimmediately when the rolling update starts. Once new replicas are ready, old replicas\ncan be scaled down further, followed by scaling up the new replicas, ensuring\nthat at least 70% of original number of replicas are available at all times\nduring the update.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "partition": { - "default": 0, - "description": "partition indicates the ordinal at which the lws should be partitioned for updates.\nDuring a rolling update, all the groups from ordinal Partition to Replicas-1 will be updated.\nThe groups from 0 to Partition-1 will not be updated.\nThis is helpful in incremental rollout strategies like canary deployments\nor interactive rollout strategies for multiple replicas like xPyD deployments.\nOnce partition field and maxSurge field both set, the bursted replicas will keep remaining\nuntil the rolling update is completely done and the partition field is reset to 0.\nThis is as expected to reduce the reconciling complexity.\nThe default value is 0.", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - }, - "type": { - "default": "RollingUpdate", - "description": "type defines the rollout strategy, it can only be “RollingUpdate” for now.", - "enum": [ - "RollingUpdate" - ], - "type": "string" - } - }, - "required": [ - "type" - ], - "type": "object", - "additionalProperties": false - }, - "scheduling": { - "description": "scheduling defines Workload-Aware Scheduling for this LeaderWorkerSet.\nThis field is immutable.", - "properties": { - "disruptionMode": { - "description": "disruptionMode defines how replica groups may be disrupted.", - "properties": { - "all": { - "description": "all specifies that all child groups must be disrupted together.", - "type": "object" - }, - "single": { - "description": "single specifies that child groups can be disrupted independently from\neach other.", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "replica": { - "description": "replica defines scheduling for each replica.", - "properties": { - "disruptionMode": { - "description": "disruptionMode defines how the leader and worker groups may be disrupted.", - "properties": { - "all": { - "description": "all specifies that all child groups must be disrupted together.", - "type": "object" - }, - "single": { - "description": "single specifies that child groups can be disrupted independently from\neach other.", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "leader": { - "description": "leader defines scheduling for the leader PodGroup.", - "properties": { - "disruptionMode": { - "description": "disruptionMode defines how leader pods may be disrupted.", - "properties": { - "all": { - "description": "all specifies that all pods in the group must be disrupted together.", - "type": "object" - }, - "single": { - "description": "single specifies that pods can be disrupted independently from each other.", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "resourceClaims": { - "description": "resourceClaims lists dynamic resource claims shared by leader pods.", - "items": { - "description": "WorkloadPodGroupResourceClaim references a dynamic resource claim\nthat is shared across pods in the group.\n", - "properties": { - "name": { - "description": "name uniquely identifies this resource claim inside the group.\nThis field is required. It must be a DNS_LABEL.", - "type": "string" - }, - "resourceClaimName": { - "description": "resourceClaimName is the name of a ResourceClaim object in the same\nnamespace.\nThis field is optional. If it is not specified, no resource claim\nis used. If set, it must be a DNS subdomain.", - "type": "string" - }, - "resourceClaimTemplateName": { - "description": "resourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace.\nThis field is optional. If it is not specified, no resource claim\ntemplate is used. If set, it must be a DNS subdomain.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "maxItems": 4, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "schedulingConstraints": { - "description": "schedulingConstraints defines placement constraints for the leader PodGroup.", - "properties": { - "topology": { - "description": "topology specifies desired topological placements for all pods\nwithin the pod group.\nIf unset, no topology placement is requested.", - "items": { - "description": "TopologyConstraint defines a topology constraint for a PodGroup.", - "properties": { - "key": { - "description": "key specifies the key of the node label representing the topology domain.\nAll pods within the PodGroup must be colocated within the same domain instance.\nDifferent PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.\nExamples: \"topology.kubernetes.io/rack\"", - "type": "string" - } - }, - "required": [ - "key" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "schedulingPolicy": { - "description": "schedulingPolicy defines scheduling for the leader PodGroup.", - "properties": { - "basic": { - "description": "basic specifies that standard, pod-by-pod Kubernetes scheduling\nbehavior should be used.", - "type": "object" - }, - "gang": { - "description": "gang specifies all-or-nothing scheduling semantics.", - "properties": { - "minCount": { - "description": "minCount is the minimum number of pods that must be scheduled\nat the same time for the scheduler to admit the entire group.\nThis field is optional. If it is not specified, the controller\nshould inject a context-specific sane default (e.g.,\nparallelism for a Job).\nIf set, it must be a positive integer.", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "schedulingConstraints": { - "description": "schedulingConstraints defines placement constraints for a replica.", - "properties": { - "topology": { - "description": "topology specifies desired topological placements for all child groups\nwithin the composite group.\nIf unset, no topology placement is requested.", - "items": { - "description": "TopologyConstraint defines a topology constraint for a PodGroup.", - "properties": { - "key": { - "description": "key specifies the key of the node label representing the topology domain.\nAll pods within the PodGroup must be colocated within the same domain instance.\nDifferent PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.\nExamples: \"topology.kubernetes.io/rack\"", - "type": "string" - } - }, - "required": [ - "key" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "schedulingPolicy": { - "description": "schedulingPolicy defines scheduling for a leader and its workers.", - "properties": { - "basic": { - "description": "basic specifies that the child groups of this composite group should be\nscheduled independently.", - "type": "object" - }, - "gang": { - "description": "gang specifies that the child groups of this composite group should be\nscheduled using all-or-nothing semantics.", - "properties": { - "minGroupCount": { - "description": "minGroupCount is the minimum number of child groups that must be\nschedulable at the same time for the scheduler to admit the entire\ncomposite group.\nThis field is optional. If it is not specified, the controller\nshould inject a context-specific sane default (e.g., the number of\nchild groups).\nIf set, it must be a positive integer.", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "worker": { - "description": "worker defines scheduling for the worker PodGroup.", - "properties": { - "disruptionMode": { - "description": "disruptionMode defines how worker pods may be disrupted.", - "properties": { - "all": { - "description": "all specifies that all pods in the group must be disrupted together.", - "type": "object" - }, - "single": { - "description": "single specifies that pods can be disrupted independently from each other.", - "type": "object" - } - }, - "type": "object", - "additionalProperties": false - }, - "resourceClaims": { - "description": "resourceClaims lists dynamic resource claims shared by worker pods.", - "items": { - "description": "WorkloadPodGroupResourceClaim references a dynamic resource claim\nthat is shared across pods in the group.\n", - "properties": { - "name": { - "description": "name uniquely identifies this resource claim inside the group.\nThis field is required. It must be a DNS_LABEL.", - "type": "string" - }, - "resourceClaimName": { - "description": "resourceClaimName is the name of a ResourceClaim object in the same\nnamespace.\nThis field is optional. If it is not specified, no resource claim\nis used. If set, it must be a DNS subdomain.", - "type": "string" - }, - "resourceClaimTemplateName": { - "description": "resourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace.\nThis field is optional. If it is not specified, no resource claim\ntemplate is used. If set, it must be a DNS subdomain.", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - }, - "maxItems": 4, - "type": "array", - "x-kubernetes-list-map-keys": [ - "name" - ], - "x-kubernetes-list-type": "map" - }, - "schedulingConstraints": { - "description": "schedulingConstraints defines placement constraints for the worker PodGroup.", - "properties": { - "topology": { - "description": "topology specifies desired topological placements for all pods\nwithin the pod group.\nIf unset, no topology placement is requested.", - "items": { - "description": "TopologyConstraint defines a topology constraint for a PodGroup.", - "properties": { - "key": { - "description": "key specifies the key of the node label representing the topology domain.\nAll pods within the PodGroup must be colocated within the same domain instance.\nDifferent PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.\nExamples: \"topology.kubernetes.io/rack\"", - "type": "string" - } - }, - "required": [ - "key" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "schedulingPolicy": { - "description": "schedulingPolicy defines scheduling for the worker PodGroup.", - "properties": { - "basic": { - "description": "basic specifies that standard, pod-by-pod Kubernetes scheduling\nbehavior should be used.", - "type": "object" - }, - "gang": { - "description": "gang specifies all-or-nothing scheduling semantics.", - "properties": { - "minCount": { - "description": "minCount is the minimum number of pods that must be scheduled\nat the same time for the scheduler to admit the entire group.\nThis field is optional. If it is not specified, the controller\nshould inject a context-specific sane default (e.g.,\nparallelism for a Job).\nIf set, it must be a positive integer.", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "schedulingConstraints": { - "description": "schedulingConstraints defines placement constraints for all replicas.", - "properties": { - "topology": { - "description": "topology specifies desired topological placements for all child groups\nwithin the composite group.\nIf unset, no topology placement is requested.", - "items": { - "description": "TopologyConstraint defines a topology constraint for a PodGroup.", - "properties": { - "key": { - "description": "key specifies the key of the node label representing the topology domain.\nAll pods within the PodGroup must be colocated within the same domain instance.\nDifferent PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.\nExamples: \"topology.kubernetes.io/rack\"", - "type": "string" - } - }, - "required": [ - "key" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "type": "object", - "additionalProperties": false - }, - "schedulingPolicy": { - "description": "schedulingPolicy defines scheduling for all replicas.", - "properties": { - "basic": { - "description": "basic specifies that the child groups of this composite group should be\nscheduled independently.", - "type": "object" - }, - "gang": { - "description": "gang specifies that the child groups of this composite group should be\nscheduled using all-or-nothing semantics.", - "properties": { - "minGroupCount": { - "description": "minGroupCount is the minimum number of child groups that must be\nschedulable at the same time for the scheduler to admit the entire\ncomposite group.\nThis field is optional. If it is not specified, the controller\nshould inject a context-specific sane default (e.g., the number of\nchild groups).\nIf set, it must be a positive integer.", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "startupPolicy": { - "default": "LeaderCreated", - "description": "startupPolicy determines the startup policy for the worker statefulset.", - "enum": [ - "LeaderCreated", - "LeaderReady" - ], - "type": "string" - } - }, - "required": [ - "leaderWorkerTemplate" - ], - "type": "object", - "additionalProperties": false - }, - "status": { - "description": "status represents the current status of LeaderWorkerSet.", - "properties": { - "conditions": { - "description": "conditions track the condition of the leaderworkerset.", - "items": { - "description": "Condition contains details for one aspect of the current state of this API Resource.", - "properties": { - "lastTransitionTime": { - "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", - "format": "date-time", - "type": "string" - }, - "message": { - "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", - "maxLength": 32768, - "type": "string" - }, - "observedGeneration": { - "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "reason": { - "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", - "maxLength": 1024, - "minLength": 1, - "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", - "type": "string" - }, - "status": { - "description": "status of the condition, one of True, False, Unknown.", - "enum": [ - "True", - "False", - "Unknown" - ], - "type": "string" - }, - "type": { - "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", - "maxLength": 316, - "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", - "type": "string" - } - }, - "required": [ - "lastTransitionTime", - "message", - "reason", - "status", - "type" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "type" - ], - "x-kubernetes-list-type": "map" - }, - "hpaPodSelector": { - "description": "hpaPodSelector for pods that belong to the LeaderWorkerSet object, this is\nneeded for HPA to know what pods belong to the LeaderWorkerSet object. Here\nwe only select the leader pods.", - "type": "string" - }, - "observedGeneration": { - "description": "observedGeneration is the most recent generation observed for this LeaderWorkerSet.", - "format": "int64", - "type": "integer" - }, - "readyReplicas": { - "description": "readyReplicas track the number of groups that are in ready state (updated or not).", - "format": "int32", - "type": "integer" - }, - "replicas": { - "description": "replicas track the total number of groups that have been created (updated or not, ready or not)", - "format": "int32", - "type": "integer" - }, - "updatedReplicas": { - "description": "updatedReplicas track the number of groups that have been updated (ready or not).", - "format": "int32", - "type": "integer" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false, - "$schema": "http://json-schema.org/draft-07/schema#", - "definitions": { - "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { - "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", - "type": "object" - }, - "creationTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "deletionGracePeriodSeconds": { - "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", - "format": "int64", - "type": "integer" - }, - "deletionTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "finalizers": { - "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set", - "x-kubernetes-patch-strategy": "merge" - }, - "generateName": { - "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", - "type": "string" - }, - "generation": { - "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", - "format": "int64", - "type": "integer" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", - "type": "object" - }, - "managedFields": { - "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "namespace": { - "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", - "type": "string" - }, - "ownerReferences": { - "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "uid" - ], - "x-kubernetes-list-type": "map", - "x-kubernetes-patch-merge-key": "uid", - "x-kubernetes-patch-strategy": "merge" - }, - "resourceVersion": { - "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", - "type": "string" - }, - "selfLink": { - "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", - "type": "string" - }, - "uid": { - "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { - "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", - "format": "date-time", - "type": "string" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { - "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", - "type": "string" - }, - "fieldsType": { - "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", - "type": "string" - }, - "fieldsV1": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", - "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." - }, - "manager": { - "description": "Manager is an identifier of the workflow managing these fields.", - "type": "string" - }, - "operation": { - "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", - "type": "string" - }, - "subresource": { - "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", - "type": "string" - }, - "time": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { - "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", - "type": "object" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { - "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", - "properties": { - "apiVersion": { - "description": "API version of the referent.", - "type": "string" - }, - "blockOwnerDeletion": { - "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", - "type": "boolean" - }, - "controller": { - "description": "If true, this reference points to the managing controller.", - "type": "boolean" - }, - "kind": { - "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "name": { - "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "uid": { - "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "required": [ - "apiVersion", - "kind", - "name", - "uid" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "required": [ - "apiVersion", - "kind", - "metadata" - ] -} diff --git a/schema/helm/crds/monitoring.coreos.com/servicemonitor_v1.json b/schema/helm/crds/monitoring.coreos.com/servicemonitor_v1.json deleted file mode 100644 index 21f847e..0000000 --- a/schema/helm/crds/monitoring.coreos.com/servicemonitor_v1.json +++ /dev/null @@ -1,1441 +0,0 @@ -{ - "description": "The `ServiceMonitor` custom resource definition (CRD) defines how `Prometheus` and `PrometheusAgent` can scrape metrics from a group of services.\nAmong other things, it allows to specify:\n* The services to scrape via label selectors.\n* The container ports to scrape.\n* Authentication credentials to use.\n* Target and metric relabeling.\n\n`Prometheus` and `PrometheusAgent` objects select `ServiceMonitor` objects using label and namespace selectors.", - "properties": { - "apiVersion": { - "type": "string", - "enum": [ - "monitoring.coreos.com/v1" - ] - }, - "kind": { - "type": "string", - "enum": [ - "ServiceMonitor" - ] - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" - }, - "spec": { - "description": "spec defines the specification of desired Service selection for target discovery by\nPrometheus.", - "properties": { - "attachMetadata": { - "description": "attachMetadata defines additional metadata which is added to the\ndiscovered targets.\n\nIt requires Prometheus >= v2.37.0.", - "properties": { - "node": { - "description": "node when set to true, Prometheus attaches node metadata to the discovered\ntargets.\n\nThe Prometheus service account must have the `list` and `watch`\npermissions on the `Nodes` objects.\n\nNode metadata labels are not automatically added to scraped metrics. They are\nexposed as `__meta_kubernetes_node_*` labels and can be copied to timeseries\nwith relabeling configuration.", - "type": "boolean" - } - }, - "type": "object", - "additionalProperties": false - }, - "bodySizeLimit": { - "description": "bodySizeLimit when defined, bodySizeLimit specifies a job level limit on the size\nof uncompressed response body that will be accepted by Prometheus.\n\nIt requires Prometheus >= v2.28.0.", - "pattern": "(^0|([0-9]*[.])?[0-9]+((K|M|G|T|E|P)i?)?B)$", - "type": "string" - }, - "convertClassicHistogramsToNHCB": { - "description": "convertClassicHistogramsToNHCB defines whether to convert all scraped classic histograms into a native histogram with custom buckets.\nIt requires Prometheus >= v3.0.0.", - "type": "boolean" - }, - "endpoints": { - "description": "endpoints defines the list of endpoints part of this ServiceMonitor.\nDefines how to scrape metrics from Kubernetes [Endpoints](https://kubernetes.io/docs/concepts/services-networking/service/#endpoints) objects.\nIn most cases, an Endpoints object is backed by a Kubernetes [Service](https://kubernetes.io/docs/concepts/services-networking/service/) object with the same name and labels.", - "items": { - "description": "Endpoint defines an endpoint serving Prometheus metrics to be scraped by\nPrometheus.", - "properties": { - "authorization": { - "description": "authorization configures the Authorization header credentials used by\nthe client.\n\nCannot be set at the same time as `basicAuth`, `bearerTokenSecret` or `oauth2`.", - "properties": { - "credentials": { - "description": "credentials defines a key of a Secret in the namespace that contains the credentials for authentication.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "type": { - "description": "type defines the authentication type. The value is case-insensitive.\n\n\"Basic\" is not a supported value.\n\nDefault: \"Bearer\"", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "basicAuth": { - "description": "basicAuth defines the Basic Authentication credentials used by the\nclient.\n\nCannot be set at the same time as `authorization`, `bearerTokenSecret` or `oauth2`.", - "properties": { - "password": { - "description": "password defines a key of a Secret containing the password for\nauthentication.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "username": { - "description": "username defines a key of a Secret containing the username for\nauthentication.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "bearerTokenFile": { - "description": "bearerTokenFile defines the file to read bearer token for scraping the target.\n\nDeprecated: use `authorization` instead.", - "type": "string" - }, - "bearerTokenSecret": { - "description": "bearerTokenSecret defines a key of a Secret containing the bearer token\nused by the client for authentication. The secret needs to be in the\nsame namespace as the custom resource and readable by the Prometheus\nOperator.\n\nCannot be set at the same time as `authorization`, `basicAuth` or `oauth2`.\n\nDeprecated: use `authorization` instead.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "enableHttp2": { - "description": "enableHttp2 can be used to disable HTTP2.", - "type": "boolean" - }, - "filterRunning": { - "description": "filterRunning when true, the pods which are not running (e.g. either in Failed or\nSucceeded state) are dropped during the target discovery.\n\nIf unset, the filtering is enabled.\n\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase", - "type": "boolean" - }, - "followRedirects": { - "description": "followRedirects defines whether the client should follow HTTP 3xx\nredirects.", - "type": "boolean" - }, - "honorLabels": { - "description": "honorLabels defines when true the metric's labels when they collide\nwith the target's labels.", - "type": "boolean" - }, - "honorTimestamps": { - "description": "honorTimestamps defines whether Prometheus preserves the timestamps\nwhen exposed by the target.", - "type": "boolean" - }, - "interval": { - "description": "interval at which Prometheus scrapes the metrics from the target.\n\nIf empty, Prometheus uses the global scrape interval.", - "pattern": "^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$", - "type": "string" - }, - "metricRelabelings": { - "description": "metricRelabelings defines the relabeling rules to apply to the\nsamples before ingestion.", - "items": { - "description": "RelabelConfig allows dynamic rewriting of the label set for targets, alerts,\nscraped samples and remote write samples.\n\nMore info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config", - "properties": { - "action": { - "default": "replace", - "description": "action to perform based on the regex matching.\n\n`Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0.\n`DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0.\n\nDefault: \"Replace\"", - "enum": [ - "replace", - "Replace", - "keep", - "Keep", - "drop", - "Drop", - "hashmod", - "HashMod", - "labelmap", - "LabelMap", - "labeldrop", - "LabelDrop", - "labelkeep", - "LabelKeep", - "lowercase", - "Lowercase", - "uppercase", - "Uppercase", - "keepequal", - "KeepEqual", - "dropequal", - "DropEqual" - ], - "type": "string" - }, - "modulus": { - "description": "modulus to take of the hash of the source label values.\n\nOnly applicable when the action is `HashMod`.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "regex": { - "description": "regex defines the regular expression against which the extracted value is matched.", - "type": "string" - }, - "replacement": { - "description": "replacement value against which a Replace action is performed if the\nregular expression matches.\n\nRegex capture groups are available.", - "type": "string" - }, - "separator": { - "description": "separator defines the string between concatenated SourceLabels.", - "type": "string" - }, - "sourceLabels": { - "description": "sourceLabels defines the source labels select values from existing labels. Their content is\nconcatenated using the configured Separator and matched against the\nconfigured regular expression.", - "items": { - "description": "LabelName is a valid Prometheus label name.\nFor Prometheus 3.x, a label name is valid if it contains UTF-8 characters.\nFor Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores.", - "type": "string" - }, - "type": "array" - }, - "targetLabel": { - "description": "targetLabel defines the label to which the resulting string is written in a replacement.\n\nIt is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`,\n`KeepEqual` and `DropEqual` actions.\n\nRegex capture groups are available.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array" - }, - "noProxy": { - "description": "noProxy defines a comma-separated string that can contain IPs, CIDR notation, domain names\nthat should be excluded from proxying. IP and domain names can\ncontain port numbers.\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", - "type": "string" - }, - "oauth2": { - "description": "oauth2 defines the OAuth2 settings used by the client.\n\nIt requires Prometheus >= 2.27.0.\n\nCannot be set at the same time as `authorization`, `basicAuth` or `bearerTokenSecret`.", - "properties": { - "clientId": { - "description": "clientId defines a key of a Secret or ConfigMap containing the\nOAuth2 client's ID.", - "properties": { - "configMap": { - "description": "configMap defines the ConfigMap containing data to use for the targets.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secret": { - "description": "secret defines the Secret containing data to use for the targets.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "clientSecret": { - "description": "clientSecret defines a key of a Secret containing the OAuth2\nclient's secret.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "endpointParams": { - "additionalProperties": { - "type": "string" - }, - "description": "endpointParams configures the HTTP parameters to append to the token\nURL.", - "type": "object" - }, - "noProxy": { - "description": "noProxy defines a comma-separated string that can contain IPs, CIDR notation, domain names\nthat should be excluded from proxying. IP and domain names can\ncontain port numbers.\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", - "type": "string" - }, - "proxyConnectHeader": { - "additionalProperties": { - "items": { - "description": "SecretKeySelector selects a key of a Secret.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "type": "array" - }, - "description": "proxyConnectHeader optionally specifies headers to send to\nproxies during CONNECT requests.\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", - "type": "object", - "x-kubernetes-map-type": "atomic" - }, - "proxyFromEnvironment": { - "description": "proxyFromEnvironment defines whether to use the proxy configuration defined by environment variables (HTTP_PROXY, HTTPS_PROXY, and NO_PROXY).\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", - "type": "boolean" - }, - "proxyUrl": { - "description": "proxyUrl defines the HTTP proxy server to use.", - "pattern": "^(http|https|socks5)://.+$", - "type": "string" - }, - "scopes": { - "description": "scopes defines the OAuth2 scopes used for the token request.", - "items": { - "type": "string" - }, - "type": "array" - }, - "tlsConfig": { - "description": "tlsConfig defines the TLS configuration to use when connecting to the OAuth2 server.\nIt requires Prometheus >= v2.43.0.", - "properties": { - "ca": { - "description": "ca defines the Certificate authority used when verifying server certificates.", - "properties": { - "configMap": { - "description": "configMap defines the ConfigMap containing data to use for the targets.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secret": { - "description": "secret defines the Secret containing data to use for the targets.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "cert": { - "description": "cert defines the Client certificate to present when doing client-authentication.", - "properties": { - "configMap": { - "description": "configMap defines the ConfigMap containing data to use for the targets.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secret": { - "description": "secret defines the Secret containing data to use for the targets.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "insecureSkipVerify": { - "description": "insecureSkipVerify defines how to disable target certificate validation.", - "type": "boolean" - }, - "keySecret": { - "description": "keySecret defines the Secret containing the client key file for the targets.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "maxVersion": { - "description": "maxVersion defines the maximum acceptable TLS version.\n\nIt requires Prometheus >= v2.41.0 or Thanos >= v0.31.0.", - "enum": [ - "TLS10", - "TLS11", - "TLS12", - "TLS13" - ], - "type": "string" - }, - "minVersion": { - "description": "minVersion defines the minimum acceptable TLS version.\n\nIt requires Prometheus >= v2.35.0 or Thanos >= v0.28.0.", - "enum": [ - "TLS10", - "TLS11", - "TLS12", - "TLS13" - ], - "type": "string" - }, - "serverName": { - "description": "serverName is used to verify the hostname for the targets.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "tokenUrl": { - "description": "tokenUrl defines the URL to fetch the token from.", - "pattern": "^(http|https)://.+$", - "type": "string" - } - }, - "required": [ - "clientId", - "clientSecret", - "tokenUrl" - ], - "type": "object", - "additionalProperties": false - }, - "params": { - "additionalProperties": { - "items": { - "type": "string" - }, - "type": "array" - }, - "description": "params define optional HTTP URL parameters.", - "type": "object" - }, - "path": { - "description": "path defines the HTTP path from which to scrape for metrics.\n\nIf empty, Prometheus uses the default value (e.g. `/metrics`).", - "type": "string" - }, - "port": { - "description": "port defines the name of the Service port which this endpoint refers to\n(e.g. `.spec.ports[].name`).\n\nIt takes precedence over `targetPort`.", - "type": "string" - }, - "proxyConnectHeader": { - "additionalProperties": { - "items": { - "description": "SecretKeySelector selects a key of a Secret.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "type": "array" - }, - "description": "proxyConnectHeader optionally specifies headers to send to\nproxies during CONNECT requests.\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", - "type": "object", - "x-kubernetes-map-type": "atomic" - }, - "proxyFromEnvironment": { - "description": "proxyFromEnvironment defines whether to use the proxy configuration defined by environment variables (HTTP_PROXY, HTTPS_PROXY, and NO_PROXY).\n\nIt requires Prometheus >= v2.43.0, Alertmanager >= v0.25.0 or Thanos >= v0.32.0.", - "type": "boolean" - }, - "proxyUrl": { - "description": "proxyUrl defines the HTTP proxy server to use.", - "pattern": "^(http|https|socks5)://.+$", - "type": "string" - }, - "relabelings": { - "description": "relabelings defines the relabeling rules to apply the target's\nmetadata labels.\n\nThe Operator automatically adds relabelings for a few standard Kubernetes fields.\n\nThe original scrape job's name is available via the `__tmp_prometheus_job_name` label.\n\nMore info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config", - "items": { - "description": "RelabelConfig allows dynamic rewriting of the label set for targets, alerts,\nscraped samples and remote write samples.\n\nMore info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config", - "properties": { - "action": { - "default": "replace", - "description": "action to perform based on the regex matching.\n\n`Uppercase` and `Lowercase` actions require Prometheus >= v2.36.0.\n`DropEqual` and `KeepEqual` actions require Prometheus >= v2.41.0.\n\nDefault: \"Replace\"", - "enum": [ - "replace", - "Replace", - "keep", - "Keep", - "drop", - "Drop", - "hashmod", - "HashMod", - "labelmap", - "LabelMap", - "labeldrop", - "LabelDrop", - "labelkeep", - "LabelKeep", - "lowercase", - "Lowercase", - "uppercase", - "Uppercase", - "keepequal", - "KeepEqual", - "dropequal", - "DropEqual" - ], - "type": "string" - }, - "modulus": { - "description": "modulus to take of the hash of the source label values.\n\nOnly applicable when the action is `HashMod`.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "regex": { - "description": "regex defines the regular expression against which the extracted value is matched.", - "type": "string" - }, - "replacement": { - "description": "replacement value against which a Replace action is performed if the\nregular expression matches.\n\nRegex capture groups are available.", - "type": "string" - }, - "separator": { - "description": "separator defines the string between concatenated SourceLabels.", - "type": "string" - }, - "sourceLabels": { - "description": "sourceLabels defines the source labels select values from existing labels. Their content is\nconcatenated using the configured Separator and matched against the\nconfigured regular expression.", - "items": { - "description": "LabelName is a valid Prometheus label name.\nFor Prometheus 3.x, a label name is valid if it contains UTF-8 characters.\nFor Prometheus 2.x, a label name is only valid if it contains ASCII characters, letters, numbers, as well as underscores.", - "type": "string" - }, - "type": "array" - }, - "targetLabel": { - "description": "targetLabel defines the label to which the resulting string is written in a replacement.\n\nIt is mandatory for `Replace`, `HashMod`, `Lowercase`, `Uppercase`,\n`KeepEqual` and `DropEqual` actions.\n\nRegex capture groups are available.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array" - }, - "scheme": { - "description": "scheme defines the HTTP scheme to use when scraping the metrics.", - "enum": [ - "http", - "https", - "HTTP", - "HTTPS" - ], - "type": "string" - }, - "scrapeTimeout": { - "description": "scrapeTimeout defines the timeout after which Prometheus considers the scrape to be failed.\n\nIf empty, Prometheus uses the global scrape timeout unless it is less\nthan the target's scrape interval value in which the latter is used.\nThe value cannot be greater than the scrape interval otherwise the operator will reject the resource.", - "pattern": "^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$", - "type": "string" - }, - "targetPort": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "targetPort defines the name or number of a container port on Pods selected\nby the Service.\nIf a name, it matches against `.spec.containers[].ports[].name` of the Pods.\nIf a number, it matches against `.spec.containers[].ports[].containerPort` of the Pods.", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "tlsConfig": { - "description": "tlsConfig defines TLS configuration used by the client.", - "properties": { - "ca": { - "description": "ca defines the Certificate authority used when verifying server certificates.", - "properties": { - "configMap": { - "description": "configMap defines the ConfigMap containing data to use for the targets.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secret": { - "description": "secret defines the Secret containing data to use for the targets.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "caFile": { - "description": "caFile defines the path to the CA cert in the Prometheus container to use for the targets.", - "type": "string" - }, - "cert": { - "description": "cert defines the Client certificate to present when doing client-authentication.", - "properties": { - "configMap": { - "description": "configMap defines the ConfigMap containing data to use for the targets.", - "properties": { - "key": { - "description": "The key to select from the ConfigMap's Data field.\nKeys in the BinaryData field are not currently propagated to container env vars.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the ConfigMap or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "secret": { - "description": "secret defines the Secret containing data to use for the targets.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false - }, - "certFile": { - "description": "certFile defines the path to the client cert file in the Prometheus container for the targets.", - "type": "string" - }, - "insecureSkipVerify": { - "description": "insecureSkipVerify defines how to disable target certificate validation.", - "type": "boolean" - }, - "keyFile": { - "description": "keyFile defines the path to the client key file in the Prometheus container for the targets.", - "type": "string" - }, - "keySecret": { - "description": "keySecret defines the Secret containing the client key file for the targets.", - "properties": { - "key": { - "description": "The key of the secret to select from. Must be a valid secret key.", - "type": "string" - }, - "name": { - "default": "", - "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - "type": "string" - }, - "optional": { - "description": "Specify whether the Secret or its key must be defined", - "type": "boolean" - } - }, - "required": [ - "key" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "maxVersion": { - "description": "maxVersion defines the maximum acceptable TLS version.\n\nIt requires Prometheus >= v2.41.0 or Thanos >= v0.31.0.", - "enum": [ - "TLS10", - "TLS11", - "TLS12", - "TLS13" - ], - "type": "string" - }, - "minVersion": { - "description": "minVersion defines the minimum acceptable TLS version.\n\nIt requires Prometheus >= v2.35.0 or Thanos >= v0.28.0.", - "enum": [ - "TLS10", - "TLS11", - "TLS12", - "TLS13" - ], - "type": "string" - }, - "serverName": { - "description": "serverName is used to verify the hostname for the targets.", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "trackTimestampsStaleness": { - "description": "trackTimestampsStaleness defines whether Prometheus tracks staleness of\nthe metrics that have an explicit timestamp present in scraped data.\nHas no effect if `honorTimestamps` is false.\n\nIt requires Prometheus >= v2.48.0.", - "type": "boolean" - } - }, - "type": "object", - "additionalProperties": false - }, - "type": "array" - }, - "fallbackScrapeProtocol": { - "description": "fallbackScrapeProtocol defines the protocol to use if a scrape returns blank, unparseable, or otherwise invalid Content-Type.\n\nIt requires Prometheus >= v3.0.0.", - "enum": [ - "PrometheusProto", - "OpenMetricsText0.0.1", - "OpenMetricsText1.0.0", - "PrometheusText0.0.4", - "PrometheusText1.0.0" - ], - "type": "string" - }, - "jobLabel": { - "description": "jobLabel selects the label from the associated Kubernetes `Service`\nobject which will be used as the `job` label for all metrics.\n\nFor example if `jobLabel` is set to `foo` and the Kubernetes `Service`\nobject is labeled with `foo: bar`, then Prometheus adds the `job=\"bar\"`\nlabel to all ingested metrics.\n\nIf the value of this field is empty or if the label doesn't exist for\nthe given Service, the `job` label of the metrics defaults to the name\nof the associated Kubernetes `Service`.", - "type": "string" - }, - "keepDroppedTargets": { - "description": "keepDroppedTargets defines the per-scrape limit on the number of targets dropped by relabeling\nthat will be kept in memory. 0 means no limit.\n\nIt requires Prometheus >= v2.47.0.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "labelLimit": { - "description": "labelLimit defines the per-scrape limit on number of labels that will be accepted for a sample.\n\nIt requires Prometheus >= v2.27.0.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "labelNameLengthLimit": { - "description": "labelNameLengthLimit defines the per-scrape limit on length of labels name that will be accepted for a sample.\n\nIt requires Prometheus >= v2.27.0.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "labelValueLengthLimit": { - "description": "labelValueLengthLimit defines the per-scrape limit on length of labels value that will be accepted for a sample.\n\nIt requires Prometheus >= v2.27.0.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "namespaceSelector": { - "description": "namespaceSelector defines in which namespace(s) Prometheus should discover the services.\nBy default, the services are discovered in the same namespace as the `ServiceMonitor` object but it is possible to select pods across different/all namespaces.", - "properties": { - "any": { - "description": "any defines the boolean describing whether all namespaces are selected in contrast to a\nlist restricting them.", - "type": "boolean" - }, - "matchNames": { - "description": "matchNames defines the list of namespace names to select from.", - "items": { - "type": "string" - }, - "type": "array" - } - }, - "type": "object", - "additionalProperties": false - }, - "nativeHistogramBucketLimit": { - "description": "nativeHistogramBucketLimit defines ff there are more than this many buckets in a native histogram,\nbuckets will be merged to stay within the limit.\nIt requires Prometheus >= v2.45.0.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "nativeHistogramMinBucketFactor": { - "anyOf": [ - { - "type": "integer" - }, - { - "type": "string" - } - ], - "description": "nativeHistogramMinBucketFactor defines if the growth factor of one bucket to the next is smaller than this,\nbuckets will be merged to increase the factor sufficiently.\nIt requires Prometheus >= v2.50.0.", - "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true, - "type": [ - "integer", - "string" - ] - }, - "podTargetLabels": { - "description": "podTargetLabels defines the labels which are transferred from the\nassociated Kubernetes `Pod` object onto the ingested metrics.", - "items": { - "type": "string" - }, - "type": "array" - }, - "sampleLimit": { - "description": "sampleLimit defines a per-scrape limit on the number of scraped samples\nthat will be accepted.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "scrapeClass": { - "description": "scrapeClass defines the scrape class to apply.", - "minLength": 1, - "type": "string" - }, - "scrapeClassicHistograms": { - "description": "scrapeClassicHistograms defines whether to scrape a classic histogram that is also exposed as a native histogram.\nIt requires Prometheus >= v2.45.0.\n\nNotice: `scrapeClassicHistograms` corresponds to the `always_scrape_classic_histograms` field in the Prometheus configuration.", - "type": "boolean" - }, - "scrapeNativeHistograms": { - "description": "scrapeNativeHistograms defines whether to enable scraping of native histograms.\nIt requires Prometheus >= v3.8.0.", - "type": "boolean" - }, - "scrapeProtocols": { - "description": "scrapeProtocols defines the protocols to negotiate during a scrape. It tells clients the\nprotocols supported by Prometheus in order of preference (from most to least preferred).\n\nIf unset, Prometheus uses its default value.\n\nIt requires Prometheus >= v2.49.0.", - "items": { - "description": "ScrapeProtocol represents a protocol used by Prometheus for scraping metrics.\nSupported values are:\n* `OpenMetricsText0.0.1`\n* `OpenMetricsText1.0.0`\n* `PrometheusProto`\n* `PrometheusText0.0.4`\n* `PrometheusText1.0.0`", - "enum": [ - "PrometheusProto", - "OpenMetricsText0.0.1", - "OpenMetricsText1.0.0", - "PrometheusText0.0.4", - "PrometheusText1.0.0" - ], - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set" - }, - "selector": { - "description": "selector defines the label selector to select the Kubernetes `Endpoints` objects to scrape metrics from.", - "properties": { - "matchExpressions": { - "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - "items": { - "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - "properties": { - "key": { - "description": "key is the label key that the selector applies to.", - "type": "string" - }, - "operator": { - "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - "type": "string" - }, - "values": { - "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - } - }, - "required": [ - "key", - "operator" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "matchLabels": { - "additionalProperties": { - "type": "string" - }, - "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - "type": "object" - } - }, - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - }, - "selectorMechanism": { - "description": "selectorMechanism defines the mechanism used to select the endpoints to scrape.\nBy default, the selection process relies on relabel configurations to filter the discovered targets.\nAlternatively, you can opt in for role selectors, which may offer better efficiency in large clusters.\nWhich strategy is best for your use case needs to be carefully evaluated.\n\nIt requires Prometheus >= v2.17.0.", - "enum": [ - "RelabelConfig", - "RoleSelector" - ], - "type": "string" - }, - "serviceDiscoveryRole": { - "description": "serviceDiscoveryRole defines the service discovery role used to discover targets.\n\nIf set, the value should be either \"Endpoints\" or \"EndpointSlice\".\nOtherwise it defaults to the value defined in the\nPrometheus/PrometheusAgent resource.", - "enum": [ - "Endpoints", - "EndpointSlice" - ], - "type": "string" - }, - "targetLabels": { - "description": "targetLabels defines the labels which are transferred from the\nassociated Kubernetes `Service` object onto the ingested metrics.", - "items": { - "type": "string" - }, - "type": "array" - }, - "targetLimit": { - "description": "targetLimit defines a limit on the number of scraped targets that will\nbe accepted.", - "format": "int64", - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "selector" - ], - "type": "object", - "additionalProperties": false - }, - "status": { - "description": "status defines the status subresource. It is under active development and is updated only when the\n\"StatusForConfigurationResources\" feature gate is enabled.\n\nMost recent observed status of the ServiceMonitor. Read-only.\nMore info:\nhttps://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", - "properties": { - "bindings": { - "description": "bindings defines the list of workload resources (Prometheus, PrometheusAgent, ThanosRuler or Alertmanager) which select the configuration resource.", - "items": { - "description": "WorkloadBinding is a link between a configuration resource and a workload resource.", - "properties": { - "conditions": { - "description": "conditions defines the current state of the configuration resource when bound to the referenced Workload object.", - "items": { - "description": "ConfigResourceCondition describes the status of configuration resources linked to Prometheus, PrometheusAgent, Alertmanager or ThanosRuler.", - "properties": { - "lastTransitionTime": { - "description": "lastTransitionTime defines the time of the last update to the current status property.", - "format": "date-time", - "type": "string" - }, - "message": { - "description": "message defines the human-readable message indicating details for the condition's last transition.", - "type": "string" - }, - "observedGeneration": { - "description": "observedGeneration defines the .metadata.generation that the\ncondition was set based upon. For instance, if `.metadata.generation` is\ncurrently 12, but the `.status.conditions[].observedGeneration` is 9, the\ncondition is out of date with respect to the current state of the object.", - "format": "int64", - "type": "integer" - }, - "reason": { - "description": "reason for the condition's last transition.", - "type": "string" - }, - "status": { - "description": "status of the condition.", - "minLength": 1, - "type": "string" - }, - "type": { - "description": "type of the condition being reported.\nCurrently, only \"Accepted\" is supported.", - "enum": [ - "Accepted" - ], - "minLength": 1, - "type": "string" - } - }, - "required": [ - "lastTransitionTime", - "status", - "type" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "type" - ], - "x-kubernetes-list-type": "map" - }, - "group": { - "description": "group defines the group of the referenced resource.", - "enum": [ - "monitoring.coreos.com" - ], - "type": "string" - }, - "name": { - "description": "name defines the name of the referenced object.", - "minLength": 1, - "type": "string" - }, - "namespace": { - "description": "namespace defines the namespace of the referenced object.", - "minLength": 1, - "type": "string" - }, - "resource": { - "description": "resource defines the type of resource being referenced (e.g. Prometheus, PrometheusAgent, ThanosRuler or Alertmanager).", - "enum": [ - "prometheuses", - "prometheusagents", - "thanosrulers", - "alertmanagers" - ], - "type": "string" - } - }, - "required": [ - "group", - "name", - "namespace", - "resource" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "group", - "resource", - "name", - "namespace" - ], - "x-kubernetes-list-type": "map" - } - }, - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "spec", - "apiVersion", - "kind", - "metadata" - ], - "type": "object", - "additionalProperties": false, - "$schema": "http://json-schema.org/draft-07/schema#", - "definitions": { - "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { - "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", - "type": "object" - }, - "creationTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "deletionGracePeriodSeconds": { - "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", - "format": "int64", - "type": "integer" - }, - "deletionTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "finalizers": { - "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set", - "x-kubernetes-patch-strategy": "merge" - }, - "generateName": { - "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", - "type": "string" - }, - "generation": { - "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", - "format": "int64", - "type": "integer" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", - "type": "object" - }, - "managedFields": { - "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "namespace": { - "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", - "type": "string" - }, - "ownerReferences": { - "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "uid" - ], - "x-kubernetes-list-type": "map", - "x-kubernetes-patch-merge-key": "uid", - "x-kubernetes-patch-strategy": "merge" - }, - "resourceVersion": { - "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", - "type": "string" - }, - "selfLink": { - "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", - "type": "string" - }, - "uid": { - "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { - "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", - "format": "date-time", - "type": "string" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { - "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", - "type": "string" - }, - "fieldsType": { - "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", - "type": "string" - }, - "fieldsV1": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", - "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." - }, - "manager": { - "description": "Manager is an identifier of the workflow managing these fields.", - "type": "string" - }, - "operation": { - "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", - "type": "string" - }, - "subresource": { - "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", - "type": "string" - }, - "time": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { - "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", - "type": "object" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { - "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", - "properties": { - "apiVersion": { - "description": "API version of the referent.", - "type": "string" - }, - "blockOwnerDeletion": { - "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", - "type": "boolean" - }, - "controller": { - "description": "If true, this reference points to the managing controller.", - "type": "boolean" - }, - "kind": { - "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "name": { - "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "uid": { - "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "required": [ - "apiVersion", - "kind", - "name", - "uid" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - } -} diff --git a/schema/helm/crds/routing.modelsphere.dev/modelroute_v1alpha1.json b/schema/helm/crds/routing.modelsphere.dev/modelroute_v1alpha1.json deleted file mode 100644 index e0babcf..0000000 --- a/schema/helm/crds/routing.modelsphere.dev/modelroute_v1alpha1.json +++ /dev/null @@ -1,541 +0,0 @@ -{ - "description": "ModelRoute 把「一个模型的后端」自动同步到 openresty 的 peers 与 CART 的 workers。", - "properties": { - "apiVersion": { - "type": "string", - "enum": [ - "routing.modelsphere.dev/v1alpha1" - ] - }, - "kind": { - "type": "string", - "enum": [ - "ModelRoute" - ] - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta" - }, - "spec": { - "description": "ModelRouteSpec 是一个模型的完整路由绑定。\n注:spec.slo 还在另一条分支上(feat/llmslo-to-openresty),main 的 schema 里没有这个字段。\nCEL 按 schema 编译,引用不存在的字段会让整个 CRD 被 API server 拒(\"undefined field 'slo'\"),\n所以这里先不写 slo 的规则 —— 那条分支合进来后补上:\n\n\trule: !has(self.modelType) || self.modelType != 'video' || !has(self.slo)\n\tmsg: modelType: video 不支持 slo(TTFT/TPS 是 token 级指标,视频生成没有这些)\n\nmonitor 的 service 行是给 LLM 健康检查用的(它按 /v1/models、TTFT 这类信号判活与告警),\n指向 H3 只会产生假告警。视频服务的可观测走 Prometheus(H3 自己的 /metrics/queue)。\nvideo 只认自己的调优项;LLM 那些(ttft/tps/自适应并发/会话亲和)在纯反代里根本没人读,\n与其静默忽略,不如直接拒 —— 配了以为生效才是最坑的。\n反过来:llm 路由里写 video 的旋钮同样是无效配置(它们只在 video 模板里渲染)。", - "properties": { - "cart": { - "description": "Cart:可选;有 = autoconfig 管这个 CART,无 = nginx 直连后端。", - "properties": { - "maxLoad": { - "description": "MaxLoad:每 worker 的 max_load,默认 20。", - "type": "integer" - }, - "outputConfigMap": { - "description": "OutputConfigMap:autoconfig 写 CART workers 的 ConfigMap(\"ns/name\")。autoconfig 只更新不创建。", - "type": "string" - }, - "outputKey": { - "description": "OutputKey:workers 写进这个 ConfigMap 的哪个 key。省略 = \"config.yaml\"。\n指到一个【只放 workers】的 key(如 \"workers.yaml\"),底稿那个 key 就完全归 chart:\nCART 按 `-c config.yaml -c workers.yaml` 的顺序合并(后者覆盖前者),helm upgrade 与 autoconfig\n各写各的 key,不再抢同一份内容。autoconfig 对这个 key 没有特殊规则 —— 读它现有内容当底稿、\n换掉 workers 再写回,key 还没内容就等于从空文档起写。", - "type": "string" - }, - "port": { - "description": "Port:CART 端口。省略则从 EndpointSlice/containerPort 自动推导(单端口)。", - "type": "integer" - }, - "selector": { - "type": "string" - }, - "service": { - "description": "CART pod 的发现(供 openresty 的 cart source);service/selector 二选一。service 支持 \"ns/name\" 跨 ns。", - "type": "string" - } - }, - "required": [ - "outputConfigMap" - ], - "type": "object", - "x-kubernetes-validations": [ - { - "message": "cart: service 和 selector 必须恰好给一个", - "rule": "has(self.service) != has(self.selector)" - } - ], - "additionalProperties": false - }, - "discovery": { - "description": "Discovery:本模型的后端桶(喂 CART 的 workers、nginx 的 backend 来源、monitor 的 services)。", - "properties": { - "includeNotReady": { - "description": "IncludeNotReady:默认 false 只取 Ready 端点(排空中端点自动排除)。", - "type": "boolean" - }, - "port": { - "description": "Port:后端服务端口(配 pod IP)。省略则自动推导:service 路径从 EndpointSlice 取、selector 路径从 containerPort 取(仅单端口可推)。", - "type": "integer" - }, - "selector": { - "description": "Selector:走 pod label 发现(兜底:没建 Service 的单机/单卡)。", - "type": "string" - }, - "service": { - "description": "Service:走 EndpointSlice 发现(推荐);该 Service 需只选服务端点(LWS Service 配成只选 leader)。\n支持 \"ns/name\" 跨 ns 发现(裸名默认与 ModelRoute 同 ns),让 ModelRoute 可放中心 ns。", - "type": "string" - } - }, - "type": "object", - "x-kubernetes-validations": [ - { - "message": "discovery: service 和 selector 必须恰好给一个", - "rule": "has(self.service) != has(self.selector)" - } - ], - "additionalProperties": false - }, - "modelType": { - "default": "llm", - "description": "ModelType:这条路由服务的是哪类模型,决定各 sink 的渲染方式。默认 llm(向后兼容,\n老的 ModelRoute 不写这个字段,行为完全不变)。\n\n llm 大语言模型(/v1/chat/completions):走 lua 路由引擎 —— 会话亲和、TTFT/TPS 限流、\n 自适应并发、CART 前置。\n video 视频生成(如 MiniMax H3):异步建任务 + 轮询 + 大文件下载。请求体可能是 64MB 的\n base64 图,响应可能是几十 MB 的视频流,LLM 那套(解析 body 取 model、按 token\n 速率限流、会话亲和)不适用甚至有害,所以渲染成纯反向代理:放开超时、关响应缓冲、\n 透传 Range、补齐 X-Forwarded-Host/Proto。\n\n以后再有别的形态(如 embedding / rerank / ASR)在这里加枚举值 + 对应模板即可,\n不用给每种形态另造一个 CRD。", - "enum": [ - "llm", - "video" - ], - "type": "string" - }, - "monitor": { - "description": "Monitor:可选;有 = 把发现的后端也写进 monitor 的 services(monitor 60s 自热加载,无 sidecar)。", - "properties": { - "gpuType": { - "description": "GPUType:monitor service 行的 gpu_type 字段(如 H100 / A100 / H200)。省略 = 从后端所在节点的\nGPU label(nvidia.com/gpu.product,GFD 打)自动推导成短名;推不出(无 label / 无 GFD)则留空。显式配则覆盖。", - "type": "string" - }, - "model": { - "description": "Model:monitor service 行的 model 字段(served-model-name);省略 = metadata.name。", - "type": "string" - }, - "nginx": { - "description": "Nginx:可选,默认 true(当 spec.nginx 配了 service/selector);复用 nginx 入口发现,写 monitor 的 nginx: 行\n(端口用 spec.nginx.listen,每端口 = 一个模型,name = 本模型)。设 false 关闭。", - "type": "boolean" - }, - "outputConfigMap": { - "description": "OutputConfigMap:autoconfig 写 monitor 配置的 ConfigMap(\"ns/name\",多模型共享,每模型一个 key)。", - "type": "string" - }, - "router": { - "description": "Router:可选,默认 true(当配了 spec.cart);复用 spec.cart 发现的 CART pod,写 monitor 的 router: 表(.../workers)。设 false 关闭。", - "type": "boolean" - } - }, - "required": [ - "outputConfigMap" - ], - "type": "object", - "additionalProperties": false - }, - "nginx": { - "description": "Nginx:nginx(openresty)路由。", - "properties": { - "outputConfigMap": { - "description": "OutputConfigMap:输出 ConfigMap(\"ns/name\",多路由共享,每路由一个 key)。", - "type": "string" - }, - "peers": { - "description": "Peers:有序 peer 组(如 cart 优先 + backend 兜底)。", - "items": { - "description": "RoutePeer:openresty 一条 route 的一组 peer 来源(cart 组 / backend 组)。", - "properties": { - "maxConcurrency": { - "description": "MaxConcurrency:该组所有 peer 的并发上限;省略用 values.default_max。", - "type": "integer" - }, - "maxConcurrencyFromBackend": { - "description": "MaxConcurrencyFromBackend:仅 use:cart 有意义。true = cart 的并发上限动态 = 后端单实例并发 × 后端数\n(CART 扇出到 N 个后端,总容量=各后端容量之和,随后端扩缩自动变)。设了它就忽略静态 MaxConcurrency。\n后端单实例并发取 use:backend 组的 maxConcurrency —— CEL 校验强制此时它必须 > 0(见 ModelRouteSpec)。", - "type": "boolean" - }, - "priority": { - "description": "Priority:openresty peer 优先级(CART 优先=1,后端兜底=0)。", - "type": "integer" - }, - "probePath": { - "description": "ProbePath:该层 openresty 健康探测路径覆盖(GET 状态行含 200=健康,否则 ban)。\n省略时:use:cart 默认 \"/health\"(cache_aware_router 的 /v1/models 是缓存端点、worker 全挂也返 200\n不能当健康信号;/health 是 worker-aware 的),其余层默认空=用 route 的 health_probe_path(/v1/models)。\n显式设值(含对 cart 设为 \"/v1/models\")覆盖默认。", - "type": "string" - }, - "use": { - "description": "Use:\"cart\"(CART 上游,走 CART Service 的 ClusterIP)、\"backend\"(discovery 的后端桶,pod IP)、\n或 \"backend-svc\"(后端 Service 的 ClusterIP VIP,作最低优先级【静态兜底】——operator 宕+rollout 时\npod-IP 层全死也不全断,降级走 kube-proxy;需 discovery.service,selector 模式无 VIP 会被跳过)。", - "enum": [ - "cart", - "backend", - "backend-svc" - ], - "type": "string" - } - }, - "required": [ - "use" - ], - "type": "object", - "additionalProperties": false - }, - "minItems": 1, - "type": "array" - }, - "route": { - "description": "Route:路由短名(= conf 文件名 session_route_.conf + openresty dict 名 + unix socket 名 .sock\n**字符集必须 ⊆ [a-z0-9._-]**:它要做 dispatch 的路径捕获正则 `^/(?[a-z0-9._-]+)/`,含大写/其它字符\n→ dispatch 派生不到 .sock → 该模型经 8080 永远打不通。故加 Pattern 强校验。", - "pattern": "^[a-z0-9._-]+$", - "type": "string" - }, - "selector": { - "description": "Selector:可选;nginx 入口的 pod label 发现(没建 Service 时的兜底)。", - "type": "string" - }, - "service": { - "description": "Service:可选;nginx 入口自身的 Service(\"ns/name\")→ 供 monitor 的 nginx: 行 + 入口 pod 扩缩事件驱动。\n端口取 Service 的 dispatch 命名端口(8080,路径路由统一入口)。与 selector 二选一(都配则 service 优先)。", - "type": "string" - }, - "values": { - "additionalProperties": { - "type": "string" - }, - "description": "Values:任意调优项,原样渲染进 lua register_route 返回表(key = value)。nginx 加新调优项无需改代码。\n常用:ttft_limit_ms、tps_limit_tps、adaptive_cc_min、default_max。值按 lua 字面量原样写(数字不加引号)。\n\n⚠️ 这里的值全部走 luaVal:非数字/非布尔会被**加引号当字符串**。所以不能在这里手写\nttft_metrics / tps_metrics 这类**嵌套 table** —— 写了会渲染成字符串,引擎的\nutil.validate_metrics 直接整份丢弃。那两个键由 spec.slo 从 LLMSLORequirement 生成,\n且渲染在本段之后 → **配了 spec.slo 时,这里手写的同名键会被静默覆盖**(实测确认)。\n要调 SLO 阈值请改 LLMSLORequirement,不要在这里写。\nMaxProperties/MaxLength 不只是防呆:CEL 规则的**估算开销**与 map 的可能大小成正比,\n不加上限时 k8s 按\"无限大\"估,白名单一长就超预算被拒\n(estimated rule cost exceeds budget —— 实测加到 9 个键就超了 2.2%)。", - "maxProperties": 32, - "type": "object" - } - }, - "required": [ - "outputConfigMap", - "peers" - ], - "type": "object", - "additionalProperties": false - }, - "slo": { - "description": "SLO:可选;有 = 把同 ns 里匹配本路由的 LLMSLORequirement 翻译成 ttft_metrics / tps_metrics,\n渲染进本路由的 session_route_.conf(与其它调优项同一条通道,reload 生效)。\n没有 = 完全不碰 SLO(openresty 回落 nginx.values 里的静态 ttft_limit_ms / tps_limit_tps)。", - "properties": { - "name": { - "description": "Name:要读哪个 LLMSLORequirement,按 **metadata.name** 取。必填,不做任何推导。\n支持 \"ns/name\" 跨 ns 引用;裸名默认用 ModelRoute 自己的 ns\n(与 discovery.service、nginx.outputConfigMap 同一套写法)。\n\n用 name 而不是 spec.serviceId,有两个原因:\n\n 1. **唯一性由 k8s 保证**。serviceId 只是个自由字符串,同 ns 里两个对象写同一个\n serviceId 完全能 apply,那时\"用哪份\"就由 List 的顺序(informer 缓存,无序保证)\n 决定,阈值会在两份之间漂,而两份 CRD 看上去都正常。按 name 是直接 Get,不存在这问题。\n 2. **不含糊**。一个服务在不同地方叫 glm 和 glm-leader,serviceId 写哪个要靠猜;\n name 是这个对象唯一的、写在 yaml 上的身份。\n\n早先还有一版是从 discovery.service 截掉 \"-leader\" 后缀推 serviceId(LWS 惯例)。\n一并删了:那是按命名规则猜关联,猜错不报错——要么静默回落静态阈值,要么套用别人的 SLO。", - "type": "string" - } - }, - "required": [ - "name" - ], - "type": "object", - "additionalProperties": false - } - }, - "required": [ - "discovery", - "nginx" - ], - "type": "object", - "x-kubernetes-validations": [ - { - "message": "modelType: video 不支持 cart(CART 是 LLM 的前缀缓存路由器)", - "rule": "!has(self.modelType) || self.modelType != 'video' || !has(self.cart)" - }, - { - "message": "modelType: video 的 nginx.peers 不能用 cart", - "rule": "!has(self.modelType) || self.modelType != 'video' || !self.nginx.peers.exists(s, s.use == 'cart')" - }, - { - "message": "modelType: video 不支持 monitor(它的探活与告警是按 LLM 端点设计的,会产生假告警;视频服务用 Prometheus 抓自己的指标)", - "rule": "!has(self.modelType) || self.modelType != 'video' || !has(self.monitor)" - }, - { - "message": "modelType: video 的 nginx.values 只支持 max_body_size / proxy_timeout / connect_timeout / rate_limit / upload_conn_limit / upload_req_limit / upload_req_burst / upload_limit_key / download_conn_limit / auth / auth_public_paths(TTFT/TPS/自适应并发等是 LLM 引擎的调优项,video 是纯反向代理,配了不会生效;rate_limit_after 已废弃 —— 下载路径现在从第一字节起就限速,不再豁免首段)", - "rule": "!has(self.modelType) || self.modelType != 'video' || !has(self.nginx.values) || self.nginx.values.all(k, k in ['max_body_size','proxy_timeout','connect_timeout','rate_limit','upload_conn_limit','upload_req_limit','upload_req_burst','upload_limit_key','download_conn_limit','auth','auth_public_paths'])" - }, - { - "message": "max_body_size / proxy_timeout / connect_timeout / rate_limit / upload_conn_limit / upload_req_limit / upload_req_burst / upload_limit_key / download_conn_limit / auth / auth_public_paths 只对 modelType: video 生效,llm 路由请用 ttft_limit_ms / tps_limit_tps / adaptive_cc_min 等", - "rule": "(has(self.modelType) && self.modelType == 'video') || !has(self.nginx.values) || self.nginx.values.all(k, !(k in ['max_body_size','proxy_timeout','connect_timeout','rate_limit','upload_conn_limit','upload_req_limit','upload_req_burst','upload_limit_key','download_conn_limit','auth','auth_public_paths']))" - }, - { - "message": "nginx.peers 用了 cart,但没配 spec.cart", - "rule": "!self.nginx.peers.exists(s, s.use == 'cart') || has(self.cart)" - }, - { - "message": "cart 用了 maxConcurrencyFromBackend,必须给 backend 组配 maxConcurrency(> 0)作乘数", - "rule": "!self.nginx.peers.exists(s, s.use == 'cart' && has(s.maxConcurrencyFromBackend) && s.maxConcurrencyFromBackend) || self.nginx.peers.exists(s, s.use == 'backend' && has(s.maxConcurrency) && s.maxConcurrency > 0)" - } - ], - "additionalProperties": false - }, - "status": { - "description": "ModelRouteStatus 是 controller 回写的观测状态。", - "properties": { - "appliedRouteConfigMap": { - "type": "string" - }, - "appliedRouteKey": { - "description": "AppliedRouteKey / AppliedRouteConfigMap:**上一次真正写进去的** openresty key 及其 ConfigMap。\n用来在 spec.nginx.route 改名后删掉旧 key —— 只看当前 spec 是推不出旧名字的,\n结果就是改一次名泄漏一个 key,而 openresty 会继续加载那条陈旧路由(指向改名前的 peers)。", - "type": "string" - }, - "backends": { - "type": "integer" - }, - "cartPeers": { - "type": "integer" - }, - "conditions": { - "items": { - "description": "Condition contains details for one aspect of the current state of this API Resource.", - "properties": { - "lastTransitionTime": { - "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", - "format": "date-time", - "type": "string" - }, - "message": { - "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", - "maxLength": 32768, - "type": "string" - }, - "observedGeneration": { - "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", - "format": "int64", - "minimum": 0, - "type": "integer" - }, - "reason": { - "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", - "maxLength": 1024, - "minLength": 1, - "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", - "type": "string" - }, - "status": { - "description": "status of the condition, one of True, False, Unknown.", - "enum": [ - "True", - "False", - "Unknown" - ], - "type": "string" - }, - "type": { - "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", - "maxLength": 316, - "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", - "type": "string" - } - }, - "required": [ - "lastTransitionTime", - "message", - "reason", - "status", - "type" - ], - "type": "object", - "additionalProperties": false - }, - "type": "array" - }, - "lastSyncTime": { - "format": "date-time", - "type": "string" - }, - "observedGeneration": { - "format": "int64", - "type": "integer" - }, - "orphanRouteKeys": { - "description": "OrphanRouteKeys:改名后遗留、已无任何 ModelRoute 声明的 openresty key(格式 \"ns/cm:key\")。\n**只报不删** —— 见 reportOrphanKeys 里为什么不能由 operator 自动删。", - "items": { - "type": "string" - }, - "type": "array" - }, - "ready": { - "type": "boolean" - } - }, - "required": [ - "backends", - "cartPeers", - "ready" - ], - "type": "object", - "additionalProperties": false - } - }, - "type": "object", - "additionalProperties": false, - "$schema": "http://json-schema.org/draft-07/schema#", - "definitions": { - "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": { - "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.", - "properties": { - "annotations": { - "additionalProperties": { - "type": "string" - }, - "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations", - "type": "object" - }, - "creationTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "deletionGracePeriodSeconds": { - "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.", - "format": "int64", - "type": "integer" - }, - "deletionTimestamp": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "finalizers": { - "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.", - "items": { - "type": "string" - }, - "type": "array", - "x-kubernetes-list-type": "set", - "x-kubernetes-patch-strategy": "merge" - }, - "generateName": { - "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency", - "type": "string" - }, - "generation": { - "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.", - "format": "int64", - "type": "integer" - }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels", - "type": "object" - }, - "managedFields": { - "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry" - }, - "type": "array", - "x-kubernetes-list-type": "atomic" - }, - "name": { - "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "namespace": { - "description": "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", - "type": "string" - }, - "ownerReferences": { - "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference" - }, - "type": "array", - "x-kubernetes-list-map-keys": [ - "uid" - ], - "x-kubernetes-list-type": "map", - "x-kubernetes-patch-merge-key": "uid", - "x-kubernetes-patch-strategy": "merge" - }, - "resourceVersion": { - "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", - "type": "string" - }, - "selfLink": { - "description": "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.", - "type": "string" - }, - "uid": { - "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.Time": { - "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.", - "format": "date-time", - "type": "string" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": { - "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.", - "type": "string" - }, - "fieldsType": { - "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"", - "type": "string" - }, - "fieldsV1": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1", - "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type." - }, - "manager": { - "description": "Manager is an identifier of the workflow managing these fields.", - "type": "string" - }, - "operation": { - "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.", - "type": "string" - }, - "subresource": { - "description": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.", - "type": "string" - }, - "time": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over." - } - }, - "type": "object", - "additionalProperties": false - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": { - "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:', where is the name of a field in a struct, or key in a map 'v:', where is the exact json formatted value of a list item 'i:', where is position of a item in a list 'k:', where is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff", - "type": "object" - }, - "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": { - "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.", - "properties": { - "apiVersion": { - "description": "API version of the referent.", - "type": "string" - }, - "blockOwnerDeletion": { - "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.", - "type": "boolean" - }, - "controller": { - "description": "If true, this reference points to the managing controller.", - "type": "boolean" - }, - "kind": { - "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "name": { - "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names", - "type": "string" - }, - "uid": { - "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids", - "type": "string" - } - }, - "required": [ - "apiVersion", - "kind", - "name", - "uid" - ], - "type": "object", - "x-kubernetes-map-type": "atomic", - "additionalProperties": false - } - }, - "required": [ - "apiVersion", - "kind", - "metadata" - ] -} From 1e9b44f75728274fa411b54da8c769af27da6038 Mon Sep 17 00:00:00 2001 From: aceforeverd Date: Thu, 8 Oct 2026 23:11:57 +0800 Subject: [PATCH 6/8] refactor schema validate layout --- README.md | 2 +- hack/build-crds.js | 55 ++++-- hack/install-helm-tools.js | 2 +- hack/lib/crd-schema.js | 2 +- hack/lib/helm-validation.js | 4 +- hack/lib/helm-validation.test.js | 4 +- hack/update-crds.js | 26 --- hack/validate-helm.integration.test.js | 4 +- hack/validate-helm.js | 14 +- hack/validate-helm.test.js | 6 +- package.json | 2 +- schema/crds/README.md | 73 ++++++++ schema/{helm => crds}/config.json | 0 .../provenance.json => crds/crds-lock.json} | 0 schema/{helm/sources.json => crds/crds.json} | 0 schema/helm/README.md | 172 ------------------ 16 files changed, 128 insertions(+), 238 deletions(-) mode change 100755 => 100644 hack/build-crds.js delete mode 100644 hack/update-crds.js create mode 100644 schema/crds/README.md rename schema/{helm => crds}/config.json (100%) rename schema/{helm/provenance.json => crds/crds-lock.json} (100%) rename schema/{helm/sources.json => crds/crds.json} (100%) delete mode 100644 schema/helm/README.md diff --git a/README.md b/README.md index e83d034..96654f1 100644 --- a/README.md +++ b/README.md @@ -118,7 +118,7 @@ thing that behaves like one: it rebuilds the index, then serves the tree. PRs also run the independent `validate-helm` check on every variant in changed version YAMLs, using the latest stable released chart for each engine, Helm's -values schema and strict Kubernetes/CRD schemas. See [Helm validation](schema/helm/README.md) for +values schema and strict Kubernetes/CRD schemas. See [Helm validation](schema/crds/README.md) for local commands, schema updates, artifacts, and validation limits. Deployment still follows the YAML chart declaration. Use `--chart-mode declared` with `npm run validate:helm` to reproduce that release locally. diff --git a/hack/build-crds.js b/hack/build-crds.js old mode 100755 new mode 100644 index b50d5e9..1d01480 --- a/hack/build-crds.js +++ b/hack/build-crds.js @@ -1,37 +1,52 @@ #!/usr/bin/env node "use strict"; -// Build the kubeconform CRD schemas from the lock into DIR. Every source is -// downloaded at its locked commit and must match its recorded sha256. -// node hack/build-crds.js [--lock schema/helm/provenance.json] DIR +// Build the kubeconform CRD schemas the way npm install builds node_modules. +// crds.json pins each CRD to a commit; crds-lock.json records the sha256 +// of what each pin holds. A lock in step with crds.json is honored, and +// different bytes are refused; a missing or stale lock is written afresh. +// --locked (CI) refuses to rewrite the lock instead, like npm ci. +// node hack/build-crds.js [--locked] [DIR] const fs = require("node:fs"); const path = require("node:path"); const {root} = require("./lib/catalog"); const {CONVERTER_VERSION, buildSchemas} = require("./lib/crd-schema"); +const config = require("../schema/crds/config.json"); +const {sources} = require("../schema/crds/crds.json"); + +const lockFile = path.join(root, "schema/crds/crds-lock.json"); +const objectMetaUrl = `https://raw.githubusercontent.com/yannh/kubernetes-json-schema/${config.kubernetesSchemaCommit}/` + + `v${config.kubernetesVersion}-standalone-strict/_definitions.json`; + +function pins(list) { + return JSON.stringify(list.map(({repository, commit, path: file, kind, group}) => [repository, commit, file, kind, group])); +} async function main(args) { - let lock = path.join(root, "schema/helm/provenance.json"); - const rest = []; - for (let i = 0; i < args.length; i++) { - if (args[i] === "--lock" && args[i + 1]) lock = args[++i]; - else rest.push(args[i]); - } - if (rest.length !== 1 || rest[0].startsWith("-")) throw new Error("usage: build-crds.js [--lock FILE] DIR"); - const provenance = JSON.parse(fs.readFileSync(lock, "utf8")); - if (provenance.converterVersion !== CONVERTER_VERSION) { - throw new Error(`${lock}: converter ${provenance.converterVersion}, want ${CONVERTER_VERSION}; run npm run helm:update-crds`); - } - const {files} = await buildSchemas(provenance.sources, provenance.objectMeta); - const locked = provenance.sources.flatMap((source) => source.schemas.map((schema) => schema.file)).sort(); - if (JSON.stringify([...files.keys()].sort()) !== JSON.stringify(locked)) { - throw new Error(`${lock}: built schemas differ from the locked list; run npm run helm:update-crds`); + const locked = args.includes("--locked"); + const rest = args.filter((arg) => arg !== "--locked"); + if (rest.length > 1 || rest.some((arg) => arg.startsWith("-"))) throw new Error("usage: build-crds.js [--locked] [DIR]"); + if (config.converterVersion !== CONVERTER_VERSION) throw new Error("converter version mismatch"); + const text = fs.existsSync(lockFile) ? fs.readFileSync(lockFile, "utf8") : null; + const lock = text && JSON.parse(text); + const current = lock?.converterVersion === CONVERTER_VERSION && lock.objectMeta?.url === objectMetaUrl && + pins(lock.sources) === pins(sources); + const stale = `${path.relative(root, lockFile)} is out of date; run npm run helm:build-crds and commit it`; + if (!current && locked) throw new Error(stale); + const built = current ? await buildSchemas(lock.sources, lock.objectMeta) : await buildSchemas(sources, {url: objectMetaUrl}); + const next = JSON.stringify({converterVersion: CONVERTER_VERSION, objectMeta: built.objectMeta, sources: built.records}, null, 2) + "\n"; + if (next !== text) { + if (locked) throw new Error(stale); + fs.writeFileSync(lockFile, next); + console.log(`Updated ${path.relative(root, lockFile)}`); } + if (!rest.length) return; const output = path.resolve(rest[0]); - for (const [file, body] of files) { + for (const [file, body] of built.files) { fs.mkdirSync(path.dirname(path.join(output, file)), {recursive: true}); fs.writeFileSync(path.join(output, file), body); } - console.log(`Built ${files.size} CRD schemas in ${output}`); + console.log(`Built ${built.files.size} CRD schemas in ${output}`); } main(process.argv.slice(2)).catch((err) => {console.error(err.message); process.exitCode = 1;}); diff --git a/hack/install-helm-tools.js b/hack/install-helm-tools.js index 45f7336..cab828b 100644 --- a/hack/install-helm-tools.js +++ b/hack/install-helm-tools.js @@ -7,7 +7,7 @@ const crypto = require("node:crypto"); const {execFileSync} = require("node:child_process"); const {root} = require("./lib/catalog"); const {download} = require("./lib/download"); -const config = require("../schema/helm/config.json"); +const config = require("../schema/crds/config.json"); async function main() { const platform = `${process.platform}-${{x64: "amd64", arm64: "arm64"}[process.arch]}`; diff --git a/hack/lib/crd-schema.js b/hack/lib/crd-schema.js index 353e127..2bb0e14 100644 --- a/hack/lib/crd-schema.js +++ b/hack/lib/crd-schema.js @@ -100,7 +100,7 @@ async function fetchPinned({url, sha256}) { } // Download CRD sources at their pinned commits and convert every served version. -// Returns the schema files and the provenance records that lock them. +// Returns the schema files and the records that lock them. async function buildSchemas(sources, objectMeta) { const meta = await fetchPinned(objectMeta); const metadata = objectMetaSchema(JSON.parse(meta.body).definitions); diff --git a/hack/lib/helm-validation.js b/hack/lib/helm-validation.js index a46d1df..dcc96ac 100644 --- a/hack/lib/helm-validation.js +++ b/hack/lib/helm-validation.js @@ -10,8 +10,8 @@ function isVersionFile(file) { } function affectsValidator(file) { - return file.startsWith("schema/helm/") || - /^hack\/(validate-helm|install-helm-tools|build-crds|update-crds)(\.integration)?\.(js|test\.js)$/.test(file) || + return file.startsWith("schema/crds/") || + /^hack\/(validate-helm|install-helm-tools|build-crds)(\.integration)?\.(js|test\.js)$/.test(file) || /^hack\/lib\/(helm-validation|crd-schema|download|catalog)(\.test)?\.js$/.test(file) || ["package.json", "package-lock.json", ".github/workflows/lint.yml"].includes(file); } diff --git a/hack/lib/helm-validation.test.js b/hack/lib/helm-validation.test.js index 04489fa..783554c 100644 --- a/hack/lib/helm-validation.test.js +++ b/hack/lib/helm-validation.test.js @@ -7,7 +7,7 @@ const os = require("node:os"); const path = require("node:path"); const {execFileSync} = require("node:child_process"); const {selectFiles, variantValues, kubeconformArgs} = require("./helm-validation"); -const config = require("../../schema/helm/config.json"); +const config = require("../../schema/crds/config.json"); function repository(t) { const dir = fs.mkdtempSync(path.join(os.tmpdir(), "helm-selection-")); @@ -57,7 +57,7 @@ test("selection uses the common ancestor even when the target branch advances", }); test("validator, dependency and schema changes, including deletions, trigger all versions", (t) => { - for (const file of ["hack/validate-helm.js", "hack/build-crds.js", "hack/lib/crd-schema.js", "schema/helm/config.json", "package-lock.json", ".github/workflows/lint.yml"]) { + for (const file of ["hack/validate-helm.js", "hack/build-crds.js", "hack/lib/crd-schema.js", "schema/crds/config.json", "package-lock.json", ".github/workflows/lint.yml"]) { const r = repository(t); r.write(file, "changed\n"); r.commit(); assert.equal(selectFiles(r.dir, {base: "base"}).reason, "validator/dependency/schema changes"); diff --git a/hack/update-crds.js b/hack/update-crds.js deleted file mode 100644 index 9e46717..0000000 --- a/hack/update-crds.js +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/bin/env node -"use strict"; - -// Refresh the CRD lock: download every source at the commit sources.json pins, -// check it converts, and record its sha256 and schemas in provenance.json. -// Schemas are not committed; hack/build-crds.js builds them from this lock. -const fs = require("node:fs"); -const path = require("node:path"); -const {root} = require("./lib/catalog"); -const {CONVERTER_VERSION, buildSchemas} = require("./lib/crd-schema"); -const config = require("../schema/helm/config.json"); -const sources = require("../schema/helm/sources.json").sources; - -async function main() { - if (config.converterVersion !== CONVERTER_VERSION) throw new Error("converter version mismatch"); - const objectMeta = {url: `https://raw.githubusercontent.com/yannh/kubernetes-json-schema/${config.kubernetesSchemaCommit}/` + - `v${config.kubernetesVersion}-standalone-strict/_definitions.json`}; - const lock = await buildSchemas(sources, objectMeta); - fs.writeFileSync(path.join(root, "schema/helm/provenance.json"), - JSON.stringify({converterVersion: CONVERTER_VERSION, objectMeta: lock.objectMeta, sources: lock.records}, null, 2) + "\n"); - for (const record of lock.records) { - for (const schema of record.schemas) console.log(`Locked ${schema.file} from ${record.repository}@${record.commit}`); - } -} - -main().catch((err) => {console.error(err.message); process.exitCode = 1;}); diff --git a/hack/validate-helm.integration.test.js b/hack/validate-helm.integration.test.js index c3d95c8..25099f2 100644 --- a/hack/validate-helm.integration.test.js +++ b/hack/validate-helm.integration.test.js @@ -10,7 +10,7 @@ const YAML = require("yaml"); const {root} = require("./lib/catalog"); const {main} = require("./validate-helm"); const {command, kubeconformArgs} = require("./lib/helm-validation"); -const config = require("../schema/helm/config.json"); +const config = require("../schema/crds/config.json"); for (const chartMode of ["latest", "declared"]) { test(`released charts (${chartMode}): fixed/range versions, all example variants, LWS, defaults and invalid configurations`, {timeout: 240000}, (t) => { @@ -18,7 +18,7 @@ for (const chartMode of ["latest", "declared"]) { t.after(() => fs.rmSync(temp, {recursive: true, force: true})); fs.mkdirSync(path.join(temp, "models/fixtures"), {recursive: true}); fs.mkdirSync(path.join(temp, "schema")); - fs.symlinkSync(path.join(root, "schema/helm"), path.join(temp, "schema/helm"), "dir"); + fs.symlinkSync(path.join(root, "schema/crds"), path.join(temp, "schema/crds"), "dir"); fs.symlinkSync(path.join(root, ".cache"), path.join(temp, ".cache"), "dir"); function write(name, doc) { fs.writeFileSync(path.join(temp, `models/fixtures/${name}.yaml`), YAML.stringify(doc)); diff --git a/hack/validate-helm.js b/hack/validate-helm.js index 706b725..49adfcb 100644 --- a/hack/validate-helm.js +++ b/hack/validate-helm.js @@ -7,7 +7,7 @@ const crypto = require("node:crypto"); const YAML = require("yaml"); const {root, compareVersions, isPrerelease} = require("./lib/catalog"); const {command, selectFiles, variantValues, kubeconformArgs, parseVersions} = require("./lib/helm-validation"); -const config = require("../schema/helm/config.json"); +const config = require("../schema/crds/config.json"); function options(args) { const opts = {files: [], chartMode: "latest", output: path.join(root, "artifacts/helm-validation")}; @@ -77,13 +77,13 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { throw new Error(`${name}: expected ${config[`${name}Version`]}, got ${version}; run npm run helm:install`); } } - const lock = path.join(root, "schema/helm/provenance.json"); - const provenance = JSON.parse(fs.readFileSync(lock, "utf8")); - if (provenance.converterVersion !== config.converterVersion) throw new Error("CRD converter version mismatch"); - const apis = [...new Set(provenance.sources.flatMap((source) => source.schemas.map((s) => `${s.group}/${s.version}`)))]; - // CRD schemas are not committed: build them from the lock for this run. + const lock = JSON.parse(fs.readFileSync(path.join(root, "schema/crds/crds-lock.json"), "utf8")); + if (lock.converterVersion !== config.converterVersion) throw new Error("CRD converter version mismatch"); + const apis = [...new Set(lock.sources.flatMap((source) => source.schemas.map((s) => `${s.group}/${s.version}`)))]; + // CRD schemas are not committed: build them from the lock for this run, + // which must not rewrite it. const schemaDir = path.join(runDir, "crds"); - requireSuccess(invoke(process.execPath, [path.join(__dirname, "build-crds.js"), "--lock", lock, schemaDir], runDir, "crds"), "crds"); + requireSuccess(invoke(process.execPath, [path.join(__dirname, "build-crds.js"), "--locked", schemaDir], runDir, "crds"), "crds"); const schemaCache = path.join(runDir, "schema-cache"); fs.mkdirSync(schemaCache); requireSuccess(invoke(bin("helm"), ["repo", "add", "catalog", config.chartRepository], runDir, "chart-repository"), "chart-repository"); diff --git a/hack/validate-helm.test.js b/hack/validate-helm.test.js index 05db7d5..1eacab1 100644 --- a/hack/validate-helm.test.js +++ b/hack/validate-helm.test.js @@ -8,7 +8,7 @@ const path = require("node:path"); const crypto = require("node:crypto"); const YAML = require("yaml"); const {main, options} = require("./validate-helm"); -const config = require("../schema/helm/config.json"); +const config = require("../schema/crds/config.json"); function fixture(t, failure, {chartName = "sglang", declaredVersion = "0.8.0", latestVersion = "0.8.0"} = {}) { const root = fs.mkdtempSync(path.join(os.tmpdir(), "helm-validator-")); @@ -19,8 +19,8 @@ function fixture(t, failure, {chartName = "sglang", declaredVersion = "0.8.0", l {id: "default", default: true, chart: {name: chartName, version: declaredVersion}}, {id: "other", chart: {name: chartName, version: `>=${config.minimumChartVersions[chartName]}`}, values: {extraArgs: ["--other"]}} ]})); - fs.mkdirSync(path.join(root, "schema/helm"), {recursive: true}); - fs.writeFileSync(path.join(root, "schema/helm/provenance.json"), JSON.stringify({converterVersion: config.converterVersion, sources: []})); + fs.mkdirSync(path.join(root, "schema/crds"), {recursive: true}); + fs.writeFileSync(path.join(root, "schema/crds/crds-lock.json"), JSON.stringify({converterVersion: config.converterVersion, sources: []})); const calls = []; const bytes = Buffer.from("fixture-package"); let prereleaseInserted = false; diff --git a/package.json b/package.json index 138581c..20858e6 100644 --- a/package.json +++ b/package.json @@ -19,7 +19,7 @@ "validate:schema": "node hack/validate-schema.js", "validate:helm": "node hack/validate-helm.js", "helm:install": "node hack/install-helm-tools.js", - "helm:update-crds": "node hack/update-crds.js", + "helm:build-crds": "node hack/build-crds.js", "test:helm": "node --test hack/lib/helm-validation.test.js hack/lib/crd-schema.test.js hack/validate-helm.test.js", "test:helm:integration": "node --test hack/validate-helm.integration.test.js", "test:lib": "node --test 'hack/lib/*.test.js'", diff --git a/schema/crds/README.md b/schema/crds/README.md new file mode 100644 index 0000000..f34702a --- /dev/null +++ b/schema/crds/README.md @@ -0,0 +1,73 @@ +# Helm validation + +`npm run validate:helm` renders every variant of the selected model versions +with a released chart and checks the result: `helm lint --strict`, +`helm template`, then `kubeconform -strict` against the Kubernetes and CRD +schemas. CI runs it on every PR as the `validate-helm` job. + +## Run it + +Needs Node.js 24, `git`, `tar` and network access. Downloads honor +`HTTPS_PROXY`, `HTTP_PROXY` and `NO_PROXY`. + +```sh +npm ci +npm run helm:install # pinned helm and kubeconform +npm run validate:helm # versions changed since origin/HEAD +npm run validate:helm -- --base origin/master +npm run validate:helm -- --all +npm run validate:helm -- models/glm5.3/glm5.3-1.0.1.yaml +npm run validate:helm -- --all --chart-mode declared +npm run test:helm +npm run test:helm:integration # against released charts +``` + +Results go to `artifacts/helm-validation/`: `summary.json`, plus a `run-*` +directory holding each variant's values, rendered manifests and tool logs. + +## What is checked + +- **Versions**: those changed since the base. A change to the validator, this + directory or the dependencies checks every version. +- **Chart**: `--chart-mode latest` (the default, and CI's) renders the newest + stable chart at or above the minimum; `declared` renders the release the + YAML's `chart.version` resolves to. +- **Minimum chart version**: set in `config.json` (sglang 0.8.0, vllm 0.5.0, the + first releases on the `*.modelsphere.dev` API groups). A new version below it + fails. A published version below it only warns, or is skipped in declared mode: + published versions are never rewritten. +- **Values**: used as written, except an absent + `modelRoute.nginx.outputConfigMap`, which is set to `ci/openresty-conf`. + +## Files + +| File | Holds | +| --- | --- | +| [`config.json`](config.json) | tool versions and checksums, Kubernetes version, chart repository, minimum chart versions | +| [`crds.json`](crds.json) | the CRDs to validate against, each pinned to an upstream commit | +| [`crds-lock.json`](crds-lock.json) | the sha256 of each pinned CRD and the schemas it yields; written by `build-crds` | + +## CRD schemas + +The schemas are not committed. `npm run helm:build-crds [-- DIR]` downloads each +CRD in `crds.json` and converts it into a strict kubeconform schema +([`hack/lib/crd-schema.js`](../../hack/lib/crd-schema.js)). It works like +`npm install`: a lock in step with `crds.json` is honored, and a download whose +bytes differ from it is refused; a missing or stale lock is rewritten. With +`--locked` it fails instead, like `npm ci`. That is how `validate:helm` builds +them, into its run directory. + +To change a CRD or the Kubernetes version, edit `crds.json` or `config.json`, +then: + +```sh +npm run helm:build-crds # rewrites crds-lock.json; commit it +npm run validate:helm -- --all +npm run validate:helm -- --all --chart-mode declared +``` + +## Limits + +This checks values and resource schemas offline. It does not run CEL, +admission webhooks or controllers, and does not check images, model paths or +GPUs. diff --git a/schema/helm/config.json b/schema/crds/config.json similarity index 100% rename from schema/helm/config.json rename to schema/crds/config.json diff --git a/schema/helm/provenance.json b/schema/crds/crds-lock.json similarity index 100% rename from schema/helm/provenance.json rename to schema/crds/crds-lock.json diff --git a/schema/helm/sources.json b/schema/crds/crds.json similarity index 100% rename from schema/helm/sources.json rename to schema/crds/crds.json diff --git a/schema/helm/README.md b/schema/helm/README.md deleted file mode 100644 index fe1c23a..0000000 --- a/schema/helm/README.md +++ /dev/null @@ -1,172 +0,0 @@ -# Helm validation schemas - -`npm run validate:helm` checks every variant in selected model version YAMLs. -By default it downloads the **latest stable released** chart for each engine -from the official repository, lets Helm merge the chart defaults with -`variant.values`, runs `helm lint --strict` and -`helm template`, then runs `kubeconform -strict`. It never ignores missing -schemas. It does not build dependencies: the dependency charts in the released -package are the ones being checked. - -## Reproduce locally - -Use Node.js 24 (CI's version), `git`, and `tar`. macOS and Linux on AMD64/ARM64 -are supported by the installer. Versions and archive SHA-256 checksums are in -[`config.json`](config.json). - -```sh -npm ci -npm run helm:install -npm run validate:helm -- --base origin/master -npm run validate:helm -- --all -npm run validate:helm -- --all --chart-mode declared -npm run validate:helm -- models/glm5.3/glm5.3-1.0.1.yaml -npm run test:helm -npm run test:helm:integration -``` - -Without a selector, the base is `origin/HEAD`. `--base` compares committed HEAD -with the common ancestor of that ref and HEAD. Local uncommitted version edits -can be checked with explicit file paths or `--all`. Added/modified version -YAMLs and rename destinations are checked; deleted versions are excluded. -Metadata, reports, and documentation alone select no files. Changes to the -validator, its tests, dependency manifests, workflow, or this schema directory -select every version. All variants are checked, regardless of `default`. - -Only absent `values.modelRoute.nginx.outputConfigMap` is supplied with -`ci/openresty-conf`, with a log message. Explicit empty, null, or invalid values -are preserved. No feature is disabled to make validation pass. Missing `values` -means chart defaults plus that route placeholder. - -The repository index is freshly fetched once per invocation. The default -`--chart-mode latest` (also explicitly used in CI) selects the newest stable -release of `sglang >=0.8.0` or `vllm >=0.5.0` in that snapshot. Prereleases are -excluded. Future stable releases, including new minor or major versions, are -automatically selected on subsequent runs. All selected variants of the same -engine use the same release, even when their YAML pins an older chart or imposes -an upper bound. The latest selection is never reused across invocations. - -Helm separately resolves the YAML declaration and checks that its selected -release meets the configured minimum. A missing or invalid declared release -fails the check, and so does an obsolete one in a version that is new: added -since the base, or named explicitly. A published version keeps the chart it was -published with, so an obsolete declaration there is a warning: latest mode still -checks its values against the latest chart, and declared mode skips it, since -its chart renders API groups with no schema here. The YAML declaration continues to control -deployment; latest-mode validation checks forward compatibility and does not -change that declaration. `--chart-mode declared` renders the actual release -selected by the YAML constraint, for deployment compatibility and reproduction. -No matching latest release or a failed latest download causes a failure, with -no fallback to the declared chart. - -Each selected package is downloaded once and checked against the repository -index's SHA-256 digest. Every variant records the validation mode, original -declaration, resolved declaration version, validation chart version, selection -constraint and package digest. This checks the selected release at run time; -it does not guarantee all historical or future releases are compatible. - -The default artifact directory is `artifacts/helm-validation/`; override it with -`--output DIR`. `summary.json` identifies files, variants, actual chart versions, -mode, resolved declaration versions, stage results and per-variant artifact -directories. Each invocation has a fresh `run-*` directory with extracted values, -rendered manifests, tool logs, downloaded -charts, the CRD schemas it built, a schema cache and isolated Helm settings. CI uploads these artifacts -even on failure. Helm and kubeconform errors retain field paths. - -## Schema sources and updates - -[`sources.json`](sources.json) pins upstream CRDs to full commit SHAs. -[`provenance.json`](provenance.json) is the lock: source URLs, the SHA-256 of each -source file, served versions and schema filenames. The converted schemas are not -committed. Each `validate:helm` run builds them into its run directory with -`hack/build-crds.js`, which downloads every source at its locked commit and -refuses one whose bytes differ from the recorded hash. Modelsphere-owned CRDs use only -`routing.modelsphere.dev`, `autoscaling.modelsphere.dev` and -`inference.modelsphere.dev`. Each source declares its expected group and kind; -the generator rejects a mismatched CRD or a Modelsphere source whose group does -not end in `.modelsphere.dev`. - -New model versions declare `sglang` version `0.8.0` or newer and `vllm` -version `0.5.0` or newer, the first releases using these groups. Published -versions are not rewritten to match: their ranges already resolve above the -minimum, and their fixed pins (`glm5.3` 1.0.0, `kimi-k3` 1.0.0 and 1.0.1, -`qwen3.6-35b-a3b` 1.0.0) are each superseded by a later version. Legacy -`autoscaling.4pd.io` and `inference.x-k8s.io` schemas are removed; resources from -old charts fail validation rather than being rewritten or accepted through aliases. -External CRDs retain their upstream groups: `leaderworkerset.x-k8s.io` for -LeaderWorkerSet and `monitoring.coreos.com` for ServiceMonitor. - -Deployments using the old groups need the corresponding controllers, CRDs, -RBAC and resource objects migrated together. Existing objects under an old API -group do not automatically become objects under the new group. - -The converter is repository-versioned as `catalog-crd-schema-v1` in -[`hack/lib/crd-schema.js`](../../hack/lib/crd-schema.js), using the YAML parser -locked in `package-lock.json`. It converts all served versions, adds strictness -recursively to defined objects (including array items), preserves explicitly -typed maps and `x-kubernetes-preserve-unknown-fields`, handles nullable schemas -and Kubernetes `IntOrString`, and enforces full API group, version and kind. -Kubernetes supplies `metadata` implicitly for custom resources; the converter -adds the same pinned strict Kubernetes `ObjectMeta` and its required definitions -to each CRD schema, including CRDs that omit it. - -Native Kubernetes schemas use the configured `1.36.3` baseline and a pinned -`yannh/kubernetes-json-schema` commit. Helm uses the same version baseline. -Schema checking requires no cluster. Downloading tools, charts, native schemas -and CRD sources requires public network access. Every download honors -`HTTPS_PROXY`/`HTTP_PROXY`/`NO_PROXY`: Helm and kubeconform natively, and the Node -scripts through `hack/lib/download.js`. - -To update a source, edit its commit/path in `sources.json` (and the Kubernetes -commit/version in `config.json` when needed), then refresh the lock and verify: - -```sh -npm run helm:update-crds -npm run test:helm -npm run test:helm:integration -npm run validate:helm -- --all -npm run validate:helm -- --all --chart-mode declared -``` - -Review the lock change by comparing each upstream CRD between the old and new -commits; `node hack/build-crds.js DIR` writes the converted schemas for a closer -look. Conversion rule changes take effect on the next run; bump the converter -version, and refresh the lock, when changing an already deployed conversion -contract. Tool updates must also update archive checksums in `config.json`. - -The acceptance suite runs both latest and declared modes. It checks GLM's fixed -and ranged chart declarations, a fixed vLLM release, both Gemma variants, an LWS -deployment, default values, misspelled -fields, incorrect types, invalid Kubernetes nesting, invalid CRD fields, template errors, no matching -release, legacy chart rejection, and unknown/mismatched GVKs. Rendered custom -resources must use the canonical Modelsphere groups. Unit tests additionally -cover selection, future stable releases beyond fixed pins, prerelease exclusion, -package reuse, missing latest releases, CRD build and download failures, a missing chart values -schema, empty renders, published legacy declarations and failure propagation. - -## Rollout and limits - -The initial full-catalog run exposed a deadline/startup budget mismatch in the -`sglang-tp2-h100` variants of Qwen 3.6 versions `1.0.0` and `1.1.0`: -`progressDeadlineSeconds: 2000` was below the startup probe budget, -`180 × 30 = 5400` seconds. Both values have been deliberately corrected to -`7200`, matching this model's other variants and leaving 1800 seconds beyond -the probe budget. No validator exception is needed for these configurations. -This edits two published versions in place, so the Pages workflow requires -`allow_rewrites` when publishing it. - -After this workflow is merged and its check has run, add **`validate-helm`** to -the target branch's required status checks in GitHub branch protection/rulesets. -The job runs on every PR, without workflow path filters, so the required check -also completes for documentation-only PRs. - -This is offline compatibility validation of values and resource schemas. It -does not execute CEL, admission webhooks, or controller business logic, and -does not verify model paths, image pulls, engine arguments, or GPU execution. -Chart fields without constraints that never render cannot be fully checked here; -fix those constraints in the chart repository rather than duplicating the chart -contract in this catalog. - -References: [Helm schema validation](https://helm.sh/docs/v3/topics/charts/#schema-files), -[kubeconform custom schemas](https://github.com/yannh/kubeconform#customresourcedefinition-crd-support), -[kubeconform limits](https://github.com/yannh/kubeconform#limits-of-kubeconform-validation). From 84a2debb38201f9a9d5d2c8c144d8ae089a978e1 Mon Sep 17 00:00:00 2001 From: aceforeverd Date: Fri, 9 Oct 2026 00:00:38 +0800 Subject: [PATCH 7/8] use helm v4 --- hack/install-helm-tools.js | 37 ++++++++++++++++++------------------- hack/lib/download.js | 3 ++- hack/validate-helm.js | 8 +++++--- schema/crds/config.json | 10 +++++----- 4 files changed, 30 insertions(+), 28 deletions(-) diff --git a/hack/install-helm-tools.js b/hack/install-helm-tools.js index cab828b..189df7c 100644 --- a/hack/install-helm-tools.js +++ b/hack/install-helm-tools.js @@ -1,6 +1,8 @@ #!/usr/bin/env node "use strict"; +// Install the pinned helm and kubeconform into .cache/helm-validation/bin, +// refusing an archive whose sha256 differs from config.json. const fs = require("node:fs"); const path = require("node:path"); const crypto = require("node:crypto"); @@ -9,32 +11,29 @@ const {root} = require("./lib/catalog"); const {download} = require("./lib/download"); const config = require("../schema/crds/config.json"); +// Each tool's release archive, and the binary's path inside it. +const tools = { + helm: (version, platform) => [`https://get.helm.sh/helm-v${version}-${platform}.tar.gz`, `${platform}/helm`], + kubeconform: (version, platform) => + [`https://github.com/yannh/kubeconform/releases/download/v${version}/kubeconform-${platform}.tar.gz`, "kubeconform"], +}; + async function main() { const platform = `${process.platform}-${{x64: "amd64", arm64: "arm64"}[process.arch]}`; const sums = config.toolChecksums[platform]; if (!sums) throw new Error(`unsupported platform: ${platform}`); const output = path.join(root, ".cache/helm-validation/bin"); fs.mkdirSync(output, {recursive: true}); - for (const name of ["helm", "kubeconform"]) { + for (const [name, release] of Object.entries(tools)) { const version = config[`${name}Version`]; - const archive = name === "helm" ? `helm-v${version}-${platform}.tar.gz` : `kubeconform-${platform}.tar.gz`; - const url = name === "helm" ? `https://get.helm.sh/${archive}` : - `https://github.com/yannh/kubeconform/releases/download/v${version}/${archive}`; - const bytes = await download(url); - if (crypto.createHash("sha256").update(bytes).digest("hex") !== sums[name]) { - throw new Error(`${archive}: checksum mismatch`); - } - const temp = fs.mkdtempSync(path.join(output, ".install-")); - try { - const archivePath = path.join(temp, archive); - fs.writeFileSync(archivePath, bytes); - const member = name === "helm" ? `${platform}/helm` : "kubeconform"; - execFileSync("tar", ["-xzf", archivePath, "-C", temp, member]); - fs.copyFileSync(path.join(temp, member), path.join(output, name)); - fs.chmodSync(path.join(output, name), 0o755); - } finally { - fs.rmSync(temp, {recursive: true, force: true}); - } + const [url, member] = release(version, platform); + const archive = await download(url); + if (crypto.createHash("sha256").update(archive).digest("hex") !== sums[name]) throw new Error(`${url}: checksum mismatch`); + const binary = execFileSync("tar", ["-xzOf", "-", member], {input: archive, maxBuffer: 512 * 1024 * 1024}); + // Rename over the old binary: writing into one that is running fails. + const target = path.join(output, name); + fs.writeFileSync(`${target}.new`, binary, {mode: 0o755}); + fs.renameSync(`${target}.new`, target); console.log(`Installed ${name} ${version} (${platform}, sha256:${sums[name]})`); } } diff --git a/hack/lib/download.js b/hack/lib/download.js index 2321b45..40005ff 100644 --- a/hack/lib/download.js +++ b/hack/lib/download.js @@ -15,9 +15,10 @@ function useEnvProxy() { } } +// Covers the whole body: the helm archive is ~20 MB, slow through some proxies. async function download(url) { useEnvProxy(); - const response = await fetch(url, {signal: AbortSignal.timeout(60000)}); + const response = await fetch(url, {signal: AbortSignal.timeout(5 * 60 * 1000)}); if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`); return Buffer.from(await response.arrayBuffer()); } diff --git a/hack/validate-helm.js b/hack/validate-helm.js index 49adfcb..354d8ad 100644 --- a/hack/validate-helm.js +++ b/hack/validate-helm.js @@ -51,8 +51,8 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { const env = {...process.env, HELM_CONFIG_HOME: path.join(runDir, "helm/config"), HELM_CACHE_HOME: path.join(runDir, "helm/cache"), HELM_DATA_HOME: path.join(runDir, "helm/data"), HELM_PLUGINS: path.join(runDir, "helm/plugins")}; - const invoke = (tool, args, dir, stage) => { - const result = runCommand(tool, args, {cwd: root, env}); + const invoke = (tool, args, dir, stage, options = {}) => { + const result = runCommand(tool, args, {cwd: root, env, ...options}); fs.writeFileSync(path.join(dir, `${stage}.log`), result.log); return result; }; @@ -83,7 +83,9 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { // CRD schemas are not committed: build them from the lock for this run, // which must not rewrite it. const schemaDir = path.join(runDir, "crds"); - requireSuccess(invoke(process.execPath, [path.join(__dirname, "build-crds.js"), "--locked", schemaDir], runDir, "crds"), "crds"); + // Several downloads, each allowed minutes: outlast them rather than kill the build. + requireSuccess(invoke(process.execPath, [path.join(__dirname, "build-crds.js"), "--locked", schemaDir], runDir, "crds", + {timeout: 30 * 60 * 1000}), "crds"); const schemaCache = path.join(runDir, "schema-cache"); fs.mkdirSync(schemaCache); requireSuccess(invoke(bin("helm"), ["repo", "add", "catalog", config.chartRepository], runDir, "chart-repository"), "chart-repository"); diff --git a/schema/crds/config.json b/schema/crds/config.json index 37c3e60..637b8eb 100644 --- a/schema/crds/config.json +++ b/schema/crds/config.json @@ -1,5 +1,5 @@ { - "helmVersion": "3.20.2", + "helmVersion": "4.3.0", "kubeconformVersion": "0.8.0", "kubernetesVersion": "1.36.3", "chartRepository": "https://modelsphere.github.io/helm-charts/", @@ -11,19 +11,19 @@ "converterVersion": "catalog-crd-schema-v1", "toolChecksums": { "darwin-arm64": { - "helm": "139c794c22f16b579d08ddd3008c8038b9bb2814f35b5bcca91f50a1f458978d", + "helm": "d3870437e1e95b67f8edbde964156c84a26503f560821d40c542441658934fba", "kubeconform": "f84f4dfbebf4a6b0b230385fa065a39ea35e02608c2b50d025dcf64775a69d67" }, "darwin-amd64": { - "helm": "7de04301f28b902a74f6286ed941cadc86ee5e6a9086a18f2ccf1f548e99d618", + "helm": "347a784877e0e20eac865e8d1c36a80f6bb0861d6f29abd34defb6570ef95d92", "kubeconform": "71dbc87ac9f24099a62b93570e65aa06312ba6ac8aea63b7f86e9d999edf5a92" }, "linux-amd64": { - "helm": "258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea", + "helm": "86584a54def73570558f66f5111cc53dfed56689637ae32c1201205d494f54fb", "kubeconform": "9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883" }, "linux-arm64": { - "helm": "5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691", + "helm": "31c5794dd55c66a51e6b7d2e2ac7a114ae8b1de41ff1d9ba51748ac973b06a08", "kubeconform": "1f53fc8e81258197a35e8603054162a5af1de8c5af13746c71ab680d9534ed87" } } From a7ac2d022b130cc9462140f016da4fe97ea0eef9 Mon Sep 17 00:00:00 2001 From: aceforeverd Date: Fri, 9 Oct 2026 09:30:28 +0800 Subject: [PATCH 8/8] simplify things --- hack/build-crds.js | 8 ++-- hack/lib/catalog.js | 10 ++--- hack/lib/crd-schema.js | 5 +-- hack/lib/download.js | 14 +----- hack/lib/helm-validation.js | 77 +++++++------------------------- hack/lib/helm-validation.test.js | 24 ++-------- hack/validate-helm.js | 19 ++++---- hack/validate-helm.test.js | 15 +++++-- hack/validate-schema.js | 18 ++++++++ schema/crds/README.md | 5 ++- schema/crds/ci-values.yaml | 5 +++ schema/crds/config.json | 1 - schema/crds/crds-lock.json | 1 - 13 files changed, 77 insertions(+), 125 deletions(-) create mode 100644 schema/crds/ci-values.yaml diff --git a/hack/build-crds.js b/hack/build-crds.js index 1d01480..3ddb232 100644 --- a/hack/build-crds.js +++ b/hack/build-crds.js @@ -10,7 +10,7 @@ const fs = require("node:fs"); const path = require("node:path"); const {root} = require("./lib/catalog"); -const {CONVERTER_VERSION, buildSchemas} = require("./lib/crd-schema"); +const {buildSchemas} = require("./lib/crd-schema"); const config = require("../schema/crds/config.json"); const {sources} = require("../schema/crds/crds.json"); @@ -26,15 +26,13 @@ async function main(args) { const locked = args.includes("--locked"); const rest = args.filter((arg) => arg !== "--locked"); if (rest.length > 1 || rest.some((arg) => arg.startsWith("-"))) throw new Error("usage: build-crds.js [--locked] [DIR]"); - if (config.converterVersion !== CONVERTER_VERSION) throw new Error("converter version mismatch"); const text = fs.existsSync(lockFile) ? fs.readFileSync(lockFile, "utf8") : null; const lock = text && JSON.parse(text); - const current = lock?.converterVersion === CONVERTER_VERSION && lock.objectMeta?.url === objectMetaUrl && - pins(lock.sources) === pins(sources); + const current = lock?.objectMeta?.url === objectMetaUrl && pins(lock.sources) === pins(sources); const stale = `${path.relative(root, lockFile)} is out of date; run npm run helm:build-crds and commit it`; if (!current && locked) throw new Error(stale); const built = current ? await buildSchemas(lock.sources, lock.objectMeta) : await buildSchemas(sources, {url: objectMetaUrl}); - const next = JSON.stringify({converterVersion: CONVERTER_VERSION, objectMeta: built.objectMeta, sources: built.records}, null, 2) + "\n"; + const next = JSON.stringify({objectMeta: built.objectMeta, sources: built.records}, null, 2) + "\n"; if (next !== text) { if (locked) throw new Error(stale); fs.writeFileSync(lockFile, next); diff --git a/hack/lib/catalog.js b/hack/lib/catalog.js index b1efe98..cc78c7e 100644 --- a/hack/lib/catalog.js +++ b/hack/lib/catalog.js @@ -15,18 +15,18 @@ function readYaml(p) { } // Model directory names, sorted. -function modelNames() { +function modelNames(dir = modelsDir) { return fs - .readdirSync(modelsDir) - .filter((name) => fs.statSync(path.join(modelsDir, name)).isDirectory()) + .readdirSync(dir) + .filter((name) => fs.statSync(path.join(dir, name)).isDirectory()) .sort(); } // A model's version files (-.yaml), as repo-relative paths. // metadata.yaml has no "-", which is what tells the two apart. -function versionFiles(name) { +function versionFiles(name, dir = modelsDir) { return fs - .readdirSync(path.join(modelsDir, name)) + .readdirSync(path.join(dir, name)) .filter((f) => f.endsWith(".yaml") && f.includes("-")) .sort() .map((f) => `models/${name}/${f}`); diff --git a/hack/lib/crd-schema.js b/hack/lib/crd-schema.js index 2bb0e14..5d3bfd8 100644 --- a/hack/lib/crd-schema.js +++ b/hack/lib/crd-schema.js @@ -4,9 +4,6 @@ const crypto = require("node:crypto"); const YAML = require("yaml"); const {download} = require("./download"); -// Versioned with the repository; changing this contract requires regeneration. -const CONVERTER_VERSION = "catalog-crd-schema-v1"; - function assertCrdSource(source, crd) { if (source.repository.startsWith("modelsphere/") && !source.group?.endsWith(".modelsphere.dev")) { throw new Error(`${source.repository}: Modelsphere CRDs must use a .modelsphere.dev API group`); @@ -127,4 +124,4 @@ async function buildSchemas(sources, objectMeta) { return {files, objectMeta: {url: objectMeta.url, sha256: meta.sha256}, records}; } -module.exports = {CONVERTER_VERSION, assertCrdSource, convertSchema, crdSchemas, objectMetaSchema, buildSchemas}; +module.exports = {assertCrdSource, convertSchema, crdSchemas, objectMetaSchema, buildSchemas}; diff --git a/hack/lib/download.js b/hack/lib/download.js index 40005ff..0fb45ac 100644 --- a/hack/lib/download.js +++ b/hack/lib/download.js @@ -2,22 +2,12 @@ const http = require("node:http"); -let proxied = false; - // fetch() ignores HTTPS_PROXY and friends unless told to, unlike curl, helm and -// kubeconform. Honor them the same way; without a proxy variable this is a no-op. -function useEnvProxy() { - if (proxied) return; - proxied = true; - if (typeof http.setGlobalProxyFromEnv === "function") http.setGlobalProxyFromEnv(); - else if (["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"].some((name) => process.env[name])) { - console.warn(`Node ${process.version} cannot route fetch() through the proxy variables; set NODE_USE_ENV_PROXY=1 or upgrade Node.`); - } -} +// kubeconform. Honor them the same way; without a proxy variable this changes nothing. +http.setGlobalProxyFromEnv?.(); // Covers the whole body: the helm archive is ~20 MB, slow through some proxies. async function download(url) { - useEnvProxy(); const response = await fetch(url, {signal: AbortSignal.timeout(5 * 60 * 1000)}); if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`); return Buffer.from(await response.arrayBuffer()); diff --git a/hack/lib/helm-validation.js b/hack/lib/helm-validation.js index dcc96ac..e392f3b 100644 --- a/hack/lib/helm-validation.js +++ b/hack/lib/helm-validation.js @@ -4,10 +4,7 @@ const fs = require("node:fs"); const path = require("node:path"); const {spawnSync} = require("node:child_process"); const YAML = require("yaml"); - -function isVersionFile(file) { - return /^models\/[^/]+\/[^/]+\.ya?ml$/.test(file) && !/\/metadata\.ya?ml$/.test(file); -} +const {modelNames, versionFiles} = require("./catalog"); function affectsValidator(file) { return file.startsWith("schema/crds/") || @@ -31,29 +28,18 @@ function git(root, args) { return result.stdout; } -function allVersionFiles(root) { - function walk(dir) { - return fs.readdirSync(path.join(root, dir), {withFileTypes: true}).flatMap((entry) => { - const file = `${dir}/${entry.name}`; - return entry.isDirectory() ? walk(file) : isVersionFile(file) ? [file] : []; - }); - } - return walk("models").sort(); -} - // Keep both sides of renames for validator-change detection. NUL delimiters -// preserve filenames with whitespace; missing old/deleted model paths are excluded. +// preserve filenames with whitespace; deleted versions are not selected. // `added` lists the new versions, held to the chart minimum: a published version // keeps the chart it was published with. Explicit files are checked as new. function selectFiles(root, {all = false, base = "origin/HEAD", files = []} = {}) { - if (all) return {files: allVersionFiles(root), added: [], reason: "--all"}; + const models = path.join(root, "models"); + const versions = modelNames(models).flatMap((name) => versionFiles(name, models)); + if (all) return {files: versions, added: [], reason: "--all"}; if (files.length) { - const selected = files.map((file) => path.relative(root, path.resolve(root, file)).split(path.sep).join("/")); - if (selected.some((file) => !isVersionFile(file) || !fs.existsSync(path.join(root, file)))) { - throw new Error("explicit files must be existing model version YAMLs under models/"); - } - const unique = [...new Set(selected)].sort(); - return {files: unique, added: unique, reason: "explicit files"}; + const selected = [...new Set(files.map((file) => path.relative(root, path.resolve(root, file)).split(path.sep).join("/")))].sort(); + if (selected.some((file) => !versions.includes(file))) throw new Error("explicit files must be existing model version YAMLs under models/"); + return {files: selected, added: selected, reason: "explicit files"}; } const mergeBase = git(root, ["merge-base", base, "HEAD"]).trim(); const tokens = git(root, ["diff", "--name-status", "-z", "--find-renames", mergeBase, "HEAD"]).split("\0"); @@ -65,30 +51,11 @@ function selectFiles(root, {all = false, base = "origin/HEAD", files = []} = {}) if (/^[RC]/.test(status)) changed.push(tokens[i++]); if (/^[ARC]/.test(status)) added.push(changed.at(-1)); } - const versions = (list) => [...new Set(list.filter((file) => isVersionFile(file) && fs.existsSync(path.join(root, file))))].sort(); + const among = (list) => versions.filter((file) => list.includes(file)); if (changed.some(affectsValidator)) { - return {files: allVersionFiles(root), added: versions(added), reason: "validator/dependency/schema changes", mergeBase}; + return {files: versions, added: among(added), reason: "validator/dependency/schema changes", mergeBase}; } - return {files: versions(changed), added: versions(added), reason: `changes since merge-base with ${base}`, mergeBase}; -} - -function isObject(value) { - return value !== null && typeof value === "object" && !Array.isArray(value); -} - -function variantValues(variant) { - const values = variant.values === undefined ? {} : structuredClone(variant.values); - if (!isObject(values)) throw new Error("variants[].values: must be an object"); - let injected = false; - if (values.modelRoute === undefined) values.modelRoute = {}; - if (isObject(values.modelRoute)) { - if (values.modelRoute.nginx === undefined) values.modelRoute.nginx = {}; - if (isObject(values.modelRoute.nginx) && !Object.hasOwn(values.modelRoute.nginx, "outputConfigMap")) { - values.modelRoute.nginx.outputConfigMap = "ci/openresty-conf"; - injected = true; - } - } - return {values, injected}; + return {files: among(changed), added: among(added), reason: `changes since merge-base with ${base}`, mergeBase}; } function kubeconformArgs(config, schemaDir, cacheDir, rendered) { @@ -101,22 +68,12 @@ function kubeconformArgs(config, schemaDir, cacheDir, rendered) { "{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json", rendered]; } +// validate:schema owns a version file's shape; this only refuses to pass a file +// with nothing to render. function parseVersions(file) { - const doc = YAML.parse(fs.readFileSync(file, "utf8")); - if (!Array.isArray(doc?.variants) || !doc.variants.length) throw new Error("variants: expected a nonempty array"); - const ids = new Set(); - for (const [index, variant] of doc.variants.entries()) { - if (!isObject(variant) || typeof variant.id !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(variant.id)) { - throw new Error(`variants[${index}].id: invalid variant id`); - } - if (ids.has(variant.id)) throw new Error(`variants[${index}].id: duplicate ${variant.id}`); - ids.add(variant.id); - if (!/^[a-z0-9][a-z0-9-]*$/.test(variant.chart?.name ?? "") || - typeof variant.chart?.version !== "string" || !variant.chart.version.trim()) { - throw new Error(`variants[${index}].chart: expected name and version constraint`); - } - } - return doc.variants; + const variants = YAML.parse(fs.readFileSync(file, "utf8"))?.variants; + if (!Array.isArray(variants) || !variants.length) throw new Error("variants: expected a nonempty array"); + return variants; } -module.exports = {command, selectFiles, isVersionFile, affectsValidator, variantValues, kubeconformArgs, parseVersions}; +module.exports = {command, selectFiles, affectsValidator, kubeconformArgs, parseVersions}; diff --git a/hack/lib/helm-validation.test.js b/hack/lib/helm-validation.test.js index 783554c..2f9cf91 100644 --- a/hack/lib/helm-validation.test.js +++ b/hack/lib/helm-validation.test.js @@ -6,7 +6,7 @@ const fs = require("node:fs"); const os = require("node:os"); const path = require("node:path"); const {execFileSync} = require("node:child_process"); -const {selectFiles, variantValues, kubeconformArgs} = require("./helm-validation"); +const {selectFiles, kubeconformArgs} = require("./helm-validation"); const config = require("../../schema/crds/config.json"); function repository(t) { @@ -39,11 +39,11 @@ test("add, modify and rename destinations are selected; deletions are excluded", const r = repository(t); r.write("models/example/example-1.1.0.yaml"); r.commit(); r.git("branch", "before"); - r.git("mv", "models/example/example-1.0.0.yaml", "models/example/renamed version-1.0.0.yml"); + r.git("mv", "models/example/example-1.0.0.yaml", "models/example/renamed version-1.0.0.yaml"); r.write("models/example/example-1.1.0.yaml", "modified\n"); r.write("models/example/example-1.2.0.yaml"); r.commit(); assert.deepEqual(selectFiles(r.dir, {base: "before"}).files, [ - "models/example/example-1.1.0.yaml", "models/example/example-1.2.0.yaml", "models/example/renamed version-1.0.0.yml"]); + "models/example/example-1.1.0.yaml", "models/example/example-1.2.0.yaml", "models/example/renamed version-1.0.0.yaml"]); r.git("rm", "models/example/example-1.2.0.yaml"); r.commit(); assert(!selectFiles(r.dir, {base: "before"}).files.includes("models/example/example-1.2.0.yaml")); }); @@ -87,24 +87,6 @@ test("unknown base fails rather than reporting no changes", (t) => { assert.throws(() => selectFiles(r.dir, {base: "missing-ref"})); }); -test("only an absent route output is supplied; explicit invalid values survive", () => { - const original = {values: {extraArgs: ["--x"], modelRoute: {nginx: {outputConfigMap: ""}}}}; - assert.equal(variantValues(original).injected, false); - assert.equal(variantValues(original).values.modelRoute.nginx.outputConfigMap, ""); - for (const value of [null, false, 17]) { - assert.equal(variantValues({values: {modelRoute: {nginx: {outputConfigMap: value}}}}).values.modelRoute.nginx.outputConfigMap, value); - } - const defaults = variantValues({}); - assert.equal(defaults.values.modelRoute.nginx.outputConfigMap, "ci/openresty-conf"); - assert.equal(defaults.values.scaler, undefined); - assert.equal(defaults.values.cart, undefined); - const variant = {values: {env: [{name: "VALUE", value: "test"}]}}; - variantValues(variant); - assert.deepEqual(variant, {values: {env: [{name: "VALUE", value: "test"}]}}); - assert.throws(() => variantValues({values: null})); - assert.equal(variantValues({values: {modelRoute: null}}).values.modelRoute, null); -}); - test("strict validation uses full group and pinned native schema without missing-schema bypass", () => { const args = kubeconformArgs(config, "/schemas", "/cache", "/rendered.yaml"); assert(args.includes("-strict")); diff --git a/hack/validate-helm.js b/hack/validate-helm.js index 354d8ad..fbe37d4 100644 --- a/hack/validate-helm.js +++ b/hack/validate-helm.js @@ -6,7 +6,7 @@ const path = require("node:path"); const crypto = require("node:crypto"); const YAML = require("yaml"); const {root, compareVersions, isPrerelease} = require("./lib/catalog"); -const {command, selectFiles, variantValues, kubeconformArgs, parseVersions} = require("./lib/helm-validation"); +const {command, selectFiles, kubeconformArgs, parseVersions} = require("./lib/helm-validation"); const config = require("../schema/crds/config.json"); function options(args) { @@ -77,15 +77,15 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { throw new Error(`${name}: expected ${config[`${name}Version`]}, got ${version}; run npm run helm:install`); } } - const lock = JSON.parse(fs.readFileSync(path.join(root, "schema/crds/crds-lock.json"), "utf8")); - if (lock.converterVersion !== config.converterVersion) throw new Error("CRD converter version mismatch"); - const apis = [...new Set(lock.sources.flatMap((source) => source.schemas.map((s) => `${s.group}/${s.version}`)))]; // CRD schemas are not committed: build them from the lock for this run, // which must not rewrite it. const schemaDir = path.join(runDir, "crds"); // Several downloads, each allowed minutes: outlast them rather than kill the build. requireSuccess(invoke(process.execPath, [path.join(__dirname, "build-crds.js"), "--locked", schemaDir], runDir, "crds", {timeout: 30 * 60 * 1000}), "crds"); + // Each schema is /_.json: the API versions Helm may render. + const apis = fs.readdirSync(schemaDir).flatMap((group) => fs.readdirSync(path.join(schemaDir, group)) + .map((file) => `${group}/${file.slice(file.lastIndexOf("_") + 1, -".json".length)}`)); const schemaCache = path.join(runDir, "schema-cache"); fs.mkdirSync(schemaCache); requireSuccess(invoke(bin("helm"), ["repo", "add", "catalog", config.chartRepository], runDir, "chart-repository"), "chart-repository"); @@ -171,11 +171,9 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { summary.results.push(record); let stage = "values"; try { - const {values, injected} = variantValues(variant); - record.injectedRouteConfig = injected; - if (injected) log(`${label}: supplying absent values.modelRoute.nginx.outputConfigMap=ci/openresty-conf`); - const valuesFile = path.join(dir, "values.yaml"); - fs.writeFileSync(valuesFile, YAML.stringify(values)); + // JSON, not YAML: Helm reads YAML 1.1, where an unquoted on, no or yes is a boolean. + const valuesFile = path.join(dir, "values.json"); + fs.writeFileSync(valuesFile, JSON.stringify(variant.values ?? {}, null, 2) + "\n"); stage = "chart"; const pkg = chartFor(variant.chart, dir); if (pkg.legacy) { @@ -195,7 +193,8 @@ function main(opts, {repositoryRoot = root, runCommand = command} = {}) { mode: chartMode, declaredVersion: pkg.declaredVersion, selectionConstraint: pkg.selectionConstraint}; log(`${label}: declared ${pkg.name} ${variant.chart.version} -> ${pkg.declaredVersion}; validating ${chartMode} chart ${pkg.name}@${pkg.actualVersion} ${pkg.digest}`); fs.writeFileSync(path.join(dir, "chart.json"), JSON.stringify(record.chart, null, 2) + "\n"); - const shared = ["--values", valuesFile, "--kube-version", config.kubernetesVersion]; + const shared = ["--values", path.join(root, "schema/crds/ci-values.yaml"), "--values", valuesFile, + "--kube-version", config.kubernetesVersion]; // Run both stages even when lint fails: template can expose separate failures. stage = "lint"; const lint = invoke(bin("helm"), ["lint", pkg.archive, "--strict", ...shared], dir, "lint"); diff --git a/hack/validate-helm.test.js b/hack/validate-helm.test.js index 1eacab1..a3cb69e 100644 --- a/hack/validate-helm.test.js +++ b/hack/validate-helm.test.js @@ -19,8 +19,6 @@ function fixture(t, failure, {chartName = "sglang", declaredVersion = "0.8.0", l {id: "default", default: true, chart: {name: chartName, version: declaredVersion}}, {id: "other", chart: {name: chartName, version: `>=${config.minimumChartVersions[chartName]}`}, values: {extraArgs: ["--other"]}} ]})); - fs.mkdirSync(path.join(root, "schema/crds"), {recursive: true}); - fs.writeFileSync(path.join(root, "schema/crds/crds-lock.json"), JSON.stringify({converterVersion: config.converterVersion, sources: []})); const calls = []; const bytes = Buffer.from("fixture-package"); let prereleaseInserted = false; @@ -51,6 +49,10 @@ function fixture(t, failure, {chartName = "sglang", declaredVersion = "0.8.0", l else if (args[0] === "-tzf") stdout = failure === "schema" ? `${chartName}/Chart.yaml\n` : `${chartName}/Chart.yaml\n${chartName}/values.schema.json\n`; else if (args[0] === "show") stdout = YAML.stringify({name: chartName, version: path.basename(args.at(-1)).slice(chartName.length + 1, -4)}); + else if (args[0].endsWith("build-crds.js")) { + fs.mkdirSync(path.join(args.at(-1), "example.dev"), {recursive: true}); + fs.writeFileSync(path.join(args.at(-1), "example.dev/widget_v1alpha1.json"), "{}"); + } else if (args[0] === "template") stdout = failure === "empty" ? "" : "apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: example\n"; const stage = args[0] === "-strict" ? "kubeconform" : args[0] === "pull" ? "download" : args[0].endsWith("build-crds.js") ? "crds" : args[0]; @@ -70,10 +72,15 @@ test("every variant uses independent values and the resolved package is reused", assert.equal(s.results.length, 2); assert(s.results.every((r) => r.ok && r.chart.version === "0.8.0" && r.chart.digest.startsWith("sha256:"))); assert.equal(f.calls.filter((a) => a[0] === "pull").length, 1); - const values = s.results.map((r) => YAML.parse(fs.readFileSync(path.join(f.root, r.artifacts, "values.yaml"), "utf8"))); + const values = s.results.map((r) => JSON.parse(fs.readFileSync(path.join(f.root, r.artifacts, "values.json"), "utf8"))); assert.equal(values[0].extraArgs, undefined); assert.deepEqual(values[1].extraArgs, ["--other"]); - assert(f.calls.filter((a) => ["lint", "template"].includes(a[0])).every((a) => a.includes(config.kubernetesVersion))); + // CI values come first, so a variant's own value overrides them. + const ci = path.join(f.root, "schema/crds/ci-values.yaml"); + assert(f.calls.filter((a) => ["lint", "template"].includes(a[0])).every((a) => a.includes(config.kubernetesVersion) && + a.indexOf(ci) > 0 && a.indexOf(ci) < a.findIndex((arg) => arg.endsWith("values.json")))); + // Helm may render exactly the CRD API versions that were built. + assert(f.calls.filter((a) => a[0] === "template").every((a) => a[a.indexOf("--api-versions") + 1] === "example.dev/v1alpha1")); }); for (const [chartName, declaredVersion, latestVersion] of [["sglang", "0.8.0", "1.2.0"], ["vllm", "0.5.0", "1.3.0"]]) { diff --git a/hack/validate-schema.js b/hack/validate-schema.js index 754535f..07953a8 100644 --- a/hack/validate-schema.js +++ b/hack/validate-schema.js @@ -132,6 +132,24 @@ for (const check of checks) { } } +// What the schema cannot see: a variant id is unique within its version. A +// deploy, a tuning entry and validate:helm all name a variant by it. +for (const file of versionFilePaths) { + let variants + try { + variants = YAML.parse(fs.readFileSync(file, "utf8"))?.variants + } catch { + continue // a parse error is already reported above + } + if (!Array.isArray(variants)) continue + const ids = variants.map((v) => v?.id) + const twice = [...new Set(ids.filter((id, i) => ids.indexOf(id) !== i))] + if (twice.length > 0) { + failed = true + report(path.relative(root, file), twice.map((id) => `variants: id ${JSON.stringify(id)} is used twice`)) + } +} + // What the schema cannot see: a tuning pair must name a published version of // its model, two different variants of that version, and a report that exists; // and a variant named as tuned must have its result recorded. swiss does not diff --git a/schema/crds/README.md b/schema/crds/README.md index f34702a..c2aa21d 100644 --- a/schema/crds/README.md +++ b/schema/crds/README.md @@ -36,14 +36,15 @@ directory holding each variant's values, rendered manifests and tool logs. first releases on the `*.modelsphere.dev` API groups). A new version below it fails. A published version below it only warns, or is skipped in declared mode: published versions are never rewritten. -- **Values**: used as written, except an absent - `modelRoute.nginx.outputConfigMap`, which is set to `ci/openresty-conf`. +- **Values**: each variant's values, layered over + [`ci-values.yaml`](ci-values.yaml), which stands in for a deploy's site profile. ## Files | File | Holds | | --- | --- | | [`config.json`](config.json) | tool versions and checksums, Kubernetes version, chart repository, minimum chart versions | +| [`ci-values.yaml`](ci-values.yaml) | values a site profile supplies, which CI has no site for | | [`crds.json`](crds.json) | the CRDs to validate against, each pinned to an upstream commit | | [`crds-lock.json`](crds-lock.json) | the sha256 of each pinned CRD and the schemas it yields; written by `build-crds` | diff --git a/schema/crds/ci-values.yaml b/schema/crds/ci-values.yaml new file mode 100644 index 0000000..b537d96 --- /dev/null +++ b/schema/crds/ci-values.yaml @@ -0,0 +1,5 @@ +# What a deploy's site profile supplies and CI has no site for. validate:helm +# layers each variant's values over this file, so a variant's own value wins. +modelRoute: + nginx: + outputConfigMap: ci/openresty-conf diff --git a/schema/crds/config.json b/schema/crds/config.json index 637b8eb..c56b702 100644 --- a/schema/crds/config.json +++ b/schema/crds/config.json @@ -8,7 +8,6 @@ "vllm": "0.5.0" }, "kubernetesSchemaCommit": "39a87cd29966bc0b3434e8cfbc2061782c8cb69a", - "converterVersion": "catalog-crd-schema-v1", "toolChecksums": { "darwin-arm64": { "helm": "d3870437e1e95b67f8edbde964156c84a26503f560821d40c542441658934fba", diff --git a/schema/crds/crds-lock.json b/schema/crds/crds-lock.json index 27c1683..ed63b8b 100644 --- a/schema/crds/crds-lock.json +++ b/schema/crds/crds-lock.json @@ -1,5 +1,4 @@ { - "converterVersion": "catalog-crd-schema-v1", "objectMeta": { "url": "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/39a87cd29966bc0b3434e8cfbc2061782c8cb69a/v1.36.3-standalone-strict/_definitions.json", "sha256": "ed76a6bccfa27ff085c390952d64267a18c91beb045b3e33117d482e26510cf3"