|
5
|
1 # Copyright 2022 The cert-manager Authors.
|
|
|
2 #
|
|
|
3 # Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
4 # you may not use this file except in compliance with the License.
|
|
|
5 # You may obtain a copy of the License at
|
|
|
6 #
|
|
|
7 # http://www.apache.org/licenses/LICENSE-2.0
|
|
|
8 #
|
|
|
9 # Unless required by applicable law or agreed to in writing, software
|
|
|
10 # distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
12 # See the License for the specific language governing permissions and
|
|
|
13 # limitations under the License.
|
|
|
14
|
|
|
15 apiVersion: v1
|
|
|
16 kind: Namespace
|
|
|
17 metadata:
|
|
|
18 name: cert-manager
|
|
|
19 ---
|
|
|
20 # Source: cert-manager/templates/crds.yaml
|
|
|
21 apiVersion: apiextensions.k8s.io/v1
|
|
|
22 kind: CustomResourceDefinition
|
|
|
23 metadata:
|
|
|
24 name: clusterissuers.cert-manager.io
|
|
|
25 labels:
|
|
|
26 app: 'cert-manager'
|
|
|
27 app.kubernetes.io/name: 'cert-manager'
|
|
|
28 app.kubernetes.io/instance: 'cert-manager'
|
|
|
29 # Generated labels
|
|
|
30 app.kubernetes.io/version: "v1.10.1"
|
|
|
31 spec:
|
|
|
32 group: cert-manager.io
|
|
|
33 names:
|
|
|
34 kind: ClusterIssuer
|
|
|
35 listKind: ClusterIssuerList
|
|
|
36 plural: clusterissuers
|
|
|
37 singular: clusterissuer
|
|
|
38 categories:
|
|
|
39 - cert-manager
|
|
|
40 scope: Cluster
|
|
|
41 versions:
|
|
|
42 - name: v1
|
|
|
43 subresources:
|
|
|
44 status: {}
|
|
|
45 additionalPrinterColumns:
|
|
|
46 - jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
47 name: Ready
|
|
|
48 type: string
|
|
|
49 - jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
50 name: Status
|
|
|
51 priority: 1
|
|
|
52 type: string
|
|
|
53 - jsonPath: .metadata.creationTimestamp
|
|
|
54 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
|
|
|
55 name: Age
|
|
|
56 type: date
|
|
|
57 schema:
|
|
|
58 openAPIV3Schema:
|
|
|
59 description: A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent.
|
|
|
60 type: object
|
|
|
61 required:
|
|
|
62 - spec
|
|
|
63 properties:
|
|
|
64 apiVersion:
|
|
|
65 description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
66 type: string
|
|
|
67 kind:
|
|
|
68 description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
69 type: string
|
|
|
70 metadata:
|
|
|
71 type: object
|
|
|
72 spec:
|
|
|
73 description: Desired state of the ClusterIssuer resource.
|
|
|
74 type: object
|
|
|
75 properties:
|
|
|
76 acme:
|
|
|
77 description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates.
|
|
|
78 type: object
|
|
|
79 required:
|
|
|
80 - privateKeySecretRef
|
|
|
81 - server
|
|
|
82 properties:
|
|
|
83 disableAccountKeyGeneration:
|
|
|
84 description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false.
|
|
|
85 type: boolean
|
|
|
86 email:
|
|
|
87 description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered.
|
|
|
88 type: string
|
|
|
89 enableDurationFeature:
|
|
|
90 description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false.
|
|
|
91 type: boolean
|
|
|
92 externalAccountBinding:
|
|
|
93 description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account.
|
|
|
94 type: object
|
|
|
95 required:
|
|
|
96 - keyID
|
|
|
97 - keySecretRef
|
|
|
98 properties:
|
|
|
99 keyAlgorithm:
|
|
|
100 description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.'
|
|
|
101 type: string
|
|
|
102 enum:
|
|
|
103 - HS256
|
|
|
104 - HS384
|
|
|
105 - HS512
|
|
|
106 keyID:
|
|
|
107 description: keyID is the ID of the CA key that the External Account is bound to.
|
|
|
108 type: string
|
|
|
109 keySecretRef:
|
|
|
110 description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data.
|
|
|
111 type: object
|
|
|
112 required:
|
|
|
113 - name
|
|
|
114 properties:
|
|
|
115 key:
|
|
|
116 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
117 type: string
|
|
|
118 name:
|
|
|
119 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
120 type: string
|
|
|
121 preferredChain:
|
|
|
122 description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN'
|
|
|
123 type: string
|
|
|
124 maxLength: 64
|
|
|
125 privateKeySecretRef:
|
|
|
126 description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used.
|
|
|
127 type: object
|
|
|
128 required:
|
|
|
129 - name
|
|
|
130 properties:
|
|
|
131 key:
|
|
|
132 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
133 type: string
|
|
|
134 name:
|
|
|
135 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
136 type: string
|
|
|
137 server:
|
|
|
138 description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.'
|
|
|
139 type: string
|
|
|
140 skipTLSVerify:
|
|
|
141 description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false.
|
|
|
142 type: boolean
|
|
|
143 solvers:
|
|
|
144 description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/'
|
|
|
145 type: array
|
|
|
146 items:
|
|
|
147 description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided.
|
|
|
148 type: object
|
|
|
149 properties:
|
|
|
150 dns01:
|
|
|
151 description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow.
|
|
|
152 type: object
|
|
|
153 properties:
|
|
|
154 acmeDNS:
|
|
|
155 description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records.
|
|
|
156 type: object
|
|
|
157 required:
|
|
|
158 - accountSecretRef
|
|
|
159 - host
|
|
|
160 properties:
|
|
|
161 accountSecretRef:
|
|
|
162 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
163 type: object
|
|
|
164 required:
|
|
|
165 - name
|
|
|
166 properties:
|
|
|
167 key:
|
|
|
168 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
169 type: string
|
|
|
170 name:
|
|
|
171 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
172 type: string
|
|
|
173 host:
|
|
|
174 type: string
|
|
|
175 akamai:
|
|
|
176 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
|
|
|
177 type: object
|
|
|
178 required:
|
|
|
179 - accessTokenSecretRef
|
|
|
180 - clientSecretSecretRef
|
|
|
181 - clientTokenSecretRef
|
|
|
182 - serviceConsumerDomain
|
|
|
183 properties:
|
|
|
184 accessTokenSecretRef:
|
|
|
185 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
186 type: object
|
|
|
187 required:
|
|
|
188 - name
|
|
|
189 properties:
|
|
|
190 key:
|
|
|
191 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
192 type: string
|
|
|
193 name:
|
|
|
194 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
195 type: string
|
|
|
196 clientSecretSecretRef:
|
|
|
197 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
198 type: object
|
|
|
199 required:
|
|
|
200 - name
|
|
|
201 properties:
|
|
|
202 key:
|
|
|
203 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
204 type: string
|
|
|
205 name:
|
|
|
206 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
207 type: string
|
|
|
208 clientTokenSecretRef:
|
|
|
209 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
210 type: object
|
|
|
211 required:
|
|
|
212 - name
|
|
|
213 properties:
|
|
|
214 key:
|
|
|
215 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
216 type: string
|
|
|
217 name:
|
|
|
218 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
219 type: string
|
|
|
220 serviceConsumerDomain:
|
|
|
221 type: string
|
|
|
222 azureDNS:
|
|
|
223 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
|
|
|
224 type: object
|
|
|
225 required:
|
|
|
226 - resourceGroupName
|
|
|
227 - subscriptionID
|
|
|
228 properties:
|
|
|
229 clientID:
|
|
|
230 description: if both this and ClientSecret are left unset MSI will be used
|
|
|
231 type: string
|
|
|
232 clientSecretSecretRef:
|
|
|
233 description: if both this and ClientID are left unset MSI will be used
|
|
|
234 type: object
|
|
|
235 required:
|
|
|
236 - name
|
|
|
237 properties:
|
|
|
238 key:
|
|
|
239 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
240 type: string
|
|
|
241 name:
|
|
|
242 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
243 type: string
|
|
|
244 environment:
|
|
|
245 description: name of the Azure environment (default AzurePublicCloud)
|
|
|
246 type: string
|
|
|
247 enum:
|
|
|
248 - AzurePublicCloud
|
|
|
249 - AzureChinaCloud
|
|
|
250 - AzureGermanCloud
|
|
|
251 - AzureUSGovernmentCloud
|
|
|
252 hostedZoneName:
|
|
|
253 description: name of the DNS zone that should be used
|
|
|
254 type: string
|
|
|
255 managedIdentity:
|
|
|
256 description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID
|
|
|
257 type: object
|
|
|
258 properties:
|
|
|
259 clientID:
|
|
|
260 description: client ID of the managed identity, can not be used at the same time as resourceID
|
|
|
261 type: string
|
|
|
262 resourceID:
|
|
|
263 description: resource ID of the managed identity, can not be used at the same time as clientID
|
|
|
264 type: string
|
|
|
265 resourceGroupName:
|
|
|
266 description: resource group the DNS zone is located in
|
|
|
267 type: string
|
|
|
268 subscriptionID:
|
|
|
269 description: ID of the Azure subscription
|
|
|
270 type: string
|
|
|
271 tenantID:
|
|
|
272 description: when specifying ClientID and ClientSecret then this field is also needed
|
|
|
273 type: string
|
|
|
274 cloudDNS:
|
|
|
275 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
|
|
|
276 type: object
|
|
|
277 required:
|
|
|
278 - project
|
|
|
279 properties:
|
|
|
280 hostedZoneName:
|
|
|
281 description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone.
|
|
|
282 type: string
|
|
|
283 project:
|
|
|
284 type: string
|
|
|
285 serviceAccountSecretRef:
|
|
|
286 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
287 type: object
|
|
|
288 required:
|
|
|
289 - name
|
|
|
290 properties:
|
|
|
291 key:
|
|
|
292 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
293 type: string
|
|
|
294 name:
|
|
|
295 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
296 type: string
|
|
|
297 cloudflare:
|
|
|
298 description: Use the Cloudflare API to manage DNS01 challenge records.
|
|
|
299 type: object
|
|
|
300 properties:
|
|
|
301 apiKeySecretRef:
|
|
|
302 description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.'
|
|
|
303 type: object
|
|
|
304 required:
|
|
|
305 - name
|
|
|
306 properties:
|
|
|
307 key:
|
|
|
308 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
309 type: string
|
|
|
310 name:
|
|
|
311 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
312 type: string
|
|
|
313 apiTokenSecretRef:
|
|
|
314 description: API token used to authenticate with Cloudflare.
|
|
|
315 type: object
|
|
|
316 required:
|
|
|
317 - name
|
|
|
318 properties:
|
|
|
319 key:
|
|
|
320 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
321 type: string
|
|
|
322 name:
|
|
|
323 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
324 type: string
|
|
|
325 email:
|
|
|
326 description: Email of the account, only required when using API key based authentication.
|
|
|
327 type: string
|
|
|
328 cnameStrategy:
|
|
|
329 description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones.
|
|
|
330 type: string
|
|
|
331 enum:
|
|
|
332 - None
|
|
|
333 - Follow
|
|
|
334 digitalocean:
|
|
|
335 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
|
|
|
336 type: object
|
|
|
337 required:
|
|
|
338 - tokenSecretRef
|
|
|
339 properties:
|
|
|
340 tokenSecretRef:
|
|
|
341 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
342 type: object
|
|
|
343 required:
|
|
|
344 - name
|
|
|
345 properties:
|
|
|
346 key:
|
|
|
347 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
348 type: string
|
|
|
349 name:
|
|
|
350 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
351 type: string
|
|
|
352 rfc2136:
|
|
|
353 description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records.
|
|
|
354 type: object
|
|
|
355 required:
|
|
|
356 - nameserver
|
|
|
357 properties:
|
|
|
358 nameserver:
|
|
|
359 description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1])Â ; port is optional. This field is required.
|
|
|
360 type: string
|
|
|
361 tsigAlgorithm:
|
|
|
362 description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.'
|
|
|
363 type: string
|
|
|
364 tsigKeyName:
|
|
|
365 description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required.
|
|
|
366 type: string
|
|
|
367 tsigSecretSecretRef:
|
|
|
368 description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required.
|
|
|
369 type: object
|
|
|
370 required:
|
|
|
371 - name
|
|
|
372 properties:
|
|
|
373 key:
|
|
|
374 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
375 type: string
|
|
|
376 name:
|
|
|
377 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
378 type: string
|
|
|
379 route53:
|
|
|
380 description: Use the AWS Route53 API to manage DNS01 challenge records.
|
|
|
381 type: object
|
|
|
382 required:
|
|
|
383 - region
|
|
|
384 properties:
|
|
|
385 accessKeyID:
|
|
|
386 description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
387 type: string
|
|
|
388 accessKeyIDSecretRef:
|
|
|
389 description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
390 type: object
|
|
|
391 required:
|
|
|
392 - name
|
|
|
393 properties:
|
|
|
394 key:
|
|
|
395 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
396 type: string
|
|
|
397 name:
|
|
|
398 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
399 type: string
|
|
|
400 hostedZoneID:
|
|
|
401 description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
|
|
|
402 type: string
|
|
|
403 region:
|
|
|
404 description: Always set the region when using AccessKeyID and SecretAccessKey
|
|
|
405 type: string
|
|
|
406 role:
|
|
|
407 description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
|
|
|
408 type: string
|
|
|
409 secretAccessKeySecretRef:
|
|
|
410 description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
411 type: object
|
|
|
412 required:
|
|
|
413 - name
|
|
|
414 properties:
|
|
|
415 key:
|
|
|
416 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
417 type: string
|
|
|
418 name:
|
|
|
419 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
420 type: string
|
|
|
421 webhook:
|
|
|
422 description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records.
|
|
|
423 type: object
|
|
|
424 required:
|
|
|
425 - groupName
|
|
|
426 - solverName
|
|
|
427 properties:
|
|
|
428 config:
|
|
|
429 description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation.
|
|
|
430 x-kubernetes-preserve-unknown-fields: true
|
|
|
431 groupName:
|
|
|
432 description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation.
|
|
|
433 type: string
|
|
|
434 solverName:
|
|
|
435 description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'.
|
|
|
436 type: string
|
|
|
437 http01:
|
|
|
438 description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
|
|
|
439 type: object
|
|
|
440 properties:
|
|
|
441 gatewayHTTPRoute:
|
|
|
442 description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future.
|
|
|
443 type: object
|
|
|
444 properties:
|
|
|
445 labels:
|
|
|
446 description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges.
|
|
|
447 type: object
|
|
|
448 additionalProperties:
|
|
|
449 type: string
|
|
|
450 parentRefs:
|
|
|
451 description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/v1alpha2/api-types/httproute/#attaching-to-gateways'
|
|
|
452 type: array
|
|
|
453 items:
|
|
|
454 description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid."
|
|
|
455 type: object
|
|
|
456 required:
|
|
|
457 - name
|
|
|
458 properties:
|
|
|
459 group:
|
|
|
460 description: "Group is the group of the referent. \n Support: Core"
|
|
|
461 type: string
|
|
|
462 default: gateway.networking.k8s.io
|
|
|
463 maxLength: 253
|
|
|
464 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
|
465 kind:
|
|
|
466 description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Custom (Other Resources)"
|
|
|
467 type: string
|
|
|
468 default: Gateway
|
|
|
469 maxLength: 63
|
|
|
470 minLength: 1
|
|
|
471 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
|
|
472 name:
|
|
|
473 description: "Name is the name of the referent. \n Support: Core"
|
|
|
474 type: string
|
|
|
475 maxLength: 253
|
|
|
476 minLength: 1
|
|
|
477 namespace:
|
|
|
478 description: "Namespace is the namespace of the referent. When unspecified (or empty string), this refers to the local namespace of the Route. \n Support: Core"
|
|
|
479 type: string
|
|
|
480 maxLength: 63
|
|
|
481 minLength: 1
|
|
|
482 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
|
|
483 port:
|
|
|
484 description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n <gateway:experimental>"
|
|
|
485 type: integer
|
|
|
486 format: int32
|
|
|
487 maximum: 65535
|
|
|
488 minimum: 1
|
|
|
489 sectionName:
|
|
|
490 description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core"
|
|
|
491 type: string
|
|
|
492 maxLength: 253
|
|
|
493 minLength: 1
|
|
|
494 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
|
495 serviceType:
|
|
|
496 description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort.
|
|
|
497 type: string
|
|
|
498 ingress:
|
|
|
499 description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed.
|
|
|
500 type: object
|
|
|
501 properties:
|
|
|
502 class:
|
|
|
503 description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified.
|
|
|
504 type: string
|
|
|
505 ingressTemplate:
|
|
|
506 description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges.
|
|
|
507 type: object
|
|
|
508 properties:
|
|
|
509 metadata:
|
|
|
510 description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values.
|
|
|
511 type: object
|
|
|
512 properties:
|
|
|
513 annotations:
|
|
|
514 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
|
|
|
515 type: object
|
|
|
516 additionalProperties:
|
|
|
517 type: string
|
|
|
518 labels:
|
|
|
519 description: Labels that should be added to the created ACME HTTP01 solver ingress.
|
|
|
520 type: object
|
|
|
521 additionalProperties:
|
|
|
522 type: string
|
|
|
523 name:
|
|
|
524 description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources.
|
|
|
525 type: string
|
|
|
526 podTemplate:
|
|
|
527 description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges.
|
|
|
528 type: object
|
|
|
529 properties:
|
|
|
530 metadata:
|
|
|
531 description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values.
|
|
|
532 type: object
|
|
|
533 properties:
|
|
|
534 annotations:
|
|
|
535 description: Annotations that should be added to the create ACME HTTP01 solver pods.
|
|
|
536 type: object
|
|
|
537 additionalProperties:
|
|
|
538 type: string
|
|
|
539 labels:
|
|
|
540 description: Labels that should be added to the created ACME HTTP01 solver pods.
|
|
|
541 type: object
|
|
|
542 additionalProperties:
|
|
|
543 type: string
|
|
|
544 spec:
|
|
|
545 description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored.
|
|
|
546 type: object
|
|
|
547 properties:
|
|
|
548 affinity:
|
|
|
549 description: If specified, the pod's scheduling constraints
|
|
|
550 type: object
|
|
|
551 properties:
|
|
|
552 nodeAffinity:
|
|
|
553 description: Describes node affinity scheduling rules for the pod.
|
|
|
554 type: object
|
|
|
555 properties:
|
|
|
556 preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
557 description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
|
|
|
558 type: array
|
|
|
559 items:
|
|
|
560 description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
|
|
|
561 type: object
|
|
|
562 required:
|
|
|
563 - preference
|
|
|
564 - weight
|
|
|
565 properties:
|
|
|
566 preference:
|
|
|
567 description: A node selector term, associated with the corresponding weight.
|
|
|
568 type: object
|
|
|
569 properties:
|
|
|
570 matchExpressions:
|
|
|
571 description: A list of node selector requirements by node's labels.
|
|
|
572 type: array
|
|
|
573 items:
|
|
|
574 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
575 type: object
|
|
|
576 required:
|
|
|
577 - key
|
|
|
578 - operator
|
|
|
579 properties:
|
|
|
580 key:
|
|
|
581 description: The label key that the selector applies to.
|
|
|
582 type: string
|
|
|
583 operator:
|
|
|
584 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
585 type: string
|
|
|
586 values:
|
|
|
587 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
588 type: array
|
|
|
589 items:
|
|
|
590 type: string
|
|
|
591 matchFields:
|
|
|
592 description: A list of node selector requirements by node's fields.
|
|
|
593 type: array
|
|
|
594 items:
|
|
|
595 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
596 type: object
|
|
|
597 required:
|
|
|
598 - key
|
|
|
599 - operator
|
|
|
600 properties:
|
|
|
601 key:
|
|
|
602 description: The label key that the selector applies to.
|
|
|
603 type: string
|
|
|
604 operator:
|
|
|
605 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
606 type: string
|
|
|
607 values:
|
|
|
608 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
609 type: array
|
|
|
610 items:
|
|
|
611 type: string
|
|
|
612 x-kubernetes-map-type: atomic
|
|
|
613 weight:
|
|
|
614 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
|
|
|
615 type: integer
|
|
|
616 format: int32
|
|
|
617 requiredDuringSchedulingIgnoredDuringExecution:
|
|
|
618 description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
|
|
|
619 type: object
|
|
|
620 required:
|
|
|
621 - nodeSelectorTerms
|
|
|
622 properties:
|
|
|
623 nodeSelectorTerms:
|
|
|
624 description: Required. A list of node selector terms. The terms are ORed.
|
|
|
625 type: array
|
|
|
626 items:
|
|
|
627 description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
|
|
|
628 type: object
|
|
|
629 properties:
|
|
|
630 matchExpressions:
|
|
|
631 description: A list of node selector requirements by node's labels.
|
|
|
632 type: array
|
|
|
633 items:
|
|
|
634 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
635 type: object
|
|
|
636 required:
|
|
|
637 - key
|
|
|
638 - operator
|
|
|
639 properties:
|
|
|
640 key:
|
|
|
641 description: The label key that the selector applies to.
|
|
|
642 type: string
|
|
|
643 operator:
|
|
|
644 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
645 type: string
|
|
|
646 values:
|
|
|
647 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
648 type: array
|
|
|
649 items:
|
|
|
650 type: string
|
|
|
651 matchFields:
|
|
|
652 description: A list of node selector requirements by node's fields.
|
|
|
653 type: array
|
|
|
654 items:
|
|
|
655 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
656 type: object
|
|
|
657 required:
|
|
|
658 - key
|
|
|
659 - operator
|
|
|
660 properties:
|
|
|
661 key:
|
|
|
662 description: The label key that the selector applies to.
|
|
|
663 type: string
|
|
|
664 operator:
|
|
|
665 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
666 type: string
|
|
|
667 values:
|
|
|
668 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
669 type: array
|
|
|
670 items:
|
|
|
671 type: string
|
|
|
672 x-kubernetes-map-type: atomic
|
|
|
673 x-kubernetes-map-type: atomic
|
|
|
674 podAffinity:
|
|
|
675 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
|
|
|
676 type: object
|
|
|
677 properties:
|
|
|
678 preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
679 description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
|
|
|
680 type: array
|
|
|
681 items:
|
|
|
682 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
|
|
|
683 type: object
|
|
|
684 required:
|
|
|
685 - podAffinityTerm
|
|
|
686 - weight
|
|
|
687 properties:
|
|
|
688 podAffinityTerm:
|
|
|
689 description: Required. A pod affinity term, associated with the corresponding weight.
|
|
|
690 type: object
|
|
|
691 required:
|
|
|
692 - topologyKey
|
|
|
693 properties:
|
|
|
694 labelSelector:
|
|
|
695 description: A label query over a set of resources, in this case pods.
|
|
|
696 type: object
|
|
|
697 properties:
|
|
|
698 matchExpressions:
|
|
|
699 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
700 type: array
|
|
|
701 items:
|
|
|
702 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
703 type: object
|
|
|
704 required:
|
|
|
705 - key
|
|
|
706 - operator
|
|
|
707 properties:
|
|
|
708 key:
|
|
|
709 description: key is the label key that the selector applies to.
|
|
|
710 type: string
|
|
|
711 operator:
|
|
|
712 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
713 type: string
|
|
|
714 values:
|
|
|
715 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
716 type: array
|
|
|
717 items:
|
|
|
718 type: string
|
|
|
719 matchLabels:
|
|
|
720 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
721 type: object
|
|
|
722 additionalProperties:
|
|
|
723 type: string
|
|
|
724 x-kubernetes-map-type: atomic
|
|
|
725 namespaceSelector:
|
|
|
726 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
727 type: object
|
|
|
728 properties:
|
|
|
729 matchExpressions:
|
|
|
730 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
731 type: array
|
|
|
732 items:
|
|
|
733 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
734 type: object
|
|
|
735 required:
|
|
|
736 - key
|
|
|
737 - operator
|
|
|
738 properties:
|
|
|
739 key:
|
|
|
740 description: key is the label key that the selector applies to.
|
|
|
741 type: string
|
|
|
742 operator:
|
|
|
743 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
744 type: string
|
|
|
745 values:
|
|
|
746 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
747 type: array
|
|
|
748 items:
|
|
|
749 type: string
|
|
|
750 matchLabels:
|
|
|
751 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
752 type: object
|
|
|
753 additionalProperties:
|
|
|
754 type: string
|
|
|
755 x-kubernetes-map-type: atomic
|
|
|
756 namespaces:
|
|
|
757 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
758 type: array
|
|
|
759 items:
|
|
|
760 type: string
|
|
|
761 topologyKey:
|
|
|
762 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
763 type: string
|
|
|
764 weight:
|
|
|
765 description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
|
|
|
766 type: integer
|
|
|
767 format: int32
|
|
|
768 requiredDuringSchedulingIgnoredDuringExecution:
|
|
|
769 description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
|
|
|
770 type: array
|
|
|
771 items:
|
|
|
772 description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running
|
|
|
773 type: object
|
|
|
774 required:
|
|
|
775 - topologyKey
|
|
|
776 properties:
|
|
|
777 labelSelector:
|
|
|
778 description: A label query over a set of resources, in this case pods.
|
|
|
779 type: object
|
|
|
780 properties:
|
|
|
781 matchExpressions:
|
|
|
782 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
783 type: array
|
|
|
784 items:
|
|
|
785 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
786 type: object
|
|
|
787 required:
|
|
|
788 - key
|
|
|
789 - operator
|
|
|
790 properties:
|
|
|
791 key:
|
|
|
792 description: key is the label key that the selector applies to.
|
|
|
793 type: string
|
|
|
794 operator:
|
|
|
795 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
796 type: string
|
|
|
797 values:
|
|
|
798 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
799 type: array
|
|
|
800 items:
|
|
|
801 type: string
|
|
|
802 matchLabels:
|
|
|
803 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
804 type: object
|
|
|
805 additionalProperties:
|
|
|
806 type: string
|
|
|
807 x-kubernetes-map-type: atomic
|
|
|
808 namespaceSelector:
|
|
|
809 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
810 type: object
|
|
|
811 properties:
|
|
|
812 matchExpressions:
|
|
|
813 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
814 type: array
|
|
|
815 items:
|
|
|
816 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
817 type: object
|
|
|
818 required:
|
|
|
819 - key
|
|
|
820 - operator
|
|
|
821 properties:
|
|
|
822 key:
|
|
|
823 description: key is the label key that the selector applies to.
|
|
|
824 type: string
|
|
|
825 operator:
|
|
|
826 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
827 type: string
|
|
|
828 values:
|
|
|
829 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
830 type: array
|
|
|
831 items:
|
|
|
832 type: string
|
|
|
833 matchLabels:
|
|
|
834 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
835 type: object
|
|
|
836 additionalProperties:
|
|
|
837 type: string
|
|
|
838 x-kubernetes-map-type: atomic
|
|
|
839 namespaces:
|
|
|
840 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
841 type: array
|
|
|
842 items:
|
|
|
843 type: string
|
|
|
844 topologyKey:
|
|
|
845 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
846 type: string
|
|
|
847 podAntiAffinity:
|
|
|
848 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
|
|
|
849 type: object
|
|
|
850 properties:
|
|
|
851 preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
852 description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
|
|
|
853 type: array
|
|
|
854 items:
|
|
|
855 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
|
|
|
856 type: object
|
|
|
857 required:
|
|
|
858 - podAffinityTerm
|
|
|
859 - weight
|
|
|
860 properties:
|
|
|
861 podAffinityTerm:
|
|
|
862 description: Required. A pod affinity term, associated with the corresponding weight.
|
|
|
863 type: object
|
|
|
864 required:
|
|
|
865 - topologyKey
|
|
|
866 properties:
|
|
|
867 labelSelector:
|
|
|
868 description: A label query over a set of resources, in this case pods.
|
|
|
869 type: object
|
|
|
870 properties:
|
|
|
871 matchExpressions:
|
|
|
872 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
873 type: array
|
|
|
874 items:
|
|
|
875 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
876 type: object
|
|
|
877 required:
|
|
|
878 - key
|
|
|
879 - operator
|
|
|
880 properties:
|
|
|
881 key:
|
|
|
882 description: key is the label key that the selector applies to.
|
|
|
883 type: string
|
|
|
884 operator:
|
|
|
885 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
886 type: string
|
|
|
887 values:
|
|
|
888 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
889 type: array
|
|
|
890 items:
|
|
|
891 type: string
|
|
|
892 matchLabels:
|
|
|
893 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
894 type: object
|
|
|
895 additionalProperties:
|
|
|
896 type: string
|
|
|
897 x-kubernetes-map-type: atomic
|
|
|
898 namespaceSelector:
|
|
|
899 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
900 type: object
|
|
|
901 properties:
|
|
|
902 matchExpressions:
|
|
|
903 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
904 type: array
|
|
|
905 items:
|
|
|
906 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
907 type: object
|
|
|
908 required:
|
|
|
909 - key
|
|
|
910 - operator
|
|
|
911 properties:
|
|
|
912 key:
|
|
|
913 description: key is the label key that the selector applies to.
|
|
|
914 type: string
|
|
|
915 operator:
|
|
|
916 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
917 type: string
|
|
|
918 values:
|
|
|
919 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
920 type: array
|
|
|
921 items:
|
|
|
922 type: string
|
|
|
923 matchLabels:
|
|
|
924 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
925 type: object
|
|
|
926 additionalProperties:
|
|
|
927 type: string
|
|
|
928 x-kubernetes-map-type: atomic
|
|
|
929 namespaces:
|
|
|
930 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
931 type: array
|
|
|
932 items:
|
|
|
933 type: string
|
|
|
934 topologyKey:
|
|
|
935 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
936 type: string
|
|
|
937 weight:
|
|
|
938 description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
|
|
|
939 type: integer
|
|
|
940 format: int32
|
|
|
941 requiredDuringSchedulingIgnoredDuringExecution:
|
|
|
942 description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
|
|
|
943 type: array
|
|
|
944 items:
|
|
|
945 description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running
|
|
|
946 type: object
|
|
|
947 required:
|
|
|
948 - topologyKey
|
|
|
949 properties:
|
|
|
950 labelSelector:
|
|
|
951 description: A label query over a set of resources, in this case pods.
|
|
|
952 type: object
|
|
|
953 properties:
|
|
|
954 matchExpressions:
|
|
|
955 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
956 type: array
|
|
|
957 items:
|
|
|
958 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
959 type: object
|
|
|
960 required:
|
|
|
961 - key
|
|
|
962 - operator
|
|
|
963 properties:
|
|
|
964 key:
|
|
|
965 description: key is the label key that the selector applies to.
|
|
|
966 type: string
|
|
|
967 operator:
|
|
|
968 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
969 type: string
|
|
|
970 values:
|
|
|
971 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
972 type: array
|
|
|
973 items:
|
|
|
974 type: string
|
|
|
975 matchLabels:
|
|
|
976 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
977 type: object
|
|
|
978 additionalProperties:
|
|
|
979 type: string
|
|
|
980 x-kubernetes-map-type: atomic
|
|
|
981 namespaceSelector:
|
|
|
982 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
983 type: object
|
|
|
984 properties:
|
|
|
985 matchExpressions:
|
|
|
986 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
987 type: array
|
|
|
988 items:
|
|
|
989 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
990 type: object
|
|
|
991 required:
|
|
|
992 - key
|
|
|
993 - operator
|
|
|
994 properties:
|
|
|
995 key:
|
|
|
996 description: key is the label key that the selector applies to.
|
|
|
997 type: string
|
|
|
998 operator:
|
|
|
999 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
1000 type: string
|
|
|
1001 values:
|
|
|
1002 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
1003 type: array
|
|
|
1004 items:
|
|
|
1005 type: string
|
|
|
1006 matchLabels:
|
|
|
1007 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
1008 type: object
|
|
|
1009 additionalProperties:
|
|
|
1010 type: string
|
|
|
1011 x-kubernetes-map-type: atomic
|
|
|
1012 namespaces:
|
|
|
1013 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
1014 type: array
|
|
|
1015 items:
|
|
|
1016 type: string
|
|
|
1017 topologyKey:
|
|
|
1018 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
1019 type: string
|
|
|
1020 nodeSelector:
|
|
|
1021 description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
|
|
|
1022 type: object
|
|
|
1023 additionalProperties:
|
|
|
1024 type: string
|
|
|
1025 priorityClassName:
|
|
|
1026 description: If specified, the pod's priorityClassName.
|
|
|
1027 type: string
|
|
|
1028 serviceAccountName:
|
|
|
1029 description: If specified, the pod's service account
|
|
|
1030 type: string
|
|
|
1031 tolerations:
|
|
|
1032 description: If specified, the pod's tolerations.
|
|
|
1033 type: array
|
|
|
1034 items:
|
|
|
1035 description: The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.
|
|
|
1036 type: object
|
|
|
1037 properties:
|
|
|
1038 effect:
|
|
|
1039 description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
|
|
|
1040 type: string
|
|
|
1041 key:
|
|
|
1042 description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
|
|
|
1043 type: string
|
|
|
1044 operator:
|
|
|
1045 description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.
|
|
|
1046 type: string
|
|
|
1047 tolerationSeconds:
|
|
|
1048 description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
|
|
|
1049 type: integer
|
|
|
1050 format: int64
|
|
|
1051 value:
|
|
|
1052 description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
|
|
|
1053 type: string
|
|
|
1054 serviceType:
|
|
|
1055 description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort.
|
|
|
1056 type: string
|
|
|
1057 selector:
|
|
|
1058 description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead.
|
|
|
1059 type: object
|
|
|
1060 properties:
|
|
|
1061 dnsNames:
|
|
|
1062 description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected.
|
|
|
1063 type: array
|
|
|
1064 items:
|
|
|
1065 type: string
|
|
|
1066 dnsZones:
|
|
|
1067 description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected.
|
|
|
1068 type: array
|
|
|
1069 items:
|
|
|
1070 type: string
|
|
|
1071 matchLabels:
|
|
|
1072 description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to.
|
|
|
1073 type: object
|
|
|
1074 additionalProperties:
|
|
|
1075 type: string
|
|
|
1076 ca:
|
|
|
1077 description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager.
|
|
|
1078 type: object
|
|
|
1079 required:
|
|
|
1080 - secretName
|
|
|
1081 properties:
|
|
|
1082 crlDistributionPoints:
|
|
|
1083 description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set.
|
|
|
1084 type: array
|
|
|
1085 items:
|
|
|
1086 type: string
|
|
|
1087 ocspServers:
|
|
|
1088 description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
|
|
|
1089 type: array
|
|
|
1090 items:
|
|
|
1091 type: string
|
|
|
1092 secretName:
|
|
|
1093 description: SecretName is the name of the secret used to sign Certificates issued by this Issuer.
|
|
|
1094 type: string
|
|
|
1095 selfSigned:
|
|
|
1096 description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object.
|
|
|
1097 type: object
|
|
|
1098 properties:
|
|
|
1099 crlDistributionPoints:
|
|
|
1100 description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings.
|
|
|
1101 type: array
|
|
|
1102 items:
|
|
|
1103 type: string
|
|
|
1104 vault:
|
|
|
1105 description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend.
|
|
|
1106 type: object
|
|
|
1107 required:
|
|
|
1108 - auth
|
|
|
1109 - path
|
|
|
1110 - server
|
|
|
1111 properties:
|
|
|
1112 auth:
|
|
|
1113 description: Auth configures how cert-manager authenticates with the Vault server.
|
|
|
1114 type: object
|
|
|
1115 properties:
|
|
|
1116 appRole:
|
|
|
1117 description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource.
|
|
|
1118 type: object
|
|
|
1119 required:
|
|
|
1120 - path
|
|
|
1121 - roleId
|
|
|
1122 - secretRef
|
|
|
1123 properties:
|
|
|
1124 path:
|
|
|
1125 description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"'
|
|
|
1126 type: string
|
|
|
1127 roleId:
|
|
|
1128 description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault.
|
|
|
1129 type: string
|
|
|
1130 secretRef:
|
|
|
1131 description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret.
|
|
|
1132 type: object
|
|
|
1133 required:
|
|
|
1134 - name
|
|
|
1135 properties:
|
|
|
1136 key:
|
|
|
1137 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1138 type: string
|
|
|
1139 name:
|
|
|
1140 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1141 type: string
|
|
|
1142 kubernetes:
|
|
|
1143 description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server.
|
|
|
1144 type: object
|
|
|
1145 required:
|
|
|
1146 - role
|
|
|
1147 - secretRef
|
|
|
1148 properties:
|
|
|
1149 mountPath:
|
|
|
1150 description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used.
|
|
|
1151 type: string
|
|
|
1152 role:
|
|
|
1153 description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies.
|
|
|
1154 type: string
|
|
|
1155 secretRef:
|
|
|
1156 description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported.
|
|
|
1157 type: object
|
|
|
1158 required:
|
|
|
1159 - name
|
|
|
1160 properties:
|
|
|
1161 key:
|
|
|
1162 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1163 type: string
|
|
|
1164 name:
|
|
|
1165 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1166 type: string
|
|
|
1167 tokenSecretRef:
|
|
|
1168 description: TokenSecretRef authenticates with Vault by presenting a token.
|
|
|
1169 type: object
|
|
|
1170 required:
|
|
|
1171 - name
|
|
|
1172 properties:
|
|
|
1173 key:
|
|
|
1174 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1175 type: string
|
|
|
1176 name:
|
|
|
1177 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1178 type: string
|
|
|
1179 caBundle:
|
|
|
1180 description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the cert-manager controller system root certificates are used to validate the TLS connection.
|
|
|
1181 type: string
|
|
|
1182 format: byte
|
|
|
1183 caBundleSecretRef:
|
|
|
1184 description: CABundleSecretRef is a reference to a Secret which contains the CABundle which will be used when connecting to Vault when using HTTPS. Mutually exclusive with CABundle. If neither CABundleSecretRef nor CABundle are defined, the cert-manager controller system root certificates are used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
|
|
|
1185 type: object
|
|
|
1186 required:
|
|
|
1187 - name
|
|
|
1188 properties:
|
|
|
1189 key:
|
|
|
1190 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1191 type: string
|
|
|
1192 name:
|
|
|
1193 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1194 type: string
|
|
|
1195 namespace:
|
|
|
1196 description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces'
|
|
|
1197 type: string
|
|
|
1198 path:
|
|
|
1199 description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".'
|
|
|
1200 type: string
|
|
|
1201 server:
|
|
|
1202 description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
|
|
|
1203 type: string
|
|
|
1204 venafi:
|
|
|
1205 description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone.
|
|
|
1206 type: object
|
|
|
1207 required:
|
|
|
1208 - zone
|
|
|
1209 properties:
|
|
|
1210 cloud:
|
|
|
1211 description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified.
|
|
|
1212 type: object
|
|
|
1213 required:
|
|
|
1214 - apiTokenSecretRef
|
|
|
1215 properties:
|
|
|
1216 apiTokenSecretRef:
|
|
|
1217 description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
|
|
|
1218 type: object
|
|
|
1219 required:
|
|
|
1220 - name
|
|
|
1221 properties:
|
|
|
1222 key:
|
|
|
1223 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1224 type: string
|
|
|
1225 name:
|
|
|
1226 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1227 type: string
|
|
|
1228 url:
|
|
|
1229 description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1".
|
|
|
1230 type: string
|
|
|
1231 tpp:
|
|
|
1232 description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified.
|
|
|
1233 type: object
|
|
|
1234 required:
|
|
|
1235 - credentialsRef
|
|
|
1236 - url
|
|
|
1237 properties:
|
|
|
1238 caBundle:
|
|
|
1239 description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates.
|
|
|
1240 type: string
|
|
|
1241 format: byte
|
|
|
1242 credentialsRef:
|
|
|
1243 description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'.
|
|
|
1244 type: object
|
|
|
1245 required:
|
|
|
1246 - name
|
|
|
1247 properties:
|
|
|
1248 name:
|
|
|
1249 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1250 type: string
|
|
|
1251 url:
|
|
|
1252 description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".'
|
|
|
1253 type: string
|
|
|
1254 zone:
|
|
|
1255 description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required.
|
|
|
1256 type: string
|
|
|
1257 status:
|
|
|
1258 description: Status of the ClusterIssuer. This is set and managed automatically.
|
|
|
1259 type: object
|
|
|
1260 properties:
|
|
|
1261 acme:
|
|
|
1262 description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates.
|
|
|
1263 type: object
|
|
|
1264 properties:
|
|
|
1265 lastRegisteredEmail:
|
|
|
1266 description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer
|
|
|
1267 type: string
|
|
|
1268 uri:
|
|
|
1269 description: URI is the unique account identifier, which can also be used to retrieve account details from the CA
|
|
|
1270 type: string
|
|
|
1271 conditions:
|
|
|
1272 description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`.
|
|
|
1273 type: array
|
|
|
1274 items:
|
|
|
1275 description: IssuerCondition contains condition information for an Issuer.
|
|
|
1276 type: object
|
|
|
1277 required:
|
|
|
1278 - status
|
|
|
1279 - type
|
|
|
1280 properties:
|
|
|
1281 lastTransitionTime:
|
|
|
1282 description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
|
|
|
1283 type: string
|
|
|
1284 format: date-time
|
|
|
1285 message:
|
|
|
1286 description: Message is a human readable description of the details of the last transition, complementing reason.
|
|
|
1287 type: string
|
|
|
1288 observedGeneration:
|
|
|
1289 description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer.
|
|
|
1290 type: integer
|
|
|
1291 format: int64
|
|
|
1292 reason:
|
|
|
1293 description: Reason is a brief machine readable explanation for the condition's last transition.
|
|
|
1294 type: string
|
|
|
1295 status:
|
|
|
1296 description: Status of the condition, one of (`True`, `False`, `Unknown`).
|
|
|
1297 type: string
|
|
|
1298 enum:
|
|
|
1299 - "True"
|
|
|
1300 - "False"
|
|
|
1301 - Unknown
|
|
|
1302 type:
|
|
|
1303 description: Type of the condition, known values are (`Ready`).
|
|
|
1304 type: string
|
|
|
1305 x-kubernetes-list-map-keys:
|
|
|
1306 - type
|
|
|
1307 x-kubernetes-list-type: map
|
|
|
1308 served: true
|
|
|
1309 storage: true
|
|
|
1310 ---
|
|
|
1311 # Source: cert-manager/templates/crds.yaml
|
|
|
1312 apiVersion: apiextensions.k8s.io/v1
|
|
|
1313 kind: CustomResourceDefinition
|
|
|
1314 metadata:
|
|
|
1315 name: challenges.acme.cert-manager.io
|
|
|
1316 labels:
|
|
|
1317 app: 'cert-manager'
|
|
|
1318 app.kubernetes.io/name: 'cert-manager'
|
|
|
1319 app.kubernetes.io/instance: 'cert-manager'
|
|
|
1320 # Generated labels
|
|
|
1321 app.kubernetes.io/version: "v1.10.1"
|
|
|
1322 spec:
|
|
|
1323 group: acme.cert-manager.io
|
|
|
1324 names:
|
|
|
1325 kind: Challenge
|
|
|
1326 listKind: ChallengeList
|
|
|
1327 plural: challenges
|
|
|
1328 singular: challenge
|
|
|
1329 categories:
|
|
|
1330 - cert-manager
|
|
|
1331 - cert-manager-acme
|
|
|
1332 scope: Namespaced
|
|
|
1333 versions:
|
|
|
1334 - additionalPrinterColumns:
|
|
|
1335 - jsonPath: .status.state
|
|
|
1336 name: State
|
|
|
1337 type: string
|
|
|
1338 - jsonPath: .spec.dnsName
|
|
|
1339 name: Domain
|
|
|
1340 type: string
|
|
|
1341 - jsonPath: .status.reason
|
|
|
1342 name: Reason
|
|
|
1343 priority: 1
|
|
|
1344 type: string
|
|
|
1345 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
|
|
|
1346 jsonPath: .metadata.creationTimestamp
|
|
|
1347 name: Age
|
|
|
1348 type: date
|
|
|
1349 name: v1
|
|
|
1350 schema:
|
|
|
1351 openAPIV3Schema:
|
|
|
1352 description: Challenge is a type to represent a Challenge request with an ACME server
|
|
|
1353 type: object
|
|
|
1354 required:
|
|
|
1355 - metadata
|
|
|
1356 - spec
|
|
|
1357 properties:
|
|
|
1358 apiVersion:
|
|
|
1359 description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
1360 type: string
|
|
|
1361 kind:
|
|
|
1362 description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
1363 type: string
|
|
|
1364 metadata:
|
|
|
1365 type: object
|
|
|
1366 spec:
|
|
|
1367 type: object
|
|
|
1368 required:
|
|
|
1369 - authorizationURL
|
|
|
1370 - dnsName
|
|
|
1371 - issuerRef
|
|
|
1372 - key
|
|
|
1373 - solver
|
|
|
1374 - token
|
|
|
1375 - type
|
|
|
1376 - url
|
|
|
1377 properties:
|
|
|
1378 authorizationURL:
|
|
|
1379 description: The URL to the ACME Authorization resource that this challenge is a part of.
|
|
|
1380 type: string
|
|
|
1381 dnsName:
|
|
|
1382 description: dnsName is the identifier that this challenge is for, e.g. example.com. If the requested DNSName is a 'wildcard', this field MUST be set to the non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.
|
|
|
1383 type: string
|
|
|
1384 issuerRef:
|
|
|
1385 description: References a properly configured ACME-type Issuer which should be used to create this Challenge. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Challenge will be marked as failed.
|
|
|
1386 type: object
|
|
|
1387 required:
|
|
|
1388 - name
|
|
|
1389 properties:
|
|
|
1390 group:
|
|
|
1391 description: Group of the resource being referred to.
|
|
|
1392 type: string
|
|
|
1393 kind:
|
|
|
1394 description: Kind of the resource being referred to.
|
|
|
1395 type: string
|
|
|
1396 name:
|
|
|
1397 description: Name of the resource being referred to.
|
|
|
1398 type: string
|
|
|
1399 key:
|
|
|
1400 description: 'The ACME challenge key for this challenge For HTTP01 challenges, this is the value that must be responded with to complete the HTTP01 challenge in the format: `<private key JWK thumbprint>.<key from acme server for challenge>`. For DNS01 challenges, this is the base64 encoded SHA256 sum of the `<private key JWK thumbprint>.<key from acme server for challenge>` text that must be set as the TXT record content.'
|
|
|
1401 type: string
|
|
|
1402 solver:
|
|
|
1403 description: Contains the domain solving configuration that should be used to solve this challenge resource.
|
|
|
1404 type: object
|
|
|
1405 properties:
|
|
|
1406 dns01:
|
|
|
1407 description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow.
|
|
|
1408 type: object
|
|
|
1409 properties:
|
|
|
1410 acmeDNS:
|
|
|
1411 description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records.
|
|
|
1412 type: object
|
|
|
1413 required:
|
|
|
1414 - accountSecretRef
|
|
|
1415 - host
|
|
|
1416 properties:
|
|
|
1417 accountSecretRef:
|
|
|
1418 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
1419 type: object
|
|
|
1420 required:
|
|
|
1421 - name
|
|
|
1422 properties:
|
|
|
1423 key:
|
|
|
1424 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1425 type: string
|
|
|
1426 name:
|
|
|
1427 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1428 type: string
|
|
|
1429 host:
|
|
|
1430 type: string
|
|
|
1431 akamai:
|
|
|
1432 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
|
|
|
1433 type: object
|
|
|
1434 required:
|
|
|
1435 - accessTokenSecretRef
|
|
|
1436 - clientSecretSecretRef
|
|
|
1437 - clientTokenSecretRef
|
|
|
1438 - serviceConsumerDomain
|
|
|
1439 properties:
|
|
|
1440 accessTokenSecretRef:
|
|
|
1441 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
1442 type: object
|
|
|
1443 required:
|
|
|
1444 - name
|
|
|
1445 properties:
|
|
|
1446 key:
|
|
|
1447 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1448 type: string
|
|
|
1449 name:
|
|
|
1450 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1451 type: string
|
|
|
1452 clientSecretSecretRef:
|
|
|
1453 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
1454 type: object
|
|
|
1455 required:
|
|
|
1456 - name
|
|
|
1457 properties:
|
|
|
1458 key:
|
|
|
1459 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1460 type: string
|
|
|
1461 name:
|
|
|
1462 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1463 type: string
|
|
|
1464 clientTokenSecretRef:
|
|
|
1465 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
1466 type: object
|
|
|
1467 required:
|
|
|
1468 - name
|
|
|
1469 properties:
|
|
|
1470 key:
|
|
|
1471 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1472 type: string
|
|
|
1473 name:
|
|
|
1474 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1475 type: string
|
|
|
1476 serviceConsumerDomain:
|
|
|
1477 type: string
|
|
|
1478 azureDNS:
|
|
|
1479 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
|
|
|
1480 type: object
|
|
|
1481 required:
|
|
|
1482 - resourceGroupName
|
|
|
1483 - subscriptionID
|
|
|
1484 properties:
|
|
|
1485 clientID:
|
|
|
1486 description: if both this and ClientSecret are left unset MSI will be used
|
|
|
1487 type: string
|
|
|
1488 clientSecretSecretRef:
|
|
|
1489 description: if both this and ClientID are left unset MSI will be used
|
|
|
1490 type: object
|
|
|
1491 required:
|
|
|
1492 - name
|
|
|
1493 properties:
|
|
|
1494 key:
|
|
|
1495 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1496 type: string
|
|
|
1497 name:
|
|
|
1498 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1499 type: string
|
|
|
1500 environment:
|
|
|
1501 description: name of the Azure environment (default AzurePublicCloud)
|
|
|
1502 type: string
|
|
|
1503 enum:
|
|
|
1504 - AzurePublicCloud
|
|
|
1505 - AzureChinaCloud
|
|
|
1506 - AzureGermanCloud
|
|
|
1507 - AzureUSGovernmentCloud
|
|
|
1508 hostedZoneName:
|
|
|
1509 description: name of the DNS zone that should be used
|
|
|
1510 type: string
|
|
|
1511 managedIdentity:
|
|
|
1512 description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID
|
|
|
1513 type: object
|
|
|
1514 properties:
|
|
|
1515 clientID:
|
|
|
1516 description: client ID of the managed identity, can not be used at the same time as resourceID
|
|
|
1517 type: string
|
|
|
1518 resourceID:
|
|
|
1519 description: resource ID of the managed identity, can not be used at the same time as clientID
|
|
|
1520 type: string
|
|
|
1521 resourceGroupName:
|
|
|
1522 description: resource group the DNS zone is located in
|
|
|
1523 type: string
|
|
|
1524 subscriptionID:
|
|
|
1525 description: ID of the Azure subscription
|
|
|
1526 type: string
|
|
|
1527 tenantID:
|
|
|
1528 description: when specifying ClientID and ClientSecret then this field is also needed
|
|
|
1529 type: string
|
|
|
1530 cloudDNS:
|
|
|
1531 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
|
|
|
1532 type: object
|
|
|
1533 required:
|
|
|
1534 - project
|
|
|
1535 properties:
|
|
|
1536 hostedZoneName:
|
|
|
1537 description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone.
|
|
|
1538 type: string
|
|
|
1539 project:
|
|
|
1540 type: string
|
|
|
1541 serviceAccountSecretRef:
|
|
|
1542 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
1543 type: object
|
|
|
1544 required:
|
|
|
1545 - name
|
|
|
1546 properties:
|
|
|
1547 key:
|
|
|
1548 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1549 type: string
|
|
|
1550 name:
|
|
|
1551 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1552 type: string
|
|
|
1553 cloudflare:
|
|
|
1554 description: Use the Cloudflare API to manage DNS01 challenge records.
|
|
|
1555 type: object
|
|
|
1556 properties:
|
|
|
1557 apiKeySecretRef:
|
|
|
1558 description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.'
|
|
|
1559 type: object
|
|
|
1560 required:
|
|
|
1561 - name
|
|
|
1562 properties:
|
|
|
1563 key:
|
|
|
1564 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1565 type: string
|
|
|
1566 name:
|
|
|
1567 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1568 type: string
|
|
|
1569 apiTokenSecretRef:
|
|
|
1570 description: API token used to authenticate with Cloudflare.
|
|
|
1571 type: object
|
|
|
1572 required:
|
|
|
1573 - name
|
|
|
1574 properties:
|
|
|
1575 key:
|
|
|
1576 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1577 type: string
|
|
|
1578 name:
|
|
|
1579 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1580 type: string
|
|
|
1581 email:
|
|
|
1582 description: Email of the account, only required when using API key based authentication.
|
|
|
1583 type: string
|
|
|
1584 cnameStrategy:
|
|
|
1585 description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones.
|
|
|
1586 type: string
|
|
|
1587 enum:
|
|
|
1588 - None
|
|
|
1589 - Follow
|
|
|
1590 digitalocean:
|
|
|
1591 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
|
|
|
1592 type: object
|
|
|
1593 required:
|
|
|
1594 - tokenSecretRef
|
|
|
1595 properties:
|
|
|
1596 tokenSecretRef:
|
|
|
1597 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
1598 type: object
|
|
|
1599 required:
|
|
|
1600 - name
|
|
|
1601 properties:
|
|
|
1602 key:
|
|
|
1603 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1604 type: string
|
|
|
1605 name:
|
|
|
1606 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1607 type: string
|
|
|
1608 rfc2136:
|
|
|
1609 description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records.
|
|
|
1610 type: object
|
|
|
1611 required:
|
|
|
1612 - nameserver
|
|
|
1613 properties:
|
|
|
1614 nameserver:
|
|
|
1615 description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1])Â ; port is optional. This field is required.
|
|
|
1616 type: string
|
|
|
1617 tsigAlgorithm:
|
|
|
1618 description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.'
|
|
|
1619 type: string
|
|
|
1620 tsigKeyName:
|
|
|
1621 description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required.
|
|
|
1622 type: string
|
|
|
1623 tsigSecretSecretRef:
|
|
|
1624 description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required.
|
|
|
1625 type: object
|
|
|
1626 required:
|
|
|
1627 - name
|
|
|
1628 properties:
|
|
|
1629 key:
|
|
|
1630 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1631 type: string
|
|
|
1632 name:
|
|
|
1633 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1634 type: string
|
|
|
1635 route53:
|
|
|
1636 description: Use the AWS Route53 API to manage DNS01 challenge records.
|
|
|
1637 type: object
|
|
|
1638 required:
|
|
|
1639 - region
|
|
|
1640 properties:
|
|
|
1641 accessKeyID:
|
|
|
1642 description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
1643 type: string
|
|
|
1644 accessKeyIDSecretRef:
|
|
|
1645 description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
1646 type: object
|
|
|
1647 required:
|
|
|
1648 - name
|
|
|
1649 properties:
|
|
|
1650 key:
|
|
|
1651 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1652 type: string
|
|
|
1653 name:
|
|
|
1654 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1655 type: string
|
|
|
1656 hostedZoneID:
|
|
|
1657 description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
|
|
|
1658 type: string
|
|
|
1659 region:
|
|
|
1660 description: Always set the region when using AccessKeyID and SecretAccessKey
|
|
|
1661 type: string
|
|
|
1662 role:
|
|
|
1663 description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
|
|
|
1664 type: string
|
|
|
1665 secretAccessKeySecretRef:
|
|
|
1666 description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
1667 type: object
|
|
|
1668 required:
|
|
|
1669 - name
|
|
|
1670 properties:
|
|
|
1671 key:
|
|
|
1672 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
1673 type: string
|
|
|
1674 name:
|
|
|
1675 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
1676 type: string
|
|
|
1677 webhook:
|
|
|
1678 description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records.
|
|
|
1679 type: object
|
|
|
1680 required:
|
|
|
1681 - groupName
|
|
|
1682 - solverName
|
|
|
1683 properties:
|
|
|
1684 config:
|
|
|
1685 description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation.
|
|
|
1686 x-kubernetes-preserve-unknown-fields: true
|
|
|
1687 groupName:
|
|
|
1688 description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation.
|
|
|
1689 type: string
|
|
|
1690 solverName:
|
|
|
1691 description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'.
|
|
|
1692 type: string
|
|
|
1693 http01:
|
|
|
1694 description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
|
|
|
1695 type: object
|
|
|
1696 properties:
|
|
|
1697 gatewayHTTPRoute:
|
|
|
1698 description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future.
|
|
|
1699 type: object
|
|
|
1700 properties:
|
|
|
1701 labels:
|
|
|
1702 description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges.
|
|
|
1703 type: object
|
|
|
1704 additionalProperties:
|
|
|
1705 type: string
|
|
|
1706 parentRefs:
|
|
|
1707 description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/v1alpha2/api-types/httproute/#attaching-to-gateways'
|
|
|
1708 type: array
|
|
|
1709 items:
|
|
|
1710 description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid."
|
|
|
1711 type: object
|
|
|
1712 required:
|
|
|
1713 - name
|
|
|
1714 properties:
|
|
|
1715 group:
|
|
|
1716 description: "Group is the group of the referent. \n Support: Core"
|
|
|
1717 type: string
|
|
|
1718 default: gateway.networking.k8s.io
|
|
|
1719 maxLength: 253
|
|
|
1720 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
|
1721 kind:
|
|
|
1722 description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Custom (Other Resources)"
|
|
|
1723 type: string
|
|
|
1724 default: Gateway
|
|
|
1725 maxLength: 63
|
|
|
1726 minLength: 1
|
|
|
1727 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
|
|
1728 name:
|
|
|
1729 description: "Name is the name of the referent. \n Support: Core"
|
|
|
1730 type: string
|
|
|
1731 maxLength: 253
|
|
|
1732 minLength: 1
|
|
|
1733 namespace:
|
|
|
1734 description: "Namespace is the namespace of the referent. When unspecified (or empty string), this refers to the local namespace of the Route. \n Support: Core"
|
|
|
1735 type: string
|
|
|
1736 maxLength: 63
|
|
|
1737 minLength: 1
|
|
|
1738 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
|
|
1739 port:
|
|
|
1740 description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n <gateway:experimental>"
|
|
|
1741 type: integer
|
|
|
1742 format: int32
|
|
|
1743 maximum: 65535
|
|
|
1744 minimum: 1
|
|
|
1745 sectionName:
|
|
|
1746 description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core"
|
|
|
1747 type: string
|
|
|
1748 maxLength: 253
|
|
|
1749 minLength: 1
|
|
|
1750 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
|
1751 serviceType:
|
|
|
1752 description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort.
|
|
|
1753 type: string
|
|
|
1754 ingress:
|
|
|
1755 description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed.
|
|
|
1756 type: object
|
|
|
1757 properties:
|
|
|
1758 class:
|
|
|
1759 description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified.
|
|
|
1760 type: string
|
|
|
1761 ingressTemplate:
|
|
|
1762 description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges.
|
|
|
1763 type: object
|
|
|
1764 properties:
|
|
|
1765 metadata:
|
|
|
1766 description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values.
|
|
|
1767 type: object
|
|
|
1768 properties:
|
|
|
1769 annotations:
|
|
|
1770 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
|
|
|
1771 type: object
|
|
|
1772 additionalProperties:
|
|
|
1773 type: string
|
|
|
1774 labels:
|
|
|
1775 description: Labels that should be added to the created ACME HTTP01 solver ingress.
|
|
|
1776 type: object
|
|
|
1777 additionalProperties:
|
|
|
1778 type: string
|
|
|
1779 name:
|
|
|
1780 description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources.
|
|
|
1781 type: string
|
|
|
1782 podTemplate:
|
|
|
1783 description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges.
|
|
|
1784 type: object
|
|
|
1785 properties:
|
|
|
1786 metadata:
|
|
|
1787 description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values.
|
|
|
1788 type: object
|
|
|
1789 properties:
|
|
|
1790 annotations:
|
|
|
1791 description: Annotations that should be added to the create ACME HTTP01 solver pods.
|
|
|
1792 type: object
|
|
|
1793 additionalProperties:
|
|
|
1794 type: string
|
|
|
1795 labels:
|
|
|
1796 description: Labels that should be added to the created ACME HTTP01 solver pods.
|
|
|
1797 type: object
|
|
|
1798 additionalProperties:
|
|
|
1799 type: string
|
|
|
1800 spec:
|
|
|
1801 description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored.
|
|
|
1802 type: object
|
|
|
1803 properties:
|
|
|
1804 affinity:
|
|
|
1805 description: If specified, the pod's scheduling constraints
|
|
|
1806 type: object
|
|
|
1807 properties:
|
|
|
1808 nodeAffinity:
|
|
|
1809 description: Describes node affinity scheduling rules for the pod.
|
|
|
1810 type: object
|
|
|
1811 properties:
|
|
|
1812 preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
1813 description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
|
|
|
1814 type: array
|
|
|
1815 items:
|
|
|
1816 description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
|
|
|
1817 type: object
|
|
|
1818 required:
|
|
|
1819 - preference
|
|
|
1820 - weight
|
|
|
1821 properties:
|
|
|
1822 preference:
|
|
|
1823 description: A node selector term, associated with the corresponding weight.
|
|
|
1824 type: object
|
|
|
1825 properties:
|
|
|
1826 matchExpressions:
|
|
|
1827 description: A list of node selector requirements by node's labels.
|
|
|
1828 type: array
|
|
|
1829 items:
|
|
|
1830 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
1831 type: object
|
|
|
1832 required:
|
|
|
1833 - key
|
|
|
1834 - operator
|
|
|
1835 properties:
|
|
|
1836 key:
|
|
|
1837 description: The label key that the selector applies to.
|
|
|
1838 type: string
|
|
|
1839 operator:
|
|
|
1840 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
1841 type: string
|
|
|
1842 values:
|
|
|
1843 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
1844 type: array
|
|
|
1845 items:
|
|
|
1846 type: string
|
|
|
1847 matchFields:
|
|
|
1848 description: A list of node selector requirements by node's fields.
|
|
|
1849 type: array
|
|
|
1850 items:
|
|
|
1851 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
1852 type: object
|
|
|
1853 required:
|
|
|
1854 - key
|
|
|
1855 - operator
|
|
|
1856 properties:
|
|
|
1857 key:
|
|
|
1858 description: The label key that the selector applies to.
|
|
|
1859 type: string
|
|
|
1860 operator:
|
|
|
1861 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
1862 type: string
|
|
|
1863 values:
|
|
|
1864 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
1865 type: array
|
|
|
1866 items:
|
|
|
1867 type: string
|
|
|
1868 x-kubernetes-map-type: atomic
|
|
|
1869 weight:
|
|
|
1870 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
|
|
|
1871 type: integer
|
|
|
1872 format: int32
|
|
|
1873 requiredDuringSchedulingIgnoredDuringExecution:
|
|
|
1874 description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
|
|
|
1875 type: object
|
|
|
1876 required:
|
|
|
1877 - nodeSelectorTerms
|
|
|
1878 properties:
|
|
|
1879 nodeSelectorTerms:
|
|
|
1880 description: Required. A list of node selector terms. The terms are ORed.
|
|
|
1881 type: array
|
|
|
1882 items:
|
|
|
1883 description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
|
|
|
1884 type: object
|
|
|
1885 properties:
|
|
|
1886 matchExpressions:
|
|
|
1887 description: A list of node selector requirements by node's labels.
|
|
|
1888 type: array
|
|
|
1889 items:
|
|
|
1890 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
1891 type: object
|
|
|
1892 required:
|
|
|
1893 - key
|
|
|
1894 - operator
|
|
|
1895 properties:
|
|
|
1896 key:
|
|
|
1897 description: The label key that the selector applies to.
|
|
|
1898 type: string
|
|
|
1899 operator:
|
|
|
1900 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
1901 type: string
|
|
|
1902 values:
|
|
|
1903 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
1904 type: array
|
|
|
1905 items:
|
|
|
1906 type: string
|
|
|
1907 matchFields:
|
|
|
1908 description: A list of node selector requirements by node's fields.
|
|
|
1909 type: array
|
|
|
1910 items:
|
|
|
1911 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
1912 type: object
|
|
|
1913 required:
|
|
|
1914 - key
|
|
|
1915 - operator
|
|
|
1916 properties:
|
|
|
1917 key:
|
|
|
1918 description: The label key that the selector applies to.
|
|
|
1919 type: string
|
|
|
1920 operator:
|
|
|
1921 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
1922 type: string
|
|
|
1923 values:
|
|
|
1924 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
1925 type: array
|
|
|
1926 items:
|
|
|
1927 type: string
|
|
|
1928 x-kubernetes-map-type: atomic
|
|
|
1929 x-kubernetes-map-type: atomic
|
|
|
1930 podAffinity:
|
|
|
1931 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
|
|
|
1932 type: object
|
|
|
1933 properties:
|
|
|
1934 preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
1935 description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
|
|
|
1936 type: array
|
|
|
1937 items:
|
|
|
1938 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
|
|
|
1939 type: object
|
|
|
1940 required:
|
|
|
1941 - podAffinityTerm
|
|
|
1942 - weight
|
|
|
1943 properties:
|
|
|
1944 podAffinityTerm:
|
|
|
1945 description: Required. A pod affinity term, associated with the corresponding weight.
|
|
|
1946 type: object
|
|
|
1947 required:
|
|
|
1948 - topologyKey
|
|
|
1949 properties:
|
|
|
1950 labelSelector:
|
|
|
1951 description: A label query over a set of resources, in this case pods.
|
|
|
1952 type: object
|
|
|
1953 properties:
|
|
|
1954 matchExpressions:
|
|
|
1955 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
1956 type: array
|
|
|
1957 items:
|
|
|
1958 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
1959 type: object
|
|
|
1960 required:
|
|
|
1961 - key
|
|
|
1962 - operator
|
|
|
1963 properties:
|
|
|
1964 key:
|
|
|
1965 description: key is the label key that the selector applies to.
|
|
|
1966 type: string
|
|
|
1967 operator:
|
|
|
1968 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
1969 type: string
|
|
|
1970 values:
|
|
|
1971 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
1972 type: array
|
|
|
1973 items:
|
|
|
1974 type: string
|
|
|
1975 matchLabels:
|
|
|
1976 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
1977 type: object
|
|
|
1978 additionalProperties:
|
|
|
1979 type: string
|
|
|
1980 x-kubernetes-map-type: atomic
|
|
|
1981 namespaceSelector:
|
|
|
1982 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
1983 type: object
|
|
|
1984 properties:
|
|
|
1985 matchExpressions:
|
|
|
1986 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
1987 type: array
|
|
|
1988 items:
|
|
|
1989 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
1990 type: object
|
|
|
1991 required:
|
|
|
1992 - key
|
|
|
1993 - operator
|
|
|
1994 properties:
|
|
|
1995 key:
|
|
|
1996 description: key is the label key that the selector applies to.
|
|
|
1997 type: string
|
|
|
1998 operator:
|
|
|
1999 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
2000 type: string
|
|
|
2001 values:
|
|
|
2002 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
2003 type: array
|
|
|
2004 items:
|
|
|
2005 type: string
|
|
|
2006 matchLabels:
|
|
|
2007 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
2008 type: object
|
|
|
2009 additionalProperties:
|
|
|
2010 type: string
|
|
|
2011 x-kubernetes-map-type: atomic
|
|
|
2012 namespaces:
|
|
|
2013 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
2014 type: array
|
|
|
2015 items:
|
|
|
2016 type: string
|
|
|
2017 topologyKey:
|
|
|
2018 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
2019 type: string
|
|
|
2020 weight:
|
|
|
2021 description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
|
|
|
2022 type: integer
|
|
|
2023 format: int32
|
|
|
2024 requiredDuringSchedulingIgnoredDuringExecution:
|
|
|
2025 description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
|
|
|
2026 type: array
|
|
|
2027 items:
|
|
|
2028 description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running
|
|
|
2029 type: object
|
|
|
2030 required:
|
|
|
2031 - topologyKey
|
|
|
2032 properties:
|
|
|
2033 labelSelector:
|
|
|
2034 description: A label query over a set of resources, in this case pods.
|
|
|
2035 type: object
|
|
|
2036 properties:
|
|
|
2037 matchExpressions:
|
|
|
2038 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
2039 type: array
|
|
|
2040 items:
|
|
|
2041 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
2042 type: object
|
|
|
2043 required:
|
|
|
2044 - key
|
|
|
2045 - operator
|
|
|
2046 properties:
|
|
|
2047 key:
|
|
|
2048 description: key is the label key that the selector applies to.
|
|
|
2049 type: string
|
|
|
2050 operator:
|
|
|
2051 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
2052 type: string
|
|
|
2053 values:
|
|
|
2054 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
2055 type: array
|
|
|
2056 items:
|
|
|
2057 type: string
|
|
|
2058 matchLabels:
|
|
|
2059 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
2060 type: object
|
|
|
2061 additionalProperties:
|
|
|
2062 type: string
|
|
|
2063 x-kubernetes-map-type: atomic
|
|
|
2064 namespaceSelector:
|
|
|
2065 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
2066 type: object
|
|
|
2067 properties:
|
|
|
2068 matchExpressions:
|
|
|
2069 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
2070 type: array
|
|
|
2071 items:
|
|
|
2072 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
2073 type: object
|
|
|
2074 required:
|
|
|
2075 - key
|
|
|
2076 - operator
|
|
|
2077 properties:
|
|
|
2078 key:
|
|
|
2079 description: key is the label key that the selector applies to.
|
|
|
2080 type: string
|
|
|
2081 operator:
|
|
|
2082 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
2083 type: string
|
|
|
2084 values:
|
|
|
2085 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
2086 type: array
|
|
|
2087 items:
|
|
|
2088 type: string
|
|
|
2089 matchLabels:
|
|
|
2090 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
2091 type: object
|
|
|
2092 additionalProperties:
|
|
|
2093 type: string
|
|
|
2094 x-kubernetes-map-type: atomic
|
|
|
2095 namespaces:
|
|
|
2096 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
2097 type: array
|
|
|
2098 items:
|
|
|
2099 type: string
|
|
|
2100 topologyKey:
|
|
|
2101 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
2102 type: string
|
|
|
2103 podAntiAffinity:
|
|
|
2104 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
|
|
|
2105 type: object
|
|
|
2106 properties:
|
|
|
2107 preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
2108 description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
|
|
|
2109 type: array
|
|
|
2110 items:
|
|
|
2111 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
|
|
|
2112 type: object
|
|
|
2113 required:
|
|
|
2114 - podAffinityTerm
|
|
|
2115 - weight
|
|
|
2116 properties:
|
|
|
2117 podAffinityTerm:
|
|
|
2118 description: Required. A pod affinity term, associated with the corresponding weight.
|
|
|
2119 type: object
|
|
|
2120 required:
|
|
|
2121 - topologyKey
|
|
|
2122 properties:
|
|
|
2123 labelSelector:
|
|
|
2124 description: A label query over a set of resources, in this case pods.
|
|
|
2125 type: object
|
|
|
2126 properties:
|
|
|
2127 matchExpressions:
|
|
|
2128 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
2129 type: array
|
|
|
2130 items:
|
|
|
2131 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
2132 type: object
|
|
|
2133 required:
|
|
|
2134 - key
|
|
|
2135 - operator
|
|
|
2136 properties:
|
|
|
2137 key:
|
|
|
2138 description: key is the label key that the selector applies to.
|
|
|
2139 type: string
|
|
|
2140 operator:
|
|
|
2141 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
2142 type: string
|
|
|
2143 values:
|
|
|
2144 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
2145 type: array
|
|
|
2146 items:
|
|
|
2147 type: string
|
|
|
2148 matchLabels:
|
|
|
2149 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
2150 type: object
|
|
|
2151 additionalProperties:
|
|
|
2152 type: string
|
|
|
2153 x-kubernetes-map-type: atomic
|
|
|
2154 namespaceSelector:
|
|
|
2155 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
2156 type: object
|
|
|
2157 properties:
|
|
|
2158 matchExpressions:
|
|
|
2159 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
2160 type: array
|
|
|
2161 items:
|
|
|
2162 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
2163 type: object
|
|
|
2164 required:
|
|
|
2165 - key
|
|
|
2166 - operator
|
|
|
2167 properties:
|
|
|
2168 key:
|
|
|
2169 description: key is the label key that the selector applies to.
|
|
|
2170 type: string
|
|
|
2171 operator:
|
|
|
2172 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
2173 type: string
|
|
|
2174 values:
|
|
|
2175 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
2176 type: array
|
|
|
2177 items:
|
|
|
2178 type: string
|
|
|
2179 matchLabels:
|
|
|
2180 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
2181 type: object
|
|
|
2182 additionalProperties:
|
|
|
2183 type: string
|
|
|
2184 x-kubernetes-map-type: atomic
|
|
|
2185 namespaces:
|
|
|
2186 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
2187 type: array
|
|
|
2188 items:
|
|
|
2189 type: string
|
|
|
2190 topologyKey:
|
|
|
2191 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
2192 type: string
|
|
|
2193 weight:
|
|
|
2194 description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
|
|
|
2195 type: integer
|
|
|
2196 format: int32
|
|
|
2197 requiredDuringSchedulingIgnoredDuringExecution:
|
|
|
2198 description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
|
|
|
2199 type: array
|
|
|
2200 items:
|
|
|
2201 description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running
|
|
|
2202 type: object
|
|
|
2203 required:
|
|
|
2204 - topologyKey
|
|
|
2205 properties:
|
|
|
2206 labelSelector:
|
|
|
2207 description: A label query over a set of resources, in this case pods.
|
|
|
2208 type: object
|
|
|
2209 properties:
|
|
|
2210 matchExpressions:
|
|
|
2211 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
2212 type: array
|
|
|
2213 items:
|
|
|
2214 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
2215 type: object
|
|
|
2216 required:
|
|
|
2217 - key
|
|
|
2218 - operator
|
|
|
2219 properties:
|
|
|
2220 key:
|
|
|
2221 description: key is the label key that the selector applies to.
|
|
|
2222 type: string
|
|
|
2223 operator:
|
|
|
2224 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
2225 type: string
|
|
|
2226 values:
|
|
|
2227 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
2228 type: array
|
|
|
2229 items:
|
|
|
2230 type: string
|
|
|
2231 matchLabels:
|
|
|
2232 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
2233 type: object
|
|
|
2234 additionalProperties:
|
|
|
2235 type: string
|
|
|
2236 x-kubernetes-map-type: atomic
|
|
|
2237 namespaceSelector:
|
|
|
2238 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
2239 type: object
|
|
|
2240 properties:
|
|
|
2241 matchExpressions:
|
|
|
2242 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
2243 type: array
|
|
|
2244 items:
|
|
|
2245 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
2246 type: object
|
|
|
2247 required:
|
|
|
2248 - key
|
|
|
2249 - operator
|
|
|
2250 properties:
|
|
|
2251 key:
|
|
|
2252 description: key is the label key that the selector applies to.
|
|
|
2253 type: string
|
|
|
2254 operator:
|
|
|
2255 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
2256 type: string
|
|
|
2257 values:
|
|
|
2258 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
2259 type: array
|
|
|
2260 items:
|
|
|
2261 type: string
|
|
|
2262 matchLabels:
|
|
|
2263 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
2264 type: object
|
|
|
2265 additionalProperties:
|
|
|
2266 type: string
|
|
|
2267 x-kubernetes-map-type: atomic
|
|
|
2268 namespaces:
|
|
|
2269 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
2270 type: array
|
|
|
2271 items:
|
|
|
2272 type: string
|
|
|
2273 topologyKey:
|
|
|
2274 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
2275 type: string
|
|
|
2276 nodeSelector:
|
|
|
2277 description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
|
|
|
2278 type: object
|
|
|
2279 additionalProperties:
|
|
|
2280 type: string
|
|
|
2281 priorityClassName:
|
|
|
2282 description: If specified, the pod's priorityClassName.
|
|
|
2283 type: string
|
|
|
2284 serviceAccountName:
|
|
|
2285 description: If specified, the pod's service account
|
|
|
2286 type: string
|
|
|
2287 tolerations:
|
|
|
2288 description: If specified, the pod's tolerations.
|
|
|
2289 type: array
|
|
|
2290 items:
|
|
|
2291 description: The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.
|
|
|
2292 type: object
|
|
|
2293 properties:
|
|
|
2294 effect:
|
|
|
2295 description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
|
|
|
2296 type: string
|
|
|
2297 key:
|
|
|
2298 description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
|
|
|
2299 type: string
|
|
|
2300 operator:
|
|
|
2301 description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.
|
|
|
2302 type: string
|
|
|
2303 tolerationSeconds:
|
|
|
2304 description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
|
|
|
2305 type: integer
|
|
|
2306 format: int64
|
|
|
2307 value:
|
|
|
2308 description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
|
|
|
2309 type: string
|
|
|
2310 serviceType:
|
|
|
2311 description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort.
|
|
|
2312 type: string
|
|
|
2313 selector:
|
|
|
2314 description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead.
|
|
|
2315 type: object
|
|
|
2316 properties:
|
|
|
2317 dnsNames:
|
|
|
2318 description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected.
|
|
|
2319 type: array
|
|
|
2320 items:
|
|
|
2321 type: string
|
|
|
2322 dnsZones:
|
|
|
2323 description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected.
|
|
|
2324 type: array
|
|
|
2325 items:
|
|
|
2326 type: string
|
|
|
2327 matchLabels:
|
|
|
2328 description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to.
|
|
|
2329 type: object
|
|
|
2330 additionalProperties:
|
|
|
2331 type: string
|
|
|
2332 token:
|
|
|
2333 description: The ACME challenge token for this challenge. This is the raw value returned from the ACME server.
|
|
|
2334 type: string
|
|
|
2335 type:
|
|
|
2336 description: The type of ACME challenge this resource represents. One of "HTTP-01" or "DNS-01".
|
|
|
2337 type: string
|
|
|
2338 enum:
|
|
|
2339 - HTTP-01
|
|
|
2340 - DNS-01
|
|
|
2341 url:
|
|
|
2342 description: The URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge.
|
|
|
2343 type: string
|
|
|
2344 wildcard:
|
|
|
2345 description: wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'.
|
|
|
2346 type: boolean
|
|
|
2347 status:
|
|
|
2348 type: object
|
|
|
2349 properties:
|
|
|
2350 presented:
|
|
|
2351 description: presented will be set to true if the challenge values for this challenge are currently 'presented'. This *does not* imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured).
|
|
|
2352 type: boolean
|
|
|
2353 processing:
|
|
|
2354 description: Used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action.
|
|
|
2355 type: boolean
|
|
|
2356 reason:
|
|
|
2357 description: Contains human readable information on why the Challenge is in the current state.
|
|
|
2358 type: string
|
|
|
2359 state:
|
|
|
2360 description: Contains the current 'state' of the challenge. If not set, the state of the challenge is unknown.
|
|
|
2361 type: string
|
|
|
2362 enum:
|
|
|
2363 - valid
|
|
|
2364 - ready
|
|
|
2365 - pending
|
|
|
2366 - processing
|
|
|
2367 - invalid
|
|
|
2368 - expired
|
|
|
2369 - errored
|
|
|
2370 served: true
|
|
|
2371 storage: true
|
|
|
2372 subresources:
|
|
|
2373 status: {}
|
|
|
2374 ---
|
|
|
2375 # Source: cert-manager/templates/crds.yaml
|
|
|
2376 apiVersion: apiextensions.k8s.io/v1
|
|
|
2377 kind: CustomResourceDefinition
|
|
|
2378 metadata:
|
|
|
2379 name: certificaterequests.cert-manager.io
|
|
|
2380 labels:
|
|
|
2381 app: 'cert-manager'
|
|
|
2382 app.kubernetes.io/name: 'cert-manager'
|
|
|
2383 app.kubernetes.io/instance: 'cert-manager'
|
|
|
2384 # Generated labels
|
|
|
2385 app.kubernetes.io/version: "v1.10.1"
|
|
|
2386 spec:
|
|
|
2387 group: cert-manager.io
|
|
|
2388 names:
|
|
|
2389 kind: CertificateRequest
|
|
|
2390 listKind: CertificateRequestList
|
|
|
2391 plural: certificaterequests
|
|
|
2392 shortNames:
|
|
|
2393 - cr
|
|
|
2394 - crs
|
|
|
2395 singular: certificaterequest
|
|
|
2396 categories:
|
|
|
2397 - cert-manager
|
|
|
2398 scope: Namespaced
|
|
|
2399 versions:
|
|
|
2400 - name: v1
|
|
|
2401 subresources:
|
|
|
2402 status: {}
|
|
|
2403 additionalPrinterColumns:
|
|
|
2404 - jsonPath: .status.conditions[?(@.type=="Approved")].status
|
|
|
2405 name: Approved
|
|
|
2406 type: string
|
|
|
2407 - jsonPath: .status.conditions[?(@.type=="Denied")].status
|
|
|
2408 name: Denied
|
|
|
2409 type: string
|
|
|
2410 - jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
2411 name: Ready
|
|
|
2412 type: string
|
|
|
2413 - jsonPath: .spec.issuerRef.name
|
|
|
2414 name: Issuer
|
|
|
2415 type: string
|
|
|
2416 - jsonPath: .spec.username
|
|
|
2417 name: Requestor
|
|
|
2418 type: string
|
|
|
2419 - jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
2420 name: Status
|
|
|
2421 priority: 1
|
|
|
2422 type: string
|
|
|
2423 - jsonPath: .metadata.creationTimestamp
|
|
|
2424 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
|
|
|
2425 name: Age
|
|
|
2426 type: date
|
|
|
2427 schema:
|
|
|
2428 openAPIV3Schema:
|
|
|
2429 description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a one-shot resource, meaning it represents a single point in time request for a certificate and cannot be re-used."
|
|
|
2430 type: object
|
|
|
2431 required:
|
|
|
2432 - spec
|
|
|
2433 properties:
|
|
|
2434 apiVersion:
|
|
|
2435 description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
2436 type: string
|
|
|
2437 kind:
|
|
|
2438 description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
2439 type: string
|
|
|
2440 metadata:
|
|
|
2441 type: object
|
|
|
2442 spec:
|
|
|
2443 description: Desired state of the CertificateRequest resource.
|
|
|
2444 type: object
|
|
|
2445 required:
|
|
|
2446 - issuerRef
|
|
|
2447 - request
|
|
|
2448 properties:
|
|
|
2449 duration:
|
|
|
2450 description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types.
|
|
|
2451 type: string
|
|
|
2452 extra:
|
|
|
2453 description: Extra contains extra attributes of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable.
|
|
|
2454 type: object
|
|
|
2455 additionalProperties:
|
|
|
2456 type: array
|
|
|
2457 items:
|
|
|
2458 type: string
|
|
|
2459 groups:
|
|
|
2460 description: Groups contains group membership of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable.
|
|
|
2461 type: array
|
|
|
2462 items:
|
|
|
2463 type: string
|
|
|
2464 x-kubernetes-list-type: atomic
|
|
|
2465 isCA:
|
|
|
2466 description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`.
|
|
|
2467 type: boolean
|
|
|
2468 issuerRef:
|
|
|
2469 description: IssuerRef is a reference to the issuer for this CertificateRequest. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to `cert-manager.io` if empty.
|
|
|
2470 type: object
|
|
|
2471 required:
|
|
|
2472 - name
|
|
|
2473 properties:
|
|
|
2474 group:
|
|
|
2475 description: Group of the resource being referred to.
|
|
|
2476 type: string
|
|
|
2477 kind:
|
|
|
2478 description: Kind of the resource being referred to.
|
|
|
2479 type: string
|
|
|
2480 name:
|
|
|
2481 description: Name of the resource being referred to.
|
|
|
2482 type: string
|
|
|
2483 request:
|
|
|
2484 description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing.
|
|
|
2485 type: string
|
|
|
2486 format: byte
|
|
|
2487 uid:
|
|
|
2488 description: UID contains the uid of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable.
|
|
|
2489 type: string
|
|
|
2490 usages:
|
|
|
2491 description: Usages is the set of x509 usages that are requested for the certificate. If usages are set they SHOULD be encoded inside the CSR spec Defaults to `digital signature` and `key encipherment` if not specified.
|
|
|
2492 type: array
|
|
|
2493 items:
|
|
|
2494 description: "KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 \n Valid KeyUsage values are as follows: \"signing\", \"digital signature\", \"content commitment\", \"key encipherment\", \"key agreement\", \"data encipherment\", \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\", \"server auth\", \"client auth\", \"code signing\", \"email protection\", \"s/mime\", \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\", \"timestamping\", \"ocsp signing\", \"microsoft sgc\", \"netscape sgc\""
|
|
|
2495 type: string
|
|
|
2496 enum:
|
|
|
2497 - signing
|
|
|
2498 - digital signature
|
|
|
2499 - content commitment
|
|
|
2500 - key encipherment
|
|
|
2501 - key agreement
|
|
|
2502 - data encipherment
|
|
|
2503 - cert sign
|
|
|
2504 - crl sign
|
|
|
2505 - encipher only
|
|
|
2506 - decipher only
|
|
|
2507 - any
|
|
|
2508 - server auth
|
|
|
2509 - client auth
|
|
|
2510 - code signing
|
|
|
2511 - email protection
|
|
|
2512 - s/mime
|
|
|
2513 - ipsec end system
|
|
|
2514 - ipsec tunnel
|
|
|
2515 - ipsec user
|
|
|
2516 - timestamping
|
|
|
2517 - ocsp signing
|
|
|
2518 - microsoft sgc
|
|
|
2519 - netscape sgc
|
|
|
2520 username:
|
|
|
2521 description: Username contains the name of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable.
|
|
|
2522 type: string
|
|
|
2523 status:
|
|
|
2524 description: Status of the CertificateRequest. This is set and managed automatically.
|
|
|
2525 type: object
|
|
|
2526 properties:
|
|
|
2527 ca:
|
|
|
2528 description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available.
|
|
|
2529 type: string
|
|
|
2530 format: byte
|
|
|
2531 certificate:
|
|
|
2532 description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field.
|
|
|
2533 type: string
|
|
|
2534 format: byte
|
|
|
2535 conditions:
|
|
|
2536 description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
|
|
|
2537 type: array
|
|
|
2538 items:
|
|
|
2539 description: CertificateRequestCondition contains condition information for a CertificateRequest.
|
|
|
2540 type: object
|
|
|
2541 required:
|
|
|
2542 - status
|
|
|
2543 - type
|
|
|
2544 properties:
|
|
|
2545 lastTransitionTime:
|
|
|
2546 description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
|
|
|
2547 type: string
|
|
|
2548 format: date-time
|
|
|
2549 message:
|
|
|
2550 description: Message is a human readable description of the details of the last transition, complementing reason.
|
|
|
2551 type: string
|
|
|
2552 reason:
|
|
|
2553 description: Reason is a brief machine readable explanation for the condition's last transition.
|
|
|
2554 type: string
|
|
|
2555 status:
|
|
|
2556 description: Status of the condition, one of (`True`, `False`, `Unknown`).
|
|
|
2557 type: string
|
|
|
2558 enum:
|
|
|
2559 - "True"
|
|
|
2560 - "False"
|
|
|
2561 - Unknown
|
|
|
2562 type:
|
|
|
2563 description: Type of the condition, known values are (`Ready`, `InvalidRequest`, `Approved`, `Denied`).
|
|
|
2564 type: string
|
|
|
2565 x-kubernetes-list-map-keys:
|
|
|
2566 - type
|
|
|
2567 x-kubernetes-list-type: map
|
|
|
2568 failureTime:
|
|
|
2569 description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.
|
|
|
2570 type: string
|
|
|
2571 format: date-time
|
|
|
2572 served: true
|
|
|
2573 storage: true
|
|
|
2574 ---
|
|
|
2575 # Source: cert-manager/templates/crds.yaml
|
|
|
2576 apiVersion: apiextensions.k8s.io/v1
|
|
|
2577 kind: CustomResourceDefinition
|
|
|
2578 metadata:
|
|
|
2579 name: issuers.cert-manager.io
|
|
|
2580 labels:
|
|
|
2581 app: 'cert-manager'
|
|
|
2582 app.kubernetes.io/name: 'cert-manager'
|
|
|
2583 app.kubernetes.io/instance: 'cert-manager'
|
|
|
2584 # Generated labels
|
|
|
2585 app.kubernetes.io/version: "v1.10.1"
|
|
|
2586 spec:
|
|
|
2587 group: cert-manager.io
|
|
|
2588 names:
|
|
|
2589 kind: Issuer
|
|
|
2590 listKind: IssuerList
|
|
|
2591 plural: issuers
|
|
|
2592 singular: issuer
|
|
|
2593 categories:
|
|
|
2594 - cert-manager
|
|
|
2595 scope: Namespaced
|
|
|
2596 versions:
|
|
|
2597 - name: v1
|
|
|
2598 subresources:
|
|
|
2599 status: {}
|
|
|
2600 additionalPrinterColumns:
|
|
|
2601 - jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
2602 name: Ready
|
|
|
2603 type: string
|
|
|
2604 - jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
2605 name: Status
|
|
|
2606 priority: 1
|
|
|
2607 type: string
|
|
|
2608 - jsonPath: .metadata.creationTimestamp
|
|
|
2609 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
|
|
|
2610 name: Age
|
|
|
2611 type: date
|
|
|
2612 schema:
|
|
|
2613 openAPIV3Schema:
|
|
|
2614 description: An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace.
|
|
|
2615 type: object
|
|
|
2616 required:
|
|
|
2617 - spec
|
|
|
2618 properties:
|
|
|
2619 apiVersion:
|
|
|
2620 description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
2621 type: string
|
|
|
2622 kind:
|
|
|
2623 description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
2624 type: string
|
|
|
2625 metadata:
|
|
|
2626 type: object
|
|
|
2627 spec:
|
|
|
2628 description: Desired state of the Issuer resource.
|
|
|
2629 type: object
|
|
|
2630 properties:
|
|
|
2631 acme:
|
|
|
2632 description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates.
|
|
|
2633 type: object
|
|
|
2634 required:
|
|
|
2635 - privateKeySecretRef
|
|
|
2636 - server
|
|
|
2637 properties:
|
|
|
2638 disableAccountKeyGeneration:
|
|
|
2639 description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false.
|
|
|
2640 type: boolean
|
|
|
2641 email:
|
|
|
2642 description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered.
|
|
|
2643 type: string
|
|
|
2644 enableDurationFeature:
|
|
|
2645 description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false.
|
|
|
2646 type: boolean
|
|
|
2647 externalAccountBinding:
|
|
|
2648 description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account.
|
|
|
2649 type: object
|
|
|
2650 required:
|
|
|
2651 - keyID
|
|
|
2652 - keySecretRef
|
|
|
2653 properties:
|
|
|
2654 keyAlgorithm:
|
|
|
2655 description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.'
|
|
|
2656 type: string
|
|
|
2657 enum:
|
|
|
2658 - HS256
|
|
|
2659 - HS384
|
|
|
2660 - HS512
|
|
|
2661 keyID:
|
|
|
2662 description: keyID is the ID of the CA key that the External Account is bound to.
|
|
|
2663 type: string
|
|
|
2664 keySecretRef:
|
|
|
2665 description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data.
|
|
|
2666 type: object
|
|
|
2667 required:
|
|
|
2668 - name
|
|
|
2669 properties:
|
|
|
2670 key:
|
|
|
2671 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2672 type: string
|
|
|
2673 name:
|
|
|
2674 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2675 type: string
|
|
|
2676 preferredChain:
|
|
|
2677 description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN'
|
|
|
2678 type: string
|
|
|
2679 maxLength: 64
|
|
|
2680 privateKeySecretRef:
|
|
|
2681 description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used.
|
|
|
2682 type: object
|
|
|
2683 required:
|
|
|
2684 - name
|
|
|
2685 properties:
|
|
|
2686 key:
|
|
|
2687 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2688 type: string
|
|
|
2689 name:
|
|
|
2690 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2691 type: string
|
|
|
2692 server:
|
|
|
2693 description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.'
|
|
|
2694 type: string
|
|
|
2695 skipTLSVerify:
|
|
|
2696 description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false.
|
|
|
2697 type: boolean
|
|
|
2698 solvers:
|
|
|
2699 description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/'
|
|
|
2700 type: array
|
|
|
2701 items:
|
|
|
2702 description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided.
|
|
|
2703 type: object
|
|
|
2704 properties:
|
|
|
2705 dns01:
|
|
|
2706 description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow.
|
|
|
2707 type: object
|
|
|
2708 properties:
|
|
|
2709 acmeDNS:
|
|
|
2710 description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records.
|
|
|
2711 type: object
|
|
|
2712 required:
|
|
|
2713 - accountSecretRef
|
|
|
2714 - host
|
|
|
2715 properties:
|
|
|
2716 accountSecretRef:
|
|
|
2717 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
2718 type: object
|
|
|
2719 required:
|
|
|
2720 - name
|
|
|
2721 properties:
|
|
|
2722 key:
|
|
|
2723 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2724 type: string
|
|
|
2725 name:
|
|
|
2726 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2727 type: string
|
|
|
2728 host:
|
|
|
2729 type: string
|
|
|
2730 akamai:
|
|
|
2731 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
|
|
|
2732 type: object
|
|
|
2733 required:
|
|
|
2734 - accessTokenSecretRef
|
|
|
2735 - clientSecretSecretRef
|
|
|
2736 - clientTokenSecretRef
|
|
|
2737 - serviceConsumerDomain
|
|
|
2738 properties:
|
|
|
2739 accessTokenSecretRef:
|
|
|
2740 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
2741 type: object
|
|
|
2742 required:
|
|
|
2743 - name
|
|
|
2744 properties:
|
|
|
2745 key:
|
|
|
2746 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2747 type: string
|
|
|
2748 name:
|
|
|
2749 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2750 type: string
|
|
|
2751 clientSecretSecretRef:
|
|
|
2752 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
2753 type: object
|
|
|
2754 required:
|
|
|
2755 - name
|
|
|
2756 properties:
|
|
|
2757 key:
|
|
|
2758 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2759 type: string
|
|
|
2760 name:
|
|
|
2761 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2762 type: string
|
|
|
2763 clientTokenSecretRef:
|
|
|
2764 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
2765 type: object
|
|
|
2766 required:
|
|
|
2767 - name
|
|
|
2768 properties:
|
|
|
2769 key:
|
|
|
2770 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2771 type: string
|
|
|
2772 name:
|
|
|
2773 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2774 type: string
|
|
|
2775 serviceConsumerDomain:
|
|
|
2776 type: string
|
|
|
2777 azureDNS:
|
|
|
2778 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
|
|
|
2779 type: object
|
|
|
2780 required:
|
|
|
2781 - resourceGroupName
|
|
|
2782 - subscriptionID
|
|
|
2783 properties:
|
|
|
2784 clientID:
|
|
|
2785 description: if both this and ClientSecret are left unset MSI will be used
|
|
|
2786 type: string
|
|
|
2787 clientSecretSecretRef:
|
|
|
2788 description: if both this and ClientID are left unset MSI will be used
|
|
|
2789 type: object
|
|
|
2790 required:
|
|
|
2791 - name
|
|
|
2792 properties:
|
|
|
2793 key:
|
|
|
2794 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2795 type: string
|
|
|
2796 name:
|
|
|
2797 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2798 type: string
|
|
|
2799 environment:
|
|
|
2800 description: name of the Azure environment (default AzurePublicCloud)
|
|
|
2801 type: string
|
|
|
2802 enum:
|
|
|
2803 - AzurePublicCloud
|
|
|
2804 - AzureChinaCloud
|
|
|
2805 - AzureGermanCloud
|
|
|
2806 - AzureUSGovernmentCloud
|
|
|
2807 hostedZoneName:
|
|
|
2808 description: name of the DNS zone that should be used
|
|
|
2809 type: string
|
|
|
2810 managedIdentity:
|
|
|
2811 description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID
|
|
|
2812 type: object
|
|
|
2813 properties:
|
|
|
2814 clientID:
|
|
|
2815 description: client ID of the managed identity, can not be used at the same time as resourceID
|
|
|
2816 type: string
|
|
|
2817 resourceID:
|
|
|
2818 description: resource ID of the managed identity, can not be used at the same time as clientID
|
|
|
2819 type: string
|
|
|
2820 resourceGroupName:
|
|
|
2821 description: resource group the DNS zone is located in
|
|
|
2822 type: string
|
|
|
2823 subscriptionID:
|
|
|
2824 description: ID of the Azure subscription
|
|
|
2825 type: string
|
|
|
2826 tenantID:
|
|
|
2827 description: when specifying ClientID and ClientSecret then this field is also needed
|
|
|
2828 type: string
|
|
|
2829 cloudDNS:
|
|
|
2830 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
|
|
|
2831 type: object
|
|
|
2832 required:
|
|
|
2833 - project
|
|
|
2834 properties:
|
|
|
2835 hostedZoneName:
|
|
|
2836 description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone.
|
|
|
2837 type: string
|
|
|
2838 project:
|
|
|
2839 type: string
|
|
|
2840 serviceAccountSecretRef:
|
|
|
2841 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
2842 type: object
|
|
|
2843 required:
|
|
|
2844 - name
|
|
|
2845 properties:
|
|
|
2846 key:
|
|
|
2847 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2848 type: string
|
|
|
2849 name:
|
|
|
2850 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2851 type: string
|
|
|
2852 cloudflare:
|
|
|
2853 description: Use the Cloudflare API to manage DNS01 challenge records.
|
|
|
2854 type: object
|
|
|
2855 properties:
|
|
|
2856 apiKeySecretRef:
|
|
|
2857 description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.'
|
|
|
2858 type: object
|
|
|
2859 required:
|
|
|
2860 - name
|
|
|
2861 properties:
|
|
|
2862 key:
|
|
|
2863 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2864 type: string
|
|
|
2865 name:
|
|
|
2866 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2867 type: string
|
|
|
2868 apiTokenSecretRef:
|
|
|
2869 description: API token used to authenticate with Cloudflare.
|
|
|
2870 type: object
|
|
|
2871 required:
|
|
|
2872 - name
|
|
|
2873 properties:
|
|
|
2874 key:
|
|
|
2875 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2876 type: string
|
|
|
2877 name:
|
|
|
2878 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2879 type: string
|
|
|
2880 email:
|
|
|
2881 description: Email of the account, only required when using API key based authentication.
|
|
|
2882 type: string
|
|
|
2883 cnameStrategy:
|
|
|
2884 description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones.
|
|
|
2885 type: string
|
|
|
2886 enum:
|
|
|
2887 - None
|
|
|
2888 - Follow
|
|
|
2889 digitalocean:
|
|
|
2890 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
|
|
|
2891 type: object
|
|
|
2892 required:
|
|
|
2893 - tokenSecretRef
|
|
|
2894 properties:
|
|
|
2895 tokenSecretRef:
|
|
|
2896 description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field.
|
|
|
2897 type: object
|
|
|
2898 required:
|
|
|
2899 - name
|
|
|
2900 properties:
|
|
|
2901 key:
|
|
|
2902 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2903 type: string
|
|
|
2904 name:
|
|
|
2905 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2906 type: string
|
|
|
2907 rfc2136:
|
|
|
2908 description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records.
|
|
|
2909 type: object
|
|
|
2910 required:
|
|
|
2911 - nameserver
|
|
|
2912 properties:
|
|
|
2913 nameserver:
|
|
|
2914 description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1])Â ; port is optional. This field is required.
|
|
|
2915 type: string
|
|
|
2916 tsigAlgorithm:
|
|
|
2917 description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.'
|
|
|
2918 type: string
|
|
|
2919 tsigKeyName:
|
|
|
2920 description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required.
|
|
|
2921 type: string
|
|
|
2922 tsigSecretSecretRef:
|
|
|
2923 description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required.
|
|
|
2924 type: object
|
|
|
2925 required:
|
|
|
2926 - name
|
|
|
2927 properties:
|
|
|
2928 key:
|
|
|
2929 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2930 type: string
|
|
|
2931 name:
|
|
|
2932 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2933 type: string
|
|
|
2934 route53:
|
|
|
2935 description: Use the AWS Route53 API to manage DNS01 challenge records.
|
|
|
2936 type: object
|
|
|
2937 required:
|
|
|
2938 - region
|
|
|
2939 properties:
|
|
|
2940 accessKeyID:
|
|
|
2941 description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
2942 type: string
|
|
|
2943 accessKeyIDSecretRef:
|
|
|
2944 description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
2945 type: object
|
|
|
2946 required:
|
|
|
2947 - name
|
|
|
2948 properties:
|
|
|
2949 key:
|
|
|
2950 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2951 type: string
|
|
|
2952 name:
|
|
|
2953 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2954 type: string
|
|
|
2955 hostedZoneID:
|
|
|
2956 description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
|
|
|
2957 type: string
|
|
|
2958 region:
|
|
|
2959 description: Always set the region when using AccessKeyID and SecretAccessKey
|
|
|
2960 type: string
|
|
|
2961 role:
|
|
|
2962 description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
|
|
|
2963 type: string
|
|
|
2964 secretAccessKeySecretRef:
|
|
|
2965 description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
2966 type: object
|
|
|
2967 required:
|
|
|
2968 - name
|
|
|
2969 properties:
|
|
|
2970 key:
|
|
|
2971 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
2972 type: string
|
|
|
2973 name:
|
|
|
2974 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
2975 type: string
|
|
|
2976 webhook:
|
|
|
2977 description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records.
|
|
|
2978 type: object
|
|
|
2979 required:
|
|
|
2980 - groupName
|
|
|
2981 - solverName
|
|
|
2982 properties:
|
|
|
2983 config:
|
|
|
2984 description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation.
|
|
|
2985 x-kubernetes-preserve-unknown-fields: true
|
|
|
2986 groupName:
|
|
|
2987 description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation.
|
|
|
2988 type: string
|
|
|
2989 solverName:
|
|
|
2990 description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'.
|
|
|
2991 type: string
|
|
|
2992 http01:
|
|
|
2993 description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
|
|
|
2994 type: object
|
|
|
2995 properties:
|
|
|
2996 gatewayHTTPRoute:
|
|
|
2997 description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future.
|
|
|
2998 type: object
|
|
|
2999 properties:
|
|
|
3000 labels:
|
|
|
3001 description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges.
|
|
|
3002 type: object
|
|
|
3003 additionalProperties:
|
|
|
3004 type: string
|
|
|
3005 parentRefs:
|
|
|
3006 description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/v1alpha2/api-types/httproute/#attaching-to-gateways'
|
|
|
3007 type: array
|
|
|
3008 items:
|
|
|
3009 description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid."
|
|
|
3010 type: object
|
|
|
3011 required:
|
|
|
3012 - name
|
|
|
3013 properties:
|
|
|
3014 group:
|
|
|
3015 description: "Group is the group of the referent. \n Support: Core"
|
|
|
3016 type: string
|
|
|
3017 default: gateway.networking.k8s.io
|
|
|
3018 maxLength: 253
|
|
|
3019 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
|
3020 kind:
|
|
|
3021 description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Custom (Other Resources)"
|
|
|
3022 type: string
|
|
|
3023 default: Gateway
|
|
|
3024 maxLength: 63
|
|
|
3025 minLength: 1
|
|
|
3026 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
|
|
3027 name:
|
|
|
3028 description: "Name is the name of the referent. \n Support: Core"
|
|
|
3029 type: string
|
|
|
3030 maxLength: 253
|
|
|
3031 minLength: 1
|
|
|
3032 namespace:
|
|
|
3033 description: "Namespace is the namespace of the referent. When unspecified (or empty string), this refers to the local namespace of the Route. \n Support: Core"
|
|
|
3034 type: string
|
|
|
3035 maxLength: 63
|
|
|
3036 minLength: 1
|
|
|
3037 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
|
|
3038 port:
|
|
|
3039 description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n <gateway:experimental>"
|
|
|
3040 type: integer
|
|
|
3041 format: int32
|
|
|
3042 maximum: 65535
|
|
|
3043 minimum: 1
|
|
|
3044 sectionName:
|
|
|
3045 description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core"
|
|
|
3046 type: string
|
|
|
3047 maxLength: 253
|
|
|
3048 minLength: 1
|
|
|
3049 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
|
3050 serviceType:
|
|
|
3051 description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort.
|
|
|
3052 type: string
|
|
|
3053 ingress:
|
|
|
3054 description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed.
|
|
|
3055 type: object
|
|
|
3056 properties:
|
|
|
3057 class:
|
|
|
3058 description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified.
|
|
|
3059 type: string
|
|
|
3060 ingressTemplate:
|
|
|
3061 description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges.
|
|
|
3062 type: object
|
|
|
3063 properties:
|
|
|
3064 metadata:
|
|
|
3065 description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values.
|
|
|
3066 type: object
|
|
|
3067 properties:
|
|
|
3068 annotations:
|
|
|
3069 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
|
|
|
3070 type: object
|
|
|
3071 additionalProperties:
|
|
|
3072 type: string
|
|
|
3073 labels:
|
|
|
3074 description: Labels that should be added to the created ACME HTTP01 solver ingress.
|
|
|
3075 type: object
|
|
|
3076 additionalProperties:
|
|
|
3077 type: string
|
|
|
3078 name:
|
|
|
3079 description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources.
|
|
|
3080 type: string
|
|
|
3081 podTemplate:
|
|
|
3082 description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges.
|
|
|
3083 type: object
|
|
|
3084 properties:
|
|
|
3085 metadata:
|
|
|
3086 description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values.
|
|
|
3087 type: object
|
|
|
3088 properties:
|
|
|
3089 annotations:
|
|
|
3090 description: Annotations that should be added to the create ACME HTTP01 solver pods.
|
|
|
3091 type: object
|
|
|
3092 additionalProperties:
|
|
|
3093 type: string
|
|
|
3094 labels:
|
|
|
3095 description: Labels that should be added to the created ACME HTTP01 solver pods.
|
|
|
3096 type: object
|
|
|
3097 additionalProperties:
|
|
|
3098 type: string
|
|
|
3099 spec:
|
|
|
3100 description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored.
|
|
|
3101 type: object
|
|
|
3102 properties:
|
|
|
3103 affinity:
|
|
|
3104 description: If specified, the pod's scheduling constraints
|
|
|
3105 type: object
|
|
|
3106 properties:
|
|
|
3107 nodeAffinity:
|
|
|
3108 description: Describes node affinity scheduling rules for the pod.
|
|
|
3109 type: object
|
|
|
3110 properties:
|
|
|
3111 preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
3112 description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
|
|
|
3113 type: array
|
|
|
3114 items:
|
|
|
3115 description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
|
|
|
3116 type: object
|
|
|
3117 required:
|
|
|
3118 - preference
|
|
|
3119 - weight
|
|
|
3120 properties:
|
|
|
3121 preference:
|
|
|
3122 description: A node selector term, associated with the corresponding weight.
|
|
|
3123 type: object
|
|
|
3124 properties:
|
|
|
3125 matchExpressions:
|
|
|
3126 description: A list of node selector requirements by node's labels.
|
|
|
3127 type: array
|
|
|
3128 items:
|
|
|
3129 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3130 type: object
|
|
|
3131 required:
|
|
|
3132 - key
|
|
|
3133 - operator
|
|
|
3134 properties:
|
|
|
3135 key:
|
|
|
3136 description: The label key that the selector applies to.
|
|
|
3137 type: string
|
|
|
3138 operator:
|
|
|
3139 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
3140 type: string
|
|
|
3141 values:
|
|
|
3142 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
3143 type: array
|
|
|
3144 items:
|
|
|
3145 type: string
|
|
|
3146 matchFields:
|
|
|
3147 description: A list of node selector requirements by node's fields.
|
|
|
3148 type: array
|
|
|
3149 items:
|
|
|
3150 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3151 type: object
|
|
|
3152 required:
|
|
|
3153 - key
|
|
|
3154 - operator
|
|
|
3155 properties:
|
|
|
3156 key:
|
|
|
3157 description: The label key that the selector applies to.
|
|
|
3158 type: string
|
|
|
3159 operator:
|
|
|
3160 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
3161 type: string
|
|
|
3162 values:
|
|
|
3163 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
3164 type: array
|
|
|
3165 items:
|
|
|
3166 type: string
|
|
|
3167 x-kubernetes-map-type: atomic
|
|
|
3168 weight:
|
|
|
3169 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
|
|
|
3170 type: integer
|
|
|
3171 format: int32
|
|
|
3172 requiredDuringSchedulingIgnoredDuringExecution:
|
|
|
3173 description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
|
|
|
3174 type: object
|
|
|
3175 required:
|
|
|
3176 - nodeSelectorTerms
|
|
|
3177 properties:
|
|
|
3178 nodeSelectorTerms:
|
|
|
3179 description: Required. A list of node selector terms. The terms are ORed.
|
|
|
3180 type: array
|
|
|
3181 items:
|
|
|
3182 description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
|
|
|
3183 type: object
|
|
|
3184 properties:
|
|
|
3185 matchExpressions:
|
|
|
3186 description: A list of node selector requirements by node's labels.
|
|
|
3187 type: array
|
|
|
3188 items:
|
|
|
3189 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3190 type: object
|
|
|
3191 required:
|
|
|
3192 - key
|
|
|
3193 - operator
|
|
|
3194 properties:
|
|
|
3195 key:
|
|
|
3196 description: The label key that the selector applies to.
|
|
|
3197 type: string
|
|
|
3198 operator:
|
|
|
3199 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
3200 type: string
|
|
|
3201 values:
|
|
|
3202 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
3203 type: array
|
|
|
3204 items:
|
|
|
3205 type: string
|
|
|
3206 matchFields:
|
|
|
3207 description: A list of node selector requirements by node's fields.
|
|
|
3208 type: array
|
|
|
3209 items:
|
|
|
3210 description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3211 type: object
|
|
|
3212 required:
|
|
|
3213 - key
|
|
|
3214 - operator
|
|
|
3215 properties:
|
|
|
3216 key:
|
|
|
3217 description: The label key that the selector applies to.
|
|
|
3218 type: string
|
|
|
3219 operator:
|
|
|
3220 description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
|
|
3221 type: string
|
|
|
3222 values:
|
|
|
3223 description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
|
|
|
3224 type: array
|
|
|
3225 items:
|
|
|
3226 type: string
|
|
|
3227 x-kubernetes-map-type: atomic
|
|
|
3228 x-kubernetes-map-type: atomic
|
|
|
3229 podAffinity:
|
|
|
3230 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
|
|
|
3231 type: object
|
|
|
3232 properties:
|
|
|
3233 preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
3234 description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
|
|
|
3235 type: array
|
|
|
3236 items:
|
|
|
3237 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
|
|
|
3238 type: object
|
|
|
3239 required:
|
|
|
3240 - podAffinityTerm
|
|
|
3241 - weight
|
|
|
3242 properties:
|
|
|
3243 podAffinityTerm:
|
|
|
3244 description: Required. A pod affinity term, associated with the corresponding weight.
|
|
|
3245 type: object
|
|
|
3246 required:
|
|
|
3247 - topologyKey
|
|
|
3248 properties:
|
|
|
3249 labelSelector:
|
|
|
3250 description: A label query over a set of resources, in this case pods.
|
|
|
3251 type: object
|
|
|
3252 properties:
|
|
|
3253 matchExpressions:
|
|
|
3254 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
3255 type: array
|
|
|
3256 items:
|
|
|
3257 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3258 type: object
|
|
|
3259 required:
|
|
|
3260 - key
|
|
|
3261 - operator
|
|
|
3262 properties:
|
|
|
3263 key:
|
|
|
3264 description: key is the label key that the selector applies to.
|
|
|
3265 type: string
|
|
|
3266 operator:
|
|
|
3267 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
3268 type: string
|
|
|
3269 values:
|
|
|
3270 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
3271 type: array
|
|
|
3272 items:
|
|
|
3273 type: string
|
|
|
3274 matchLabels:
|
|
|
3275 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
3276 type: object
|
|
|
3277 additionalProperties:
|
|
|
3278 type: string
|
|
|
3279 x-kubernetes-map-type: atomic
|
|
|
3280 namespaceSelector:
|
|
|
3281 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
3282 type: object
|
|
|
3283 properties:
|
|
|
3284 matchExpressions:
|
|
|
3285 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
3286 type: array
|
|
|
3287 items:
|
|
|
3288 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3289 type: object
|
|
|
3290 required:
|
|
|
3291 - key
|
|
|
3292 - operator
|
|
|
3293 properties:
|
|
|
3294 key:
|
|
|
3295 description: key is the label key that the selector applies to.
|
|
|
3296 type: string
|
|
|
3297 operator:
|
|
|
3298 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
3299 type: string
|
|
|
3300 values:
|
|
|
3301 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
3302 type: array
|
|
|
3303 items:
|
|
|
3304 type: string
|
|
|
3305 matchLabels:
|
|
|
3306 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
3307 type: object
|
|
|
3308 additionalProperties:
|
|
|
3309 type: string
|
|
|
3310 x-kubernetes-map-type: atomic
|
|
|
3311 namespaces:
|
|
|
3312 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
3313 type: array
|
|
|
3314 items:
|
|
|
3315 type: string
|
|
|
3316 topologyKey:
|
|
|
3317 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
3318 type: string
|
|
|
3319 weight:
|
|
|
3320 description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
|
|
|
3321 type: integer
|
|
|
3322 format: int32
|
|
|
3323 requiredDuringSchedulingIgnoredDuringExecution:
|
|
|
3324 description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
|
|
|
3325 type: array
|
|
|
3326 items:
|
|
|
3327 description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running
|
|
|
3328 type: object
|
|
|
3329 required:
|
|
|
3330 - topologyKey
|
|
|
3331 properties:
|
|
|
3332 labelSelector:
|
|
|
3333 description: A label query over a set of resources, in this case pods.
|
|
|
3334 type: object
|
|
|
3335 properties:
|
|
|
3336 matchExpressions:
|
|
|
3337 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
3338 type: array
|
|
|
3339 items:
|
|
|
3340 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3341 type: object
|
|
|
3342 required:
|
|
|
3343 - key
|
|
|
3344 - operator
|
|
|
3345 properties:
|
|
|
3346 key:
|
|
|
3347 description: key is the label key that the selector applies to.
|
|
|
3348 type: string
|
|
|
3349 operator:
|
|
|
3350 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
3351 type: string
|
|
|
3352 values:
|
|
|
3353 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
3354 type: array
|
|
|
3355 items:
|
|
|
3356 type: string
|
|
|
3357 matchLabels:
|
|
|
3358 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
3359 type: object
|
|
|
3360 additionalProperties:
|
|
|
3361 type: string
|
|
|
3362 x-kubernetes-map-type: atomic
|
|
|
3363 namespaceSelector:
|
|
|
3364 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
3365 type: object
|
|
|
3366 properties:
|
|
|
3367 matchExpressions:
|
|
|
3368 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
3369 type: array
|
|
|
3370 items:
|
|
|
3371 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3372 type: object
|
|
|
3373 required:
|
|
|
3374 - key
|
|
|
3375 - operator
|
|
|
3376 properties:
|
|
|
3377 key:
|
|
|
3378 description: key is the label key that the selector applies to.
|
|
|
3379 type: string
|
|
|
3380 operator:
|
|
|
3381 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
3382 type: string
|
|
|
3383 values:
|
|
|
3384 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
3385 type: array
|
|
|
3386 items:
|
|
|
3387 type: string
|
|
|
3388 matchLabels:
|
|
|
3389 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
3390 type: object
|
|
|
3391 additionalProperties:
|
|
|
3392 type: string
|
|
|
3393 x-kubernetes-map-type: atomic
|
|
|
3394 namespaces:
|
|
|
3395 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
3396 type: array
|
|
|
3397 items:
|
|
|
3398 type: string
|
|
|
3399 topologyKey:
|
|
|
3400 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
3401 type: string
|
|
|
3402 podAntiAffinity:
|
|
|
3403 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
|
|
|
3404 type: object
|
|
|
3405 properties:
|
|
|
3406 preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
3407 description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
|
|
|
3408 type: array
|
|
|
3409 items:
|
|
|
3410 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
|
|
|
3411 type: object
|
|
|
3412 required:
|
|
|
3413 - podAffinityTerm
|
|
|
3414 - weight
|
|
|
3415 properties:
|
|
|
3416 podAffinityTerm:
|
|
|
3417 description: Required. A pod affinity term, associated with the corresponding weight.
|
|
|
3418 type: object
|
|
|
3419 required:
|
|
|
3420 - topologyKey
|
|
|
3421 properties:
|
|
|
3422 labelSelector:
|
|
|
3423 description: A label query over a set of resources, in this case pods.
|
|
|
3424 type: object
|
|
|
3425 properties:
|
|
|
3426 matchExpressions:
|
|
|
3427 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
3428 type: array
|
|
|
3429 items:
|
|
|
3430 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3431 type: object
|
|
|
3432 required:
|
|
|
3433 - key
|
|
|
3434 - operator
|
|
|
3435 properties:
|
|
|
3436 key:
|
|
|
3437 description: key is the label key that the selector applies to.
|
|
|
3438 type: string
|
|
|
3439 operator:
|
|
|
3440 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
3441 type: string
|
|
|
3442 values:
|
|
|
3443 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
3444 type: array
|
|
|
3445 items:
|
|
|
3446 type: string
|
|
|
3447 matchLabels:
|
|
|
3448 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
3449 type: object
|
|
|
3450 additionalProperties:
|
|
|
3451 type: string
|
|
|
3452 x-kubernetes-map-type: atomic
|
|
|
3453 namespaceSelector:
|
|
|
3454 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
3455 type: object
|
|
|
3456 properties:
|
|
|
3457 matchExpressions:
|
|
|
3458 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
3459 type: array
|
|
|
3460 items:
|
|
|
3461 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3462 type: object
|
|
|
3463 required:
|
|
|
3464 - key
|
|
|
3465 - operator
|
|
|
3466 properties:
|
|
|
3467 key:
|
|
|
3468 description: key is the label key that the selector applies to.
|
|
|
3469 type: string
|
|
|
3470 operator:
|
|
|
3471 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
3472 type: string
|
|
|
3473 values:
|
|
|
3474 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
3475 type: array
|
|
|
3476 items:
|
|
|
3477 type: string
|
|
|
3478 matchLabels:
|
|
|
3479 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
3480 type: object
|
|
|
3481 additionalProperties:
|
|
|
3482 type: string
|
|
|
3483 x-kubernetes-map-type: atomic
|
|
|
3484 namespaces:
|
|
|
3485 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
3486 type: array
|
|
|
3487 items:
|
|
|
3488 type: string
|
|
|
3489 topologyKey:
|
|
|
3490 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
3491 type: string
|
|
|
3492 weight:
|
|
|
3493 description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
|
|
|
3494 type: integer
|
|
|
3495 format: int32
|
|
|
3496 requiredDuringSchedulingIgnoredDuringExecution:
|
|
|
3497 description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
|
|
|
3498 type: array
|
|
|
3499 items:
|
|
|
3500 description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running
|
|
|
3501 type: object
|
|
|
3502 required:
|
|
|
3503 - topologyKey
|
|
|
3504 properties:
|
|
|
3505 labelSelector:
|
|
|
3506 description: A label query over a set of resources, in this case pods.
|
|
|
3507 type: object
|
|
|
3508 properties:
|
|
|
3509 matchExpressions:
|
|
|
3510 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
3511 type: array
|
|
|
3512 items:
|
|
|
3513 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3514 type: object
|
|
|
3515 required:
|
|
|
3516 - key
|
|
|
3517 - operator
|
|
|
3518 properties:
|
|
|
3519 key:
|
|
|
3520 description: key is the label key that the selector applies to.
|
|
|
3521 type: string
|
|
|
3522 operator:
|
|
|
3523 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
3524 type: string
|
|
|
3525 values:
|
|
|
3526 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
3527 type: array
|
|
|
3528 items:
|
|
|
3529 type: string
|
|
|
3530 matchLabels:
|
|
|
3531 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
3532 type: object
|
|
|
3533 additionalProperties:
|
|
|
3534 type: string
|
|
|
3535 x-kubernetes-map-type: atomic
|
|
|
3536 namespaceSelector:
|
|
|
3537 description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
|
|
|
3538 type: object
|
|
|
3539 properties:
|
|
|
3540 matchExpressions:
|
|
|
3541 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
|
|
3542 type: array
|
|
|
3543 items:
|
|
|
3544 description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
|
|
|
3545 type: object
|
|
|
3546 required:
|
|
|
3547 - key
|
|
|
3548 - operator
|
|
|
3549 properties:
|
|
|
3550 key:
|
|
|
3551 description: key is the label key that the selector applies to.
|
|
|
3552 type: string
|
|
|
3553 operator:
|
|
|
3554 description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
|
3555 type: string
|
|
|
3556 values:
|
|
|
3557 description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
|
|
|
3558 type: array
|
|
|
3559 items:
|
|
|
3560 type: string
|
|
|
3561 matchLabels:
|
|
|
3562 description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
|
|
|
3563 type: object
|
|
|
3564 additionalProperties:
|
|
|
3565 type: string
|
|
|
3566 x-kubernetes-map-type: atomic
|
|
|
3567 namespaces:
|
|
|
3568 description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
|
|
|
3569 type: array
|
|
|
3570 items:
|
|
|
3571 type: string
|
|
|
3572 topologyKey:
|
|
|
3573 description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
|
|
|
3574 type: string
|
|
|
3575 nodeSelector:
|
|
|
3576 description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
|
|
|
3577 type: object
|
|
|
3578 additionalProperties:
|
|
|
3579 type: string
|
|
|
3580 priorityClassName:
|
|
|
3581 description: If specified, the pod's priorityClassName.
|
|
|
3582 type: string
|
|
|
3583 serviceAccountName:
|
|
|
3584 description: If specified, the pod's service account
|
|
|
3585 type: string
|
|
|
3586 tolerations:
|
|
|
3587 description: If specified, the pod's tolerations.
|
|
|
3588 type: array
|
|
|
3589 items:
|
|
|
3590 description: The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.
|
|
|
3591 type: object
|
|
|
3592 properties:
|
|
|
3593 effect:
|
|
|
3594 description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
|
|
|
3595 type: string
|
|
|
3596 key:
|
|
|
3597 description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
|
|
|
3598 type: string
|
|
|
3599 operator:
|
|
|
3600 description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.
|
|
|
3601 type: string
|
|
|
3602 tolerationSeconds:
|
|
|
3603 description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
|
|
|
3604 type: integer
|
|
|
3605 format: int64
|
|
|
3606 value:
|
|
|
3607 description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
|
|
|
3608 type: string
|
|
|
3609 serviceType:
|
|
|
3610 description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort.
|
|
|
3611 type: string
|
|
|
3612 selector:
|
|
|
3613 description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead.
|
|
|
3614 type: object
|
|
|
3615 properties:
|
|
|
3616 dnsNames:
|
|
|
3617 description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected.
|
|
|
3618 type: array
|
|
|
3619 items:
|
|
|
3620 type: string
|
|
|
3621 dnsZones:
|
|
|
3622 description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected.
|
|
|
3623 type: array
|
|
|
3624 items:
|
|
|
3625 type: string
|
|
|
3626 matchLabels:
|
|
|
3627 description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to.
|
|
|
3628 type: object
|
|
|
3629 additionalProperties:
|
|
|
3630 type: string
|
|
|
3631 ca:
|
|
|
3632 description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager.
|
|
|
3633 type: object
|
|
|
3634 required:
|
|
|
3635 - secretName
|
|
|
3636 properties:
|
|
|
3637 crlDistributionPoints:
|
|
|
3638 description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set.
|
|
|
3639 type: array
|
|
|
3640 items:
|
|
|
3641 type: string
|
|
|
3642 ocspServers:
|
|
|
3643 description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
|
|
|
3644 type: array
|
|
|
3645 items:
|
|
|
3646 type: string
|
|
|
3647 secretName:
|
|
|
3648 description: SecretName is the name of the secret used to sign Certificates issued by this Issuer.
|
|
|
3649 type: string
|
|
|
3650 selfSigned:
|
|
|
3651 description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object.
|
|
|
3652 type: object
|
|
|
3653 properties:
|
|
|
3654 crlDistributionPoints:
|
|
|
3655 description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings.
|
|
|
3656 type: array
|
|
|
3657 items:
|
|
|
3658 type: string
|
|
|
3659 vault:
|
|
|
3660 description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend.
|
|
|
3661 type: object
|
|
|
3662 required:
|
|
|
3663 - auth
|
|
|
3664 - path
|
|
|
3665 - server
|
|
|
3666 properties:
|
|
|
3667 auth:
|
|
|
3668 description: Auth configures how cert-manager authenticates with the Vault server.
|
|
|
3669 type: object
|
|
|
3670 properties:
|
|
|
3671 appRole:
|
|
|
3672 description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource.
|
|
|
3673 type: object
|
|
|
3674 required:
|
|
|
3675 - path
|
|
|
3676 - roleId
|
|
|
3677 - secretRef
|
|
|
3678 properties:
|
|
|
3679 path:
|
|
|
3680 description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"'
|
|
|
3681 type: string
|
|
|
3682 roleId:
|
|
|
3683 description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault.
|
|
|
3684 type: string
|
|
|
3685 secretRef:
|
|
|
3686 description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret.
|
|
|
3687 type: object
|
|
|
3688 required:
|
|
|
3689 - name
|
|
|
3690 properties:
|
|
|
3691 key:
|
|
|
3692 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
3693 type: string
|
|
|
3694 name:
|
|
|
3695 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
3696 type: string
|
|
|
3697 kubernetes:
|
|
|
3698 description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server.
|
|
|
3699 type: object
|
|
|
3700 required:
|
|
|
3701 - role
|
|
|
3702 - secretRef
|
|
|
3703 properties:
|
|
|
3704 mountPath:
|
|
|
3705 description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used.
|
|
|
3706 type: string
|
|
|
3707 role:
|
|
|
3708 description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies.
|
|
|
3709 type: string
|
|
|
3710 secretRef:
|
|
|
3711 description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported.
|
|
|
3712 type: object
|
|
|
3713 required:
|
|
|
3714 - name
|
|
|
3715 properties:
|
|
|
3716 key:
|
|
|
3717 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
3718 type: string
|
|
|
3719 name:
|
|
|
3720 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
3721 type: string
|
|
|
3722 tokenSecretRef:
|
|
|
3723 description: TokenSecretRef authenticates with Vault by presenting a token.
|
|
|
3724 type: object
|
|
|
3725 required:
|
|
|
3726 - name
|
|
|
3727 properties:
|
|
|
3728 key:
|
|
|
3729 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
3730 type: string
|
|
|
3731 name:
|
|
|
3732 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
3733 type: string
|
|
|
3734 caBundle:
|
|
|
3735 description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the cert-manager controller system root certificates are used to validate the TLS connection.
|
|
|
3736 type: string
|
|
|
3737 format: byte
|
|
|
3738 caBundleSecretRef:
|
|
|
3739 description: CABundleSecretRef is a reference to a Secret which contains the CABundle which will be used when connecting to Vault when using HTTPS. Mutually exclusive with CABundle. If neither CABundleSecretRef nor CABundle are defined, the cert-manager controller system root certificates are used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
|
|
|
3740 type: object
|
|
|
3741 required:
|
|
|
3742 - name
|
|
|
3743 properties:
|
|
|
3744 key:
|
|
|
3745 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
3746 type: string
|
|
|
3747 name:
|
|
|
3748 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
3749 type: string
|
|
|
3750 namespace:
|
|
|
3751 description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces'
|
|
|
3752 type: string
|
|
|
3753 path:
|
|
|
3754 description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".'
|
|
|
3755 type: string
|
|
|
3756 server:
|
|
|
3757 description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
|
|
|
3758 type: string
|
|
|
3759 venafi:
|
|
|
3760 description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone.
|
|
|
3761 type: object
|
|
|
3762 required:
|
|
|
3763 - zone
|
|
|
3764 properties:
|
|
|
3765 cloud:
|
|
|
3766 description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified.
|
|
|
3767 type: object
|
|
|
3768 required:
|
|
|
3769 - apiTokenSecretRef
|
|
|
3770 properties:
|
|
|
3771 apiTokenSecretRef:
|
|
|
3772 description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
|
|
|
3773 type: object
|
|
|
3774 required:
|
|
|
3775 - name
|
|
|
3776 properties:
|
|
|
3777 key:
|
|
|
3778 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
3779 type: string
|
|
|
3780 name:
|
|
|
3781 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
3782 type: string
|
|
|
3783 url:
|
|
|
3784 description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1".
|
|
|
3785 type: string
|
|
|
3786 tpp:
|
|
|
3787 description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified.
|
|
|
3788 type: object
|
|
|
3789 required:
|
|
|
3790 - credentialsRef
|
|
|
3791 - url
|
|
|
3792 properties:
|
|
|
3793 caBundle:
|
|
|
3794 description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates.
|
|
|
3795 type: string
|
|
|
3796 format: byte
|
|
|
3797 credentialsRef:
|
|
|
3798 description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'.
|
|
|
3799 type: object
|
|
|
3800 required:
|
|
|
3801 - name
|
|
|
3802 properties:
|
|
|
3803 name:
|
|
|
3804 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
3805 type: string
|
|
|
3806 url:
|
|
|
3807 description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".'
|
|
|
3808 type: string
|
|
|
3809 zone:
|
|
|
3810 description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required.
|
|
|
3811 type: string
|
|
|
3812 status:
|
|
|
3813 description: Status of the Issuer. This is set and managed automatically.
|
|
|
3814 type: object
|
|
|
3815 properties:
|
|
|
3816 acme:
|
|
|
3817 description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates.
|
|
|
3818 type: object
|
|
|
3819 properties:
|
|
|
3820 lastRegisteredEmail:
|
|
|
3821 description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer
|
|
|
3822 type: string
|
|
|
3823 uri:
|
|
|
3824 description: URI is the unique account identifier, which can also be used to retrieve account details from the CA
|
|
|
3825 type: string
|
|
|
3826 conditions:
|
|
|
3827 description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`.
|
|
|
3828 type: array
|
|
|
3829 items:
|
|
|
3830 description: IssuerCondition contains condition information for an Issuer.
|
|
|
3831 type: object
|
|
|
3832 required:
|
|
|
3833 - status
|
|
|
3834 - type
|
|
|
3835 properties:
|
|
|
3836 lastTransitionTime:
|
|
|
3837 description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
|
|
|
3838 type: string
|
|
|
3839 format: date-time
|
|
|
3840 message:
|
|
|
3841 description: Message is a human readable description of the details of the last transition, complementing reason.
|
|
|
3842 type: string
|
|
|
3843 observedGeneration:
|
|
|
3844 description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer.
|
|
|
3845 type: integer
|
|
|
3846 format: int64
|
|
|
3847 reason:
|
|
|
3848 description: Reason is a brief machine readable explanation for the condition's last transition.
|
|
|
3849 type: string
|
|
|
3850 status:
|
|
|
3851 description: Status of the condition, one of (`True`, `False`, `Unknown`).
|
|
|
3852 type: string
|
|
|
3853 enum:
|
|
|
3854 - "True"
|
|
|
3855 - "False"
|
|
|
3856 - Unknown
|
|
|
3857 type:
|
|
|
3858 description: Type of the condition, known values are (`Ready`).
|
|
|
3859 type: string
|
|
|
3860 x-kubernetes-list-map-keys:
|
|
|
3861 - type
|
|
|
3862 x-kubernetes-list-type: map
|
|
|
3863 served: true
|
|
|
3864 storage: true
|
|
|
3865 ---
|
|
|
3866 # Source: cert-manager/templates/crds.yaml
|
|
|
3867 apiVersion: apiextensions.k8s.io/v1
|
|
|
3868 kind: CustomResourceDefinition
|
|
|
3869 metadata:
|
|
|
3870 name: certificates.cert-manager.io
|
|
|
3871 labels:
|
|
|
3872 app: 'cert-manager'
|
|
|
3873 app.kubernetes.io/name: 'cert-manager'
|
|
|
3874 app.kubernetes.io/instance: 'cert-manager'
|
|
|
3875 # Generated labels
|
|
|
3876 app.kubernetes.io/version: "v1.10.1"
|
|
|
3877 spec:
|
|
|
3878 group: cert-manager.io
|
|
|
3879 names:
|
|
|
3880 kind: Certificate
|
|
|
3881 listKind: CertificateList
|
|
|
3882 plural: certificates
|
|
|
3883 shortNames:
|
|
|
3884 - cert
|
|
|
3885 - certs
|
|
|
3886 singular: certificate
|
|
|
3887 categories:
|
|
|
3888 - cert-manager
|
|
|
3889 scope: Namespaced
|
|
|
3890 versions:
|
|
|
3891 - name: v1
|
|
|
3892 subresources:
|
|
|
3893 status: {}
|
|
|
3894 additionalPrinterColumns:
|
|
|
3895 - jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
3896 name: Ready
|
|
|
3897 type: string
|
|
|
3898 - jsonPath: .spec.secretName
|
|
|
3899 name: Secret
|
|
|
3900 type: string
|
|
|
3901 - jsonPath: .spec.issuerRef.name
|
|
|
3902 name: Issuer
|
|
|
3903 priority: 1
|
|
|
3904 type: string
|
|
|
3905 - jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
3906 name: Status
|
|
|
3907 priority: 1
|
|
|
3908 type: string
|
|
|
3909 - jsonPath: .metadata.creationTimestamp
|
|
|
3910 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
|
|
|
3911 name: Age
|
|
|
3912 type: date
|
|
|
3913 schema:
|
|
|
3914 openAPIV3Schema:
|
|
|
3915 description: "A Certificate resource should be created to ensure an up to date and signed x509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. \n The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`)."
|
|
|
3916 type: object
|
|
|
3917 required:
|
|
|
3918 - spec
|
|
|
3919 properties:
|
|
|
3920 apiVersion:
|
|
|
3921 description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
3922 type: string
|
|
|
3923 kind:
|
|
|
3924 description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
3925 type: string
|
|
|
3926 metadata:
|
|
|
3927 type: object
|
|
|
3928 spec:
|
|
|
3929 description: Desired state of the Certificate resource.
|
|
|
3930 type: object
|
|
|
3931 required:
|
|
|
3932 - issuerRef
|
|
|
3933 - secretName
|
|
|
3934 properties:
|
|
|
3935 additionalOutputFormats:
|
|
|
3936 description: AdditionalOutputFormats defines extra output formats of the private key and signed certificate chain to be written to this Certificate's target Secret. This is an Alpha Feature and is only enabled with the `--feature-gates=AdditionalCertificateOutputFormats=true` option on both the controller and webhook components.
|
|
|
3937 type: array
|
|
|
3938 items:
|
|
|
3939 description: CertificateAdditionalOutputFormat defines an additional output format of a Certificate resource. These contain supplementary data formats of the signed certificate chain and paired private key.
|
|
|
3940 type: object
|
|
|
3941 required:
|
|
|
3942 - type
|
|
|
3943 properties:
|
|
|
3944 type:
|
|
|
3945 description: Type is the name of the format type that should be written to the Certificate's target Secret.
|
|
|
3946 type: string
|
|
|
3947 enum:
|
|
|
3948 - DER
|
|
|
3949 - CombinedPEM
|
|
|
3950 commonName:
|
|
|
3951 description: 'CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs. This value is ignored by TLS clients when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4'
|
|
|
3952 type: string
|
|
|
3953 dnsNames:
|
|
|
3954 description: DNSNames is a list of DNS subjectAltNames to be set on the Certificate.
|
|
|
3955 type: array
|
|
|
3956 items:
|
|
|
3957 type: string
|
|
|
3958 duration:
|
|
|
3959 description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. If unset this defaults to 90 days. Certificate will be renewed either 2/3 through its duration or `renewBefore` period before its expiry, whichever is later. Minimum accepted duration is 1 hour. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration
|
|
|
3960 type: string
|
|
|
3961 emailAddresses:
|
|
|
3962 description: EmailAddresses is a list of email subjectAltNames to be set on the Certificate.
|
|
|
3963 type: array
|
|
|
3964 items:
|
|
|
3965 type: string
|
|
|
3966 encodeUsagesInRequest:
|
|
|
3967 description: EncodeUsagesInRequest controls whether key usages should be present in the CertificateRequest
|
|
|
3968 type: boolean
|
|
|
3969 ipAddresses:
|
|
|
3970 description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate.
|
|
|
3971 type: array
|
|
|
3972 items:
|
|
|
3973 type: string
|
|
|
3974 isCA:
|
|
|
3975 description: IsCA will mark this Certificate as valid for certificate signing. This will automatically add the `cert sign` usage to the list of `usages`.
|
|
|
3976 type: boolean
|
|
|
3977 issuerRef:
|
|
|
3978 description: IssuerRef is a reference to the issuer for this certificate. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the Certificate will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times.
|
|
|
3979 type: object
|
|
|
3980 required:
|
|
|
3981 - name
|
|
|
3982 properties:
|
|
|
3983 group:
|
|
|
3984 description: Group of the resource being referred to.
|
|
|
3985 type: string
|
|
|
3986 kind:
|
|
|
3987 description: Kind of the resource being referred to.
|
|
|
3988 type: string
|
|
|
3989 name:
|
|
|
3990 description: Name of the resource being referred to.
|
|
|
3991 type: string
|
|
|
3992 keystores:
|
|
|
3993 description: Keystores configures additional keystore output formats stored in the `secretName` Secret resource.
|
|
|
3994 type: object
|
|
|
3995 properties:
|
|
|
3996 jks:
|
|
|
3997 description: JKS configures options for storing a JKS keystore in the `spec.secretName` Secret resource.
|
|
|
3998 type: object
|
|
|
3999 required:
|
|
|
4000 - create
|
|
|
4001 - passwordSecretRef
|
|
|
4002 properties:
|
|
|
4003 create:
|
|
|
4004 description: Create enables JKS keystore creation for the Certificate. If true, a file named `keystore.jks` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. A file named `truststore.jks` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority
|
|
|
4005 type: boolean
|
|
|
4006 passwordSecretRef:
|
|
|
4007 description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore.
|
|
|
4008 type: object
|
|
|
4009 required:
|
|
|
4010 - name
|
|
|
4011 properties:
|
|
|
4012 key:
|
|
|
4013 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
4014 type: string
|
|
|
4015 name:
|
|
|
4016 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
4017 type: string
|
|
|
4018 pkcs12:
|
|
|
4019 description: PKCS12 configures options for storing a PKCS12 keystore in the `spec.secretName` Secret resource.
|
|
|
4020 type: object
|
|
|
4021 required:
|
|
|
4022 - create
|
|
|
4023 - passwordSecretRef
|
|
|
4024 properties:
|
|
|
4025 create:
|
|
|
4026 description: Create enables PKCS12 keystore creation for the Certificate. If true, a file named `keystore.p12` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. A file named `truststore.p12` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority
|
|
|
4027 type: boolean
|
|
|
4028 passwordSecretRef:
|
|
|
4029 description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore.
|
|
|
4030 type: object
|
|
|
4031 required:
|
|
|
4032 - name
|
|
|
4033 properties:
|
|
|
4034 key:
|
|
|
4035 description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
|
|
|
4036 type: string
|
|
|
4037 name:
|
|
|
4038 description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
4039 type: string
|
|
|
4040 literalSubject:
|
|
|
4041 description: LiteralSubject is an LDAP formatted string that represents the [X.509 Subject field](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6). Use this *instead* of the Subject field if you need to ensure the correct ordering of the RDN sequence, such as when issuing certs for LDAP authentication. See https://github.com/cert-manager/cert-manager/issues/3203, https://github.com/cert-manager/cert-manager/issues/4424. This field is alpha level and is only supported by cert-manager installations where LiteralCertificateSubject feature gate is enabled on both cert-manager controller and webhook.
|
|
|
4042 type: string
|
|
|
4043 privateKey:
|
|
|
4044 description: Options to control private keys used for the Certificate.
|
|
|
4045 type: object
|
|
|
4046 properties:
|
|
|
4047 algorithm:
|
|
|
4048 description: Algorithm is the private key algorithm of the corresponding private key for this certificate. If provided, allowed values are either `RSA`,`Ed25519` or `ECDSA` If `algorithm` is specified and `size` is not provided, key size of 256 will be used for `ECDSA` key algorithm and key size of 2048 will be used for `RSA` key algorithm. key size is ignored when using the `Ed25519` key algorithm.
|
|
|
4049 type: string
|
|
|
4050 enum:
|
|
|
4051 - RSA
|
|
|
4052 - ECDSA
|
|
|
4053 - Ed25519
|
|
|
4054 encoding:
|
|
|
4055 description: The private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 and PKCS#8, respectively. Defaults to `PKCS1` if not specified.
|
|
|
4056 type: string
|
|
|
4057 enum:
|
|
|
4058 - PKCS1
|
|
|
4059 - PKCS8
|
|
|
4060 rotationPolicy:
|
|
|
4061 description: RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. If set to Never, a private key will only be generated if one does not already exist in the target `spec.secretName`. If one does exists but it does not have the correct algorithm or size, a warning will be raised to await user intervention. If set to Always, a private key matching the specified requirements will be generated whenever a re-issuance occurs. Default is 'Never' for backward compatibility.
|
|
|
4062 type: string
|
|
|
4063 enum:
|
|
|
4064 - Never
|
|
|
4065 - Always
|
|
|
4066 size:
|
|
|
4067 description: Size is the key bit size of the corresponding private key for this certificate. If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified. If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, and will default to `256` if not specified. If `algorithm` is set to `Ed25519`, Size is ignored. No other values are allowed.
|
|
|
4068 type: integer
|
|
|
4069 renewBefore:
|
|
|
4070 description: How long before the currently issued certificate's expiry cert-manager should renew the certificate. The default is 2/3 of the issued certificate's duration. Minimum accepted value is 5 minutes. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration
|
|
|
4071 type: string
|
|
|
4072 revisionHistoryLimit:
|
|
|
4073 description: revisionHistoryLimit is the maximum number of CertificateRequest revisions that are maintained in the Certificate's history. Each revision represents a single `CertificateRequest` created by this Certificate, either when it was created, renewed, or Spec was changed. Revisions will be removed by oldest first if the number of revisions exceeds this number. If set, revisionHistoryLimit must be a value of `1` or greater. If unset (`nil`), revisions will not be garbage collected. Default value is `nil`.
|
|
|
4074 type: integer
|
|
|
4075 format: int32
|
|
|
4076 secretName:
|
|
|
4077 description: SecretName is the name of the secret resource that will be automatically created and managed by this Certificate resource. It will be populated with a private key and certificate, signed by the denoted issuer.
|
|
|
4078 type: string
|
|
|
4079 secretTemplate:
|
|
|
4080 description: SecretTemplate defines annotations and labels to be copied to the Certificate's Secret. Labels and annotations on the Secret will be changed as they appear on the SecretTemplate when added or removed. SecretTemplate annotations are added in conjunction with, and cannot overwrite, the base set of annotations cert-manager sets on the Certificate's Secret.
|
|
|
4081 type: object
|
|
|
4082 properties:
|
|
|
4083 annotations:
|
|
|
4084 description: Annotations is a key value map to be copied to the target Kubernetes Secret.
|
|
|
4085 type: object
|
|
|
4086 additionalProperties:
|
|
|
4087 type: string
|
|
|
4088 labels:
|
|
|
4089 description: Labels is a key value map to be copied to the target Kubernetes Secret.
|
|
|
4090 type: object
|
|
|
4091 additionalProperties:
|
|
|
4092 type: string
|
|
|
4093 subject:
|
|
|
4094 description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
|
|
|
4095 type: object
|
|
|
4096 properties:
|
|
|
4097 countries:
|
|
|
4098 description: Countries to be used on the Certificate.
|
|
|
4099 type: array
|
|
|
4100 items:
|
|
|
4101 type: string
|
|
|
4102 localities:
|
|
|
4103 description: Cities to be used on the Certificate.
|
|
|
4104 type: array
|
|
|
4105 items:
|
|
|
4106 type: string
|
|
|
4107 organizationalUnits:
|
|
|
4108 description: Organizational Units to be used on the Certificate.
|
|
|
4109 type: array
|
|
|
4110 items:
|
|
|
4111 type: string
|
|
|
4112 organizations:
|
|
|
4113 description: Organizations to be used on the Certificate.
|
|
|
4114 type: array
|
|
|
4115 items:
|
|
|
4116 type: string
|
|
|
4117 postalCodes:
|
|
|
4118 description: Postal codes to be used on the Certificate.
|
|
|
4119 type: array
|
|
|
4120 items:
|
|
|
4121 type: string
|
|
|
4122 provinces:
|
|
|
4123 description: State/Provinces to be used on the Certificate.
|
|
|
4124 type: array
|
|
|
4125 items:
|
|
|
4126 type: string
|
|
|
4127 serialNumber:
|
|
|
4128 description: Serial number to be used on the Certificate.
|
|
|
4129 type: string
|
|
|
4130 streetAddresses:
|
|
|
4131 description: Street addresses to be used on the Certificate.
|
|
|
4132 type: array
|
|
|
4133 items:
|
|
|
4134 type: string
|
|
|
4135 uris:
|
|
|
4136 description: URIs is a list of URI subjectAltNames to be set on the Certificate.
|
|
|
4137 type: array
|
|
|
4138 items:
|
|
|
4139 type: string
|
|
|
4140 usages:
|
|
|
4141 description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified.
|
|
|
4142 type: array
|
|
|
4143 items:
|
|
|
4144 description: "KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 \n Valid KeyUsage values are as follows: \"signing\", \"digital signature\", \"content commitment\", \"key encipherment\", \"key agreement\", \"data encipherment\", \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\", \"server auth\", \"client auth\", \"code signing\", \"email protection\", \"s/mime\", \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\", \"timestamping\", \"ocsp signing\", \"microsoft sgc\", \"netscape sgc\""
|
|
|
4145 type: string
|
|
|
4146 enum:
|
|
|
4147 - signing
|
|
|
4148 - digital signature
|
|
|
4149 - content commitment
|
|
|
4150 - key encipherment
|
|
|
4151 - key agreement
|
|
|
4152 - data encipherment
|
|
|
4153 - cert sign
|
|
|
4154 - crl sign
|
|
|
4155 - encipher only
|
|
|
4156 - decipher only
|
|
|
4157 - any
|
|
|
4158 - server auth
|
|
|
4159 - client auth
|
|
|
4160 - code signing
|
|
|
4161 - email protection
|
|
|
4162 - s/mime
|
|
|
4163 - ipsec end system
|
|
|
4164 - ipsec tunnel
|
|
|
4165 - ipsec user
|
|
|
4166 - timestamping
|
|
|
4167 - ocsp signing
|
|
|
4168 - microsoft sgc
|
|
|
4169 - netscape sgc
|
|
|
4170 status:
|
|
|
4171 description: Status of the Certificate. This is set and managed automatically.
|
|
|
4172 type: object
|
|
|
4173 properties:
|
|
|
4174 conditions:
|
|
|
4175 description: List of status conditions to indicate the status of certificates. Known condition types are `Ready` and `Issuing`.
|
|
|
4176 type: array
|
|
|
4177 items:
|
|
|
4178 description: CertificateCondition contains condition information for an Certificate.
|
|
|
4179 type: object
|
|
|
4180 required:
|
|
|
4181 - status
|
|
|
4182 - type
|
|
|
4183 properties:
|
|
|
4184 lastTransitionTime:
|
|
|
4185 description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
|
|
|
4186 type: string
|
|
|
4187 format: date-time
|
|
|
4188 message:
|
|
|
4189 description: Message is a human readable description of the details of the last transition, complementing reason.
|
|
|
4190 type: string
|
|
|
4191 observedGeneration:
|
|
|
4192 description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Certificate.
|
|
|
4193 type: integer
|
|
|
4194 format: int64
|
|
|
4195 reason:
|
|
|
4196 description: Reason is a brief machine readable explanation for the condition's last transition.
|
|
|
4197 type: string
|
|
|
4198 status:
|
|
|
4199 description: Status of the condition, one of (`True`, `False`, `Unknown`).
|
|
|
4200 type: string
|
|
|
4201 enum:
|
|
|
4202 - "True"
|
|
|
4203 - "False"
|
|
|
4204 - Unknown
|
|
|
4205 type:
|
|
|
4206 description: Type of the condition, known values are (`Ready`, `Issuing`).
|
|
|
4207 type: string
|
|
|
4208 x-kubernetes-list-map-keys:
|
|
|
4209 - type
|
|
|
4210 x-kubernetes-list-type: map
|
|
|
4211 failedIssuanceAttempts:
|
|
|
4212 description: The number of continuous failed issuance attempts up till now. This field gets removed (if set) on a successful issuance and gets set to 1 if unset and an issuance has failed. If an issuance has failed, the delay till the next issuance will be calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - 1).
|
|
|
4213 type: integer
|
|
|
4214 lastFailureTime:
|
|
|
4215 description: LastFailureTime is the time as recorded by the Certificate controller of the most recent failure to complete a CertificateRequest for this Certificate resource. If set, cert-manager will not re-request another Certificate until 1 hour has elapsed from this time.
|
|
|
4216 type: string
|
|
|
4217 format: date-time
|
|
|
4218 nextPrivateKeySecretName:
|
|
|
4219 description: The name of the Secret resource containing the private key to be used for the next certificate iteration. The keymanager controller will automatically set this field if the `Issuing` condition is set to `True`. It will automatically unset this field when the Issuing condition is not set or False.
|
|
|
4220 type: string
|
|
|
4221 notAfter:
|
|
|
4222 description: The expiration time of the certificate stored in the secret named by this resource in `spec.secretName`.
|
|
|
4223 type: string
|
|
|
4224 format: date-time
|
|
|
4225 notBefore:
|
|
|
4226 description: The time after which the certificate stored in the secret named by this resource in spec.secretName is valid.
|
|
|
4227 type: string
|
|
|
4228 format: date-time
|
|
|
4229 renewalTime:
|
|
|
4230 description: RenewalTime is the time at which the certificate will be next renewed. If not set, no upcoming renewal is scheduled.
|
|
|
4231 type: string
|
|
|
4232 format: date-time
|
|
|
4233 revision:
|
|
|
4234 description: "The current 'revision' of the certificate as issued. \n When a CertificateRequest resource is created, it will have the `cert-manager.io/certificate-revision` set to one greater than the current value of this field. \n Upon issuance, this field will be set to the value of the annotation on the CertificateRequest resource used to issue the certificate. \n Persisting the value on the CertificateRequest resource allows the certificates controller to know whether a request is part of an old issuance or if it is part of the ongoing revision's issuance by checking if the revision value in the annotation is greater than this field."
|
|
|
4235 type: integer
|
|
|
4236 served: true
|
|
|
4237 storage: true
|
|
|
4238 ---
|
|
|
4239 # Source: cert-manager/templates/crds.yaml
|
|
|
4240 apiVersion: apiextensions.k8s.io/v1
|
|
|
4241 kind: CustomResourceDefinition
|
|
|
4242 metadata:
|
|
|
4243 name: orders.acme.cert-manager.io
|
|
|
4244 labels:
|
|
|
4245 app: 'cert-manager'
|
|
|
4246 app.kubernetes.io/name: 'cert-manager'
|
|
|
4247 app.kubernetes.io/instance: 'cert-manager'
|
|
|
4248 # Generated labels
|
|
|
4249 app.kubernetes.io/version: "v1.10.1"
|
|
|
4250 spec:
|
|
|
4251 group: acme.cert-manager.io
|
|
|
4252 names:
|
|
|
4253 kind: Order
|
|
|
4254 listKind: OrderList
|
|
|
4255 plural: orders
|
|
|
4256 singular: order
|
|
|
4257 categories:
|
|
|
4258 - cert-manager
|
|
|
4259 - cert-manager-acme
|
|
|
4260 scope: Namespaced
|
|
|
4261 versions:
|
|
|
4262 - name: v1
|
|
|
4263 subresources:
|
|
|
4264 status: {}
|
|
|
4265 additionalPrinterColumns:
|
|
|
4266 - jsonPath: .status.state
|
|
|
4267 name: State
|
|
|
4268 type: string
|
|
|
4269 - jsonPath: .spec.issuerRef.name
|
|
|
4270 name: Issuer
|
|
|
4271 priority: 1
|
|
|
4272 type: string
|
|
|
4273 - jsonPath: .status.reason
|
|
|
4274 name: Reason
|
|
|
4275 priority: 1
|
|
|
4276 type: string
|
|
|
4277 - jsonPath: .metadata.creationTimestamp
|
|
|
4278 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
|
|
|
4279 name: Age
|
|
|
4280 type: date
|
|
|
4281 schema:
|
|
|
4282 openAPIV3Schema:
|
|
|
4283 description: Order is a type to represent an Order with an ACME server
|
|
|
4284 type: object
|
|
|
4285 required:
|
|
|
4286 - metadata
|
|
|
4287 - spec
|
|
|
4288 properties:
|
|
|
4289 apiVersion:
|
|
|
4290 description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
4291 type: string
|
|
|
4292 kind:
|
|
|
4293 description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
4294 type: string
|
|
|
4295 metadata:
|
|
|
4296 type: object
|
|
|
4297 spec:
|
|
|
4298 type: object
|
|
|
4299 required:
|
|
|
4300 - issuerRef
|
|
|
4301 - request
|
|
|
4302 properties:
|
|
|
4303 commonName:
|
|
|
4304 description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR.
|
|
|
4305 type: string
|
|
|
4306 dnsNames:
|
|
|
4307 description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
|
|
|
4308 type: array
|
|
|
4309 items:
|
|
|
4310 type: string
|
|
|
4311 duration:
|
|
|
4312 description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec.
|
|
|
4313 type: string
|
|
|
4314 ipAddresses:
|
|
|
4315 description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
|
|
|
4316 type: array
|
|
|
4317 items:
|
|
|
4318 type: string
|
|
|
4319 issuerRef:
|
|
|
4320 description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed.
|
|
|
4321 type: object
|
|
|
4322 required:
|
|
|
4323 - name
|
|
|
4324 properties:
|
|
|
4325 group:
|
|
|
4326 description: Group of the resource being referred to.
|
|
|
4327 type: string
|
|
|
4328 kind:
|
|
|
4329 description: Kind of the resource being referred to.
|
|
|
4330 type: string
|
|
|
4331 name:
|
|
|
4332 description: Name of the resource being referred to.
|
|
|
4333 type: string
|
|
|
4334 request:
|
|
|
4335 description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order.
|
|
|
4336 type: string
|
|
|
4337 format: byte
|
|
|
4338 status:
|
|
|
4339 type: object
|
|
|
4340 properties:
|
|
|
4341 authorizations:
|
|
|
4342 description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order.
|
|
|
4343 type: array
|
|
|
4344 items:
|
|
|
4345 description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.
|
|
|
4346 type: object
|
|
|
4347 required:
|
|
|
4348 - url
|
|
|
4349 properties:
|
|
|
4350 challenges:
|
|
|
4351 description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process.
|
|
|
4352 type: array
|
|
|
4353 items:
|
|
|
4354 description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process.
|
|
|
4355 type: object
|
|
|
4356 required:
|
|
|
4357 - token
|
|
|
4358 - type
|
|
|
4359 - url
|
|
|
4360 properties:
|
|
|
4361 token:
|
|
|
4362 description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented.
|
|
|
4363 type: string
|
|
|
4364 type:
|
|
|
4365 description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored.
|
|
|
4366 type: string
|
|
|
4367 url:
|
|
|
4368 description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server.
|
|
|
4369 type: string
|
|
|
4370 identifier:
|
|
|
4371 description: Identifier is the DNS name to be validated as part of this authorization
|
|
|
4372 type: string
|
|
|
4373 initialState:
|
|
|
4374 description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created.
|
|
|
4375 type: string
|
|
|
4376 enum:
|
|
|
4377 - valid
|
|
|
4378 - ready
|
|
|
4379 - pending
|
|
|
4380 - processing
|
|
|
4381 - invalid
|
|
|
4382 - expired
|
|
|
4383 - errored
|
|
|
4384 url:
|
|
|
4385 description: URL is the URL of the Authorization that must be completed
|
|
|
4386 type: string
|
|
|
4387 wildcard:
|
|
|
4388 description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'.
|
|
|
4389 type: boolean
|
|
|
4390 certificate:
|
|
|
4391 description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state.
|
|
|
4392 type: string
|
|
|
4393 format: byte
|
|
|
4394 failureTime:
|
|
|
4395 description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off.
|
|
|
4396 type: string
|
|
|
4397 format: date-time
|
|
|
4398 finalizeURL:
|
|
|
4399 description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed.
|
|
|
4400 type: string
|
|
|
4401 reason:
|
|
|
4402 description: Reason optionally provides more information about a why the order is in the current state.
|
|
|
4403 type: string
|
|
|
4404 state:
|
|
|
4405 description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final'
|
|
|
4406 type: string
|
|
|
4407 enum:
|
|
|
4408 - valid
|
|
|
4409 - ready
|
|
|
4410 - pending
|
|
|
4411 - processing
|
|
|
4412 - invalid
|
|
|
4413 - expired
|
|
|
4414 - errored
|
|
|
4415 url:
|
|
|
4416 description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set.
|
|
|
4417 type: string
|
|
|
4418 served: true
|
|
|
4419 storage: true
|
|
|
4420 ---
|
|
|
4421 # Source: cert-manager/templates/cainjector-serviceaccount.yaml
|
|
|
4422 apiVersion: v1
|
|
|
4423 kind: ServiceAccount
|
|
|
4424 automountServiceAccountToken: true
|
|
|
4425 metadata:
|
|
|
4426 name: cert-manager-cainjector
|
|
|
4427 namespace: cert-manager
|
|
|
4428 labels:
|
|
|
4429 app: cainjector
|
|
|
4430 app.kubernetes.io/name: cainjector
|
|
|
4431 app.kubernetes.io/instance: cert-manager
|
|
|
4432 app.kubernetes.io/component: "cainjector"
|
|
|
4433 app.kubernetes.io/version: "v1.10.1"
|
|
|
4434 ---
|
|
|
4435 # Source: cert-manager/templates/serviceaccount.yaml
|
|
|
4436 apiVersion: v1
|
|
|
4437 kind: ServiceAccount
|
|
|
4438 automountServiceAccountToken: true
|
|
|
4439 metadata:
|
|
|
4440 name: cert-manager
|
|
|
4441 namespace: cert-manager
|
|
|
4442 labels:
|
|
|
4443 app: cert-manager
|
|
|
4444 app.kubernetes.io/name: cert-manager
|
|
|
4445 app.kubernetes.io/instance: cert-manager
|
|
|
4446 app.kubernetes.io/component: "controller"
|
|
|
4447 app.kubernetes.io/version: "v1.10.1"
|
|
|
4448 ---
|
|
|
4449 # Source: cert-manager/templates/webhook-serviceaccount.yaml
|
|
|
4450 apiVersion: v1
|
|
|
4451 kind: ServiceAccount
|
|
|
4452 automountServiceAccountToken: true
|
|
|
4453 metadata:
|
|
|
4454 name: cert-manager-webhook
|
|
|
4455 namespace: cert-manager
|
|
|
4456 labels:
|
|
|
4457 app: webhook
|
|
|
4458 app.kubernetes.io/name: webhook
|
|
|
4459 app.kubernetes.io/instance: cert-manager
|
|
|
4460 app.kubernetes.io/component: "webhook"
|
|
|
4461 app.kubernetes.io/version: "v1.10.1"
|
|
|
4462 ---
|
|
|
4463 # Source: cert-manager/templates/webhook-config.yaml
|
|
|
4464 apiVersion: v1
|
|
|
4465 kind: ConfigMap
|
|
|
4466 metadata:
|
|
|
4467 name: cert-manager-webhook
|
|
|
4468 namespace: cert-manager
|
|
|
4469 labels:
|
|
|
4470 app: webhook
|
|
|
4471 app.kubernetes.io/name: webhook
|
|
|
4472 app.kubernetes.io/instance: cert-manager
|
|
|
4473 app.kubernetes.io/component: "webhook"
|
|
|
4474 data:
|
|
|
4475 ---
|
|
|
4476 # Source: cert-manager/templates/cainjector-rbac.yaml
|
|
|
4477 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4478 kind: ClusterRole
|
|
|
4479 metadata:
|
|
|
4480 name: cert-manager-cainjector
|
|
|
4481 labels:
|
|
|
4482 app: cainjector
|
|
|
4483 app.kubernetes.io/name: cainjector
|
|
|
4484 app.kubernetes.io/instance: cert-manager
|
|
|
4485 app.kubernetes.io/component: "cainjector"
|
|
|
4486 app.kubernetes.io/version: "v1.10.1"
|
|
|
4487 rules:
|
|
|
4488 - apiGroups: ["cert-manager.io"]
|
|
|
4489 resources: ["certificates"]
|
|
|
4490 verbs: ["get", "list", "watch"]
|
|
|
4491 - apiGroups: [""]
|
|
|
4492 resources: ["secrets"]
|
|
|
4493 verbs: ["get", "list", "watch"]
|
|
|
4494 - apiGroups: [""]
|
|
|
4495 resources: ["events"]
|
|
|
4496 verbs: ["get", "create", "update", "patch"]
|
|
|
4497 - apiGroups: ["admissionregistration.k8s.io"]
|
|
|
4498 resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
|
|
|
4499 verbs: ["get", "list", "watch", "update"]
|
|
|
4500 - apiGroups: ["apiregistration.k8s.io"]
|
|
|
4501 resources: ["apiservices"]
|
|
|
4502 verbs: ["get", "list", "watch", "update"]
|
|
|
4503 - apiGroups: ["apiextensions.k8s.io"]
|
|
|
4504 resources: ["customresourcedefinitions"]
|
|
|
4505 verbs: ["get", "list", "watch", "update"]
|
|
|
4506 ---
|
|
|
4507 # Source: cert-manager/templates/rbac.yaml
|
|
|
4508 # Issuer controller role
|
|
|
4509 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4510 kind: ClusterRole
|
|
|
4511 metadata:
|
|
|
4512 name: cert-manager-controller-issuers
|
|
|
4513 labels:
|
|
|
4514 app: cert-manager
|
|
|
4515 app.kubernetes.io/name: cert-manager
|
|
|
4516 app.kubernetes.io/instance: cert-manager
|
|
|
4517 app.kubernetes.io/component: "controller"
|
|
|
4518 app.kubernetes.io/version: "v1.10.1"
|
|
|
4519 rules:
|
|
|
4520 - apiGroups: ["cert-manager.io"]
|
|
|
4521 resources: ["issuers", "issuers/status"]
|
|
|
4522 verbs: ["update", "patch"]
|
|
|
4523 - apiGroups: ["cert-manager.io"]
|
|
|
4524 resources: ["issuers"]
|
|
|
4525 verbs: ["get", "list", "watch"]
|
|
|
4526 - apiGroups: [""]
|
|
|
4527 resources: ["secrets"]
|
|
|
4528 verbs: ["get", "list", "watch", "create", "update", "delete"]
|
|
|
4529 - apiGroups: [""]
|
|
|
4530 resources: ["events"]
|
|
|
4531 verbs: ["create", "patch"]
|
|
|
4532 ---
|
|
|
4533 # Source: cert-manager/templates/rbac.yaml
|
|
|
4534 # ClusterIssuer controller role
|
|
|
4535 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4536 kind: ClusterRole
|
|
|
4537 metadata:
|
|
|
4538 name: cert-manager-controller-clusterissuers
|
|
|
4539 labels:
|
|
|
4540 app: cert-manager
|
|
|
4541 app.kubernetes.io/name: cert-manager
|
|
|
4542 app.kubernetes.io/instance: cert-manager
|
|
|
4543 app.kubernetes.io/component: "controller"
|
|
|
4544 app.kubernetes.io/version: "v1.10.1"
|
|
|
4545 rules:
|
|
|
4546 - apiGroups: ["cert-manager.io"]
|
|
|
4547 resources: ["clusterissuers", "clusterissuers/status"]
|
|
|
4548 verbs: ["update", "patch"]
|
|
|
4549 - apiGroups: ["cert-manager.io"]
|
|
|
4550 resources: ["clusterissuers"]
|
|
|
4551 verbs: ["get", "list", "watch"]
|
|
|
4552 - apiGroups: [""]
|
|
|
4553 resources: ["secrets"]
|
|
|
4554 verbs: ["get", "list", "watch", "create", "update", "delete"]
|
|
|
4555 - apiGroups: [""]
|
|
|
4556 resources: ["events"]
|
|
|
4557 verbs: ["create", "patch"]
|
|
|
4558 ---
|
|
|
4559 # Source: cert-manager/templates/rbac.yaml
|
|
|
4560 # Certificates controller role
|
|
|
4561 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4562 kind: ClusterRole
|
|
|
4563 metadata:
|
|
|
4564 name: cert-manager-controller-certificates
|
|
|
4565 labels:
|
|
|
4566 app: cert-manager
|
|
|
4567 app.kubernetes.io/name: cert-manager
|
|
|
4568 app.kubernetes.io/instance: cert-manager
|
|
|
4569 app.kubernetes.io/component: "controller"
|
|
|
4570 app.kubernetes.io/version: "v1.10.1"
|
|
|
4571 rules:
|
|
|
4572 - apiGroups: ["cert-manager.io"]
|
|
|
4573 resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
|
|
|
4574 verbs: ["update", "patch"]
|
|
|
4575 - apiGroups: ["cert-manager.io"]
|
|
|
4576 resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"]
|
|
|
4577 verbs: ["get", "list", "watch"]
|
|
|
4578 # We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
|
|
4579 # admission controller enabled:
|
|
|
4580 # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
|
|
4581 - apiGroups: ["cert-manager.io"]
|
|
|
4582 resources: ["certificates/finalizers", "certificaterequests/finalizers"]
|
|
|
4583 verbs: ["update"]
|
|
|
4584 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4585 resources: ["orders"]
|
|
|
4586 verbs: ["create", "delete", "get", "list", "watch"]
|
|
|
4587 - apiGroups: [""]
|
|
|
4588 resources: ["secrets"]
|
|
|
4589 verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
|
|
|
4590 - apiGroups: [""]
|
|
|
4591 resources: ["events"]
|
|
|
4592 verbs: ["create", "patch"]
|
|
|
4593 ---
|
|
|
4594 # Source: cert-manager/templates/rbac.yaml
|
|
|
4595 # Orders controller role
|
|
|
4596 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4597 kind: ClusterRole
|
|
|
4598 metadata:
|
|
|
4599 name: cert-manager-controller-orders
|
|
|
4600 labels:
|
|
|
4601 app: cert-manager
|
|
|
4602 app.kubernetes.io/name: cert-manager
|
|
|
4603 app.kubernetes.io/instance: cert-manager
|
|
|
4604 app.kubernetes.io/component: "controller"
|
|
|
4605 app.kubernetes.io/version: "v1.10.1"
|
|
|
4606 rules:
|
|
|
4607 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4608 resources: ["orders", "orders/status"]
|
|
|
4609 verbs: ["update", "patch"]
|
|
|
4610 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4611 resources: ["orders", "challenges"]
|
|
|
4612 verbs: ["get", "list", "watch"]
|
|
|
4613 - apiGroups: ["cert-manager.io"]
|
|
|
4614 resources: ["clusterissuers", "issuers"]
|
|
|
4615 verbs: ["get", "list", "watch"]
|
|
|
4616 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4617 resources: ["challenges"]
|
|
|
4618 verbs: ["create", "delete"]
|
|
|
4619 # We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
|
|
4620 # admission controller enabled:
|
|
|
4621 # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
|
|
4622 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4623 resources: ["orders/finalizers"]
|
|
|
4624 verbs: ["update"]
|
|
|
4625 - apiGroups: [""]
|
|
|
4626 resources: ["secrets"]
|
|
|
4627 verbs: ["get", "list", "watch"]
|
|
|
4628 - apiGroups: [""]
|
|
|
4629 resources: ["events"]
|
|
|
4630 verbs: ["create", "patch"]
|
|
|
4631 ---
|
|
|
4632 # Source: cert-manager/templates/rbac.yaml
|
|
|
4633 # Challenges controller role
|
|
|
4634 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4635 kind: ClusterRole
|
|
|
4636 metadata:
|
|
|
4637 name: cert-manager-controller-challenges
|
|
|
4638 labels:
|
|
|
4639 app: cert-manager
|
|
|
4640 app.kubernetes.io/name: cert-manager
|
|
|
4641 app.kubernetes.io/instance: cert-manager
|
|
|
4642 app.kubernetes.io/component: "controller"
|
|
|
4643 app.kubernetes.io/version: "v1.10.1"
|
|
|
4644 rules:
|
|
|
4645 # Use to update challenge resource status
|
|
|
4646 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4647 resources: ["challenges", "challenges/status"]
|
|
|
4648 verbs: ["update", "patch"]
|
|
|
4649 # Used to watch challenge resources
|
|
|
4650 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4651 resources: ["challenges"]
|
|
|
4652 verbs: ["get", "list", "watch"]
|
|
|
4653 # Used to watch challenges, issuer and clusterissuer resources
|
|
|
4654 - apiGroups: ["cert-manager.io"]
|
|
|
4655 resources: ["issuers", "clusterissuers"]
|
|
|
4656 verbs: ["get", "list", "watch"]
|
|
|
4657 # Need to be able to retrieve ACME account private key to complete challenges
|
|
|
4658 - apiGroups: [""]
|
|
|
4659 resources: ["secrets"]
|
|
|
4660 verbs: ["get", "list", "watch"]
|
|
|
4661 # Used to create events
|
|
|
4662 - apiGroups: [""]
|
|
|
4663 resources: ["events"]
|
|
|
4664 verbs: ["create", "patch"]
|
|
|
4665 # HTTP01 rules
|
|
|
4666 - apiGroups: [""]
|
|
|
4667 resources: ["pods", "services"]
|
|
|
4668 verbs: ["get", "list", "watch", "create", "delete"]
|
|
|
4669 - apiGroups: ["networking.k8s.io"]
|
|
|
4670 resources: ["ingresses"]
|
|
|
4671 verbs: ["get", "list", "watch", "create", "delete", "update"]
|
|
|
4672 - apiGroups: [ "gateway.networking.k8s.io" ]
|
|
|
4673 resources: [ "httproutes" ]
|
|
|
4674 verbs: ["get", "list", "watch", "create", "delete", "update"]
|
|
|
4675 # We require the ability to specify a custom hostname when we are creating
|
|
|
4676 # new ingress resources.
|
|
|
4677 # See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148
|
|
|
4678 - apiGroups: ["route.openshift.io"]
|
|
|
4679 resources: ["routes/custom-host"]
|
|
|
4680 verbs: ["create"]
|
|
|
4681 # We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
|
|
4682 # admission controller enabled:
|
|
|
4683 # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
|
|
4684 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4685 resources: ["challenges/finalizers"]
|
|
|
4686 verbs: ["update"]
|
|
|
4687 # DNS01 rules (duplicated above)
|
|
|
4688 - apiGroups: [""]
|
|
|
4689 resources: ["secrets"]
|
|
|
4690 verbs: ["get", "list", "watch"]
|
|
|
4691 ---
|
|
|
4692 # Source: cert-manager/templates/rbac.yaml
|
|
|
4693 # ingress-shim controller role
|
|
|
4694 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4695 kind: ClusterRole
|
|
|
4696 metadata:
|
|
|
4697 name: cert-manager-controller-ingress-shim
|
|
|
4698 labels:
|
|
|
4699 app: cert-manager
|
|
|
4700 app.kubernetes.io/name: cert-manager
|
|
|
4701 app.kubernetes.io/instance: cert-manager
|
|
|
4702 app.kubernetes.io/component: "controller"
|
|
|
4703 app.kubernetes.io/version: "v1.10.1"
|
|
|
4704 rules:
|
|
|
4705 - apiGroups: ["cert-manager.io"]
|
|
|
4706 resources: ["certificates", "certificaterequests"]
|
|
|
4707 verbs: ["create", "update", "delete"]
|
|
|
4708 - apiGroups: ["cert-manager.io"]
|
|
|
4709 resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"]
|
|
|
4710 verbs: ["get", "list", "watch"]
|
|
|
4711 - apiGroups: ["networking.k8s.io"]
|
|
|
4712 resources: ["ingresses"]
|
|
|
4713 verbs: ["get", "list", "watch"]
|
|
|
4714 # We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
|
|
4715 # admission controller enabled:
|
|
|
4716 # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
|
|
4717 - apiGroups: ["networking.k8s.io"]
|
|
|
4718 resources: ["ingresses/finalizers"]
|
|
|
4719 verbs: ["update"]
|
|
|
4720 - apiGroups: ["gateway.networking.k8s.io"]
|
|
|
4721 resources: ["gateways", "httproutes"]
|
|
|
4722 verbs: ["get", "list", "watch"]
|
|
|
4723 - apiGroups: ["gateway.networking.k8s.io"]
|
|
|
4724 resources: ["gateways/finalizers", "httproutes/finalizers"]
|
|
|
4725 verbs: ["update"]
|
|
|
4726 - apiGroups: [""]
|
|
|
4727 resources: ["events"]
|
|
|
4728 verbs: ["create", "patch"]
|
|
|
4729 ---
|
|
|
4730 # Source: cert-manager/templates/rbac.yaml
|
|
|
4731 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4732 kind: ClusterRole
|
|
|
4733 metadata:
|
|
|
4734 name: cert-manager-view
|
|
|
4735 labels:
|
|
|
4736 app: cert-manager
|
|
|
4737 app.kubernetes.io/name: cert-manager
|
|
|
4738 app.kubernetes.io/instance: cert-manager
|
|
|
4739 app.kubernetes.io/component: "controller"
|
|
|
4740 app.kubernetes.io/version: "v1.10.1"
|
|
|
4741 rbac.authorization.k8s.io/aggregate-to-view: "true"
|
|
|
4742 rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
|
|
4743 rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
|
4744 rules:
|
|
|
4745 - apiGroups: ["cert-manager.io"]
|
|
|
4746 resources: ["certificates", "certificaterequests", "issuers"]
|
|
|
4747 verbs: ["get", "list", "watch"]
|
|
|
4748 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4749 resources: ["challenges", "orders"]
|
|
|
4750 verbs: ["get", "list", "watch"]
|
|
|
4751 ---
|
|
|
4752 # Source: cert-manager/templates/rbac.yaml
|
|
|
4753 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4754 kind: ClusterRole
|
|
|
4755 metadata:
|
|
|
4756 name: cert-manager-edit
|
|
|
4757 labels:
|
|
|
4758 app: cert-manager
|
|
|
4759 app.kubernetes.io/name: cert-manager
|
|
|
4760 app.kubernetes.io/instance: cert-manager
|
|
|
4761 app.kubernetes.io/component: "controller"
|
|
|
4762 app.kubernetes.io/version: "v1.10.1"
|
|
|
4763 rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
|
|
4764 rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
|
4765 rules:
|
|
|
4766 - apiGroups: ["cert-manager.io"]
|
|
|
4767 resources: ["certificates", "certificaterequests", "issuers"]
|
|
|
4768 verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
|
4769 - apiGroups: ["cert-manager.io"]
|
|
|
4770 resources: ["certificates/status"]
|
|
|
4771 verbs: ["update"]
|
|
|
4772 - apiGroups: ["acme.cert-manager.io"]
|
|
|
4773 resources: ["challenges", "orders"]
|
|
|
4774 verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
|
4775 ---
|
|
|
4776 # Source: cert-manager/templates/rbac.yaml
|
|
|
4777 # Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers
|
|
|
4778 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4779 kind: ClusterRole
|
|
|
4780 metadata:
|
|
|
4781 name: cert-manager-controller-approve:cert-manager-io
|
|
|
4782 labels:
|
|
|
4783 app: cert-manager
|
|
|
4784 app.kubernetes.io/name: cert-manager
|
|
|
4785 app.kubernetes.io/instance: cert-manager
|
|
|
4786 app.kubernetes.io/component: "cert-manager"
|
|
|
4787 app.kubernetes.io/version: "v1.10.1"
|
|
|
4788 rules:
|
|
|
4789 - apiGroups: ["cert-manager.io"]
|
|
|
4790 resources: ["signers"]
|
|
|
4791 verbs: ["approve"]
|
|
|
4792 resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
|
|
|
4793 ---
|
|
|
4794 # Source: cert-manager/templates/rbac.yaml
|
|
|
4795 # Permission to:
|
|
|
4796 # - Update and sign CertificatSigningeRequests referencing cert-manager.io Issuers and ClusterIssuers
|
|
|
4797 # - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers
|
|
|
4798 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4799 kind: ClusterRole
|
|
|
4800 metadata:
|
|
|
4801 name: cert-manager-controller-certificatesigningrequests
|
|
|
4802 labels:
|
|
|
4803 app: cert-manager
|
|
|
4804 app.kubernetes.io/name: cert-manager
|
|
|
4805 app.kubernetes.io/instance: cert-manager
|
|
|
4806 app.kubernetes.io/component: "cert-manager"
|
|
|
4807 app.kubernetes.io/version: "v1.10.1"
|
|
|
4808 rules:
|
|
|
4809 - apiGroups: ["certificates.k8s.io"]
|
|
|
4810 resources: ["certificatesigningrequests"]
|
|
|
4811 verbs: ["get", "list", "watch", "update"]
|
|
|
4812 - apiGroups: ["certificates.k8s.io"]
|
|
|
4813 resources: ["certificatesigningrequests/status"]
|
|
|
4814 verbs: ["update", "patch"]
|
|
|
4815 - apiGroups: ["certificates.k8s.io"]
|
|
|
4816 resources: ["signers"]
|
|
|
4817 resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
|
|
|
4818 verbs: ["sign"]
|
|
|
4819 - apiGroups: ["authorization.k8s.io"]
|
|
|
4820 resources: ["subjectaccessreviews"]
|
|
|
4821 verbs: ["create"]
|
|
|
4822 ---
|
|
|
4823 # Source: cert-manager/templates/webhook-rbac.yaml
|
|
|
4824 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4825 kind: ClusterRole
|
|
|
4826 metadata:
|
|
|
4827 name: cert-manager-webhook:subjectaccessreviews
|
|
|
4828 labels:
|
|
|
4829 app: webhook
|
|
|
4830 app.kubernetes.io/name: webhook
|
|
|
4831 app.kubernetes.io/instance: cert-manager
|
|
|
4832 app.kubernetes.io/component: "webhook"
|
|
|
4833 app.kubernetes.io/version: "v1.10.1"
|
|
|
4834 rules:
|
|
|
4835 - apiGroups: ["authorization.k8s.io"]
|
|
|
4836 resources: ["subjectaccessreviews"]
|
|
|
4837 verbs: ["create"]
|
|
|
4838 ---
|
|
|
4839 # Source: cert-manager/templates/cainjector-rbac.yaml
|
|
|
4840 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4841 kind: ClusterRoleBinding
|
|
|
4842 metadata:
|
|
|
4843 name: cert-manager-cainjector
|
|
|
4844 labels:
|
|
|
4845 app: cainjector
|
|
|
4846 app.kubernetes.io/name: cainjector
|
|
|
4847 app.kubernetes.io/instance: cert-manager
|
|
|
4848 app.kubernetes.io/component: "cainjector"
|
|
|
4849 app.kubernetes.io/version: "v1.10.1"
|
|
|
4850 roleRef:
|
|
|
4851 apiGroup: rbac.authorization.k8s.io
|
|
|
4852 kind: ClusterRole
|
|
|
4853 name: cert-manager-cainjector
|
|
|
4854 subjects:
|
|
|
4855 - name: cert-manager-cainjector
|
|
|
4856 namespace: cert-manager
|
|
|
4857 kind: ServiceAccount
|
|
|
4858 ---
|
|
|
4859 # Source: cert-manager/templates/rbac.yaml
|
|
|
4860 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4861 kind: ClusterRoleBinding
|
|
|
4862 metadata:
|
|
|
4863 name: cert-manager-controller-issuers
|
|
|
4864 labels:
|
|
|
4865 app: cert-manager
|
|
|
4866 app.kubernetes.io/name: cert-manager
|
|
|
4867 app.kubernetes.io/instance: cert-manager
|
|
|
4868 app.kubernetes.io/component: "controller"
|
|
|
4869 app.kubernetes.io/version: "v1.10.1"
|
|
|
4870 roleRef:
|
|
|
4871 apiGroup: rbac.authorization.k8s.io
|
|
|
4872 kind: ClusterRole
|
|
|
4873 name: cert-manager-controller-issuers
|
|
|
4874 subjects:
|
|
|
4875 - name: cert-manager
|
|
|
4876 namespace: cert-manager
|
|
|
4877 kind: ServiceAccount
|
|
|
4878 ---
|
|
|
4879 # Source: cert-manager/templates/rbac.yaml
|
|
|
4880 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4881 kind: ClusterRoleBinding
|
|
|
4882 metadata:
|
|
|
4883 name: cert-manager-controller-clusterissuers
|
|
|
4884 labels:
|
|
|
4885 app: cert-manager
|
|
|
4886 app.kubernetes.io/name: cert-manager
|
|
|
4887 app.kubernetes.io/instance: cert-manager
|
|
|
4888 app.kubernetes.io/component: "controller"
|
|
|
4889 app.kubernetes.io/version: "v1.10.1"
|
|
|
4890 roleRef:
|
|
|
4891 apiGroup: rbac.authorization.k8s.io
|
|
|
4892 kind: ClusterRole
|
|
|
4893 name: cert-manager-controller-clusterissuers
|
|
|
4894 subjects:
|
|
|
4895 - name: cert-manager
|
|
|
4896 namespace: cert-manager
|
|
|
4897 kind: ServiceAccount
|
|
|
4898 ---
|
|
|
4899 # Source: cert-manager/templates/rbac.yaml
|
|
|
4900 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4901 kind: ClusterRoleBinding
|
|
|
4902 metadata:
|
|
|
4903 name: cert-manager-controller-certificates
|
|
|
4904 labels:
|
|
|
4905 app: cert-manager
|
|
|
4906 app.kubernetes.io/name: cert-manager
|
|
|
4907 app.kubernetes.io/instance: cert-manager
|
|
|
4908 app.kubernetes.io/component: "controller"
|
|
|
4909 app.kubernetes.io/version: "v1.10.1"
|
|
|
4910 roleRef:
|
|
|
4911 apiGroup: rbac.authorization.k8s.io
|
|
|
4912 kind: ClusterRole
|
|
|
4913 name: cert-manager-controller-certificates
|
|
|
4914 subjects:
|
|
|
4915 - name: cert-manager
|
|
|
4916 namespace: cert-manager
|
|
|
4917 kind: ServiceAccount
|
|
|
4918 ---
|
|
|
4919 # Source: cert-manager/templates/rbac.yaml
|
|
|
4920 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4921 kind: ClusterRoleBinding
|
|
|
4922 metadata:
|
|
|
4923 name: cert-manager-controller-orders
|
|
|
4924 labels:
|
|
|
4925 app: cert-manager
|
|
|
4926 app.kubernetes.io/name: cert-manager
|
|
|
4927 app.kubernetes.io/instance: cert-manager
|
|
|
4928 app.kubernetes.io/component: "controller"
|
|
|
4929 app.kubernetes.io/version: "v1.10.1"
|
|
|
4930 roleRef:
|
|
|
4931 apiGroup: rbac.authorization.k8s.io
|
|
|
4932 kind: ClusterRole
|
|
|
4933 name: cert-manager-controller-orders
|
|
|
4934 subjects:
|
|
|
4935 - name: cert-manager
|
|
|
4936 namespace: cert-manager
|
|
|
4937 kind: ServiceAccount
|
|
|
4938 ---
|
|
|
4939 # Source: cert-manager/templates/rbac.yaml
|
|
|
4940 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4941 kind: ClusterRoleBinding
|
|
|
4942 metadata:
|
|
|
4943 name: cert-manager-controller-challenges
|
|
|
4944 labels:
|
|
|
4945 app: cert-manager
|
|
|
4946 app.kubernetes.io/name: cert-manager
|
|
|
4947 app.kubernetes.io/instance: cert-manager
|
|
|
4948 app.kubernetes.io/component: "controller"
|
|
|
4949 app.kubernetes.io/version: "v1.10.1"
|
|
|
4950 roleRef:
|
|
|
4951 apiGroup: rbac.authorization.k8s.io
|
|
|
4952 kind: ClusterRole
|
|
|
4953 name: cert-manager-controller-challenges
|
|
|
4954 subjects:
|
|
|
4955 - name: cert-manager
|
|
|
4956 namespace: cert-manager
|
|
|
4957 kind: ServiceAccount
|
|
|
4958 ---
|
|
|
4959 # Source: cert-manager/templates/rbac.yaml
|
|
|
4960 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4961 kind: ClusterRoleBinding
|
|
|
4962 metadata:
|
|
|
4963 name: cert-manager-controller-ingress-shim
|
|
|
4964 labels:
|
|
|
4965 app: cert-manager
|
|
|
4966 app.kubernetes.io/name: cert-manager
|
|
|
4967 app.kubernetes.io/instance: cert-manager
|
|
|
4968 app.kubernetes.io/component: "controller"
|
|
|
4969 app.kubernetes.io/version: "v1.10.1"
|
|
|
4970 roleRef:
|
|
|
4971 apiGroup: rbac.authorization.k8s.io
|
|
|
4972 kind: ClusterRole
|
|
|
4973 name: cert-manager-controller-ingress-shim
|
|
|
4974 subjects:
|
|
|
4975 - name: cert-manager
|
|
|
4976 namespace: cert-manager
|
|
|
4977 kind: ServiceAccount
|
|
|
4978 ---
|
|
|
4979 # Source: cert-manager/templates/rbac.yaml
|
|
|
4980 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
4981 kind: ClusterRoleBinding
|
|
|
4982 metadata:
|
|
|
4983 name: cert-manager-controller-approve:cert-manager-io
|
|
|
4984 labels:
|
|
|
4985 app: cert-manager
|
|
|
4986 app.kubernetes.io/name: cert-manager
|
|
|
4987 app.kubernetes.io/instance: cert-manager
|
|
|
4988 app.kubernetes.io/component: "cert-manager"
|
|
|
4989 app.kubernetes.io/version: "v1.10.1"
|
|
|
4990 roleRef:
|
|
|
4991 apiGroup: rbac.authorization.k8s.io
|
|
|
4992 kind: ClusterRole
|
|
|
4993 name: cert-manager-controller-approve:cert-manager-io
|
|
|
4994 subjects:
|
|
|
4995 - name: cert-manager
|
|
|
4996 namespace: cert-manager
|
|
|
4997 kind: ServiceAccount
|
|
|
4998 ---
|
|
|
4999 # Source: cert-manager/templates/rbac.yaml
|
|
|
5000 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
5001 kind: ClusterRoleBinding
|
|
|
5002 metadata:
|
|
|
5003 name: cert-manager-controller-certificatesigningrequests
|
|
|
5004 labels:
|
|
|
5005 app: cert-manager
|
|
|
5006 app.kubernetes.io/name: cert-manager
|
|
|
5007 app.kubernetes.io/instance: cert-manager
|
|
|
5008 app.kubernetes.io/component: "cert-manager"
|
|
|
5009 app.kubernetes.io/version: "v1.10.1"
|
|
|
5010 roleRef:
|
|
|
5011 apiGroup: rbac.authorization.k8s.io
|
|
|
5012 kind: ClusterRole
|
|
|
5013 name: cert-manager-controller-certificatesigningrequests
|
|
|
5014 subjects:
|
|
|
5015 - name: cert-manager
|
|
|
5016 namespace: cert-manager
|
|
|
5017 kind: ServiceAccount
|
|
|
5018 ---
|
|
|
5019 # Source: cert-manager/templates/webhook-rbac.yaml
|
|
|
5020 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
5021 kind: ClusterRoleBinding
|
|
|
5022 metadata:
|
|
|
5023 name: cert-manager-webhook:subjectaccessreviews
|
|
|
5024 labels:
|
|
|
5025 app: webhook
|
|
|
5026 app.kubernetes.io/name: webhook
|
|
|
5027 app.kubernetes.io/instance: cert-manager
|
|
|
5028 app.kubernetes.io/component: "webhook"
|
|
|
5029 app.kubernetes.io/version: "v1.10.1"
|
|
|
5030 roleRef:
|
|
|
5031 apiGroup: rbac.authorization.k8s.io
|
|
|
5032 kind: ClusterRole
|
|
|
5033 name: cert-manager-webhook:subjectaccessreviews
|
|
|
5034 subjects:
|
|
|
5035 - apiGroup: ""
|
|
|
5036 kind: ServiceAccount
|
|
|
5037 name: cert-manager-webhook
|
|
|
5038 namespace: cert-manager
|
|
|
5039 ---
|
|
|
5040 # Source: cert-manager/templates/cainjector-rbac.yaml
|
|
|
5041 # leader election rules
|
|
|
5042 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
5043 kind: Role
|
|
|
5044 metadata:
|
|
|
5045 name: cert-manager-cainjector:leaderelection
|
|
|
5046 namespace: kube-system
|
|
|
5047 labels:
|
|
|
5048 app: cainjector
|
|
|
5049 app.kubernetes.io/name: cainjector
|
|
|
5050 app.kubernetes.io/instance: cert-manager
|
|
|
5051 app.kubernetes.io/component: "cainjector"
|
|
|
5052 app.kubernetes.io/version: "v1.10.1"
|
|
|
5053 rules:
|
|
|
5054 # Used for leader election by the controller
|
|
|
5055 # cert-manager-cainjector-leader-election is used by the CertificateBased injector controller
|
|
|
5056 # see cmd/cainjector/start.go#L113
|
|
|
5057 # cert-manager-cainjector-leader-election-core is used by the SecretBased injector controller
|
|
|
5058 # see cmd/cainjector/start.go#L137
|
|
|
5059 - apiGroups: ["coordination.k8s.io"]
|
|
|
5060 resources: ["leases"]
|
|
|
5061 resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"]
|
|
|
5062 verbs: ["get", "update", "patch"]
|
|
|
5063 - apiGroups: ["coordination.k8s.io"]
|
|
|
5064 resources: ["leases"]
|
|
|
5065 verbs: ["create"]
|
|
|
5066 ---
|
|
|
5067 # Source: cert-manager/templates/rbac.yaml
|
|
|
5068 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
5069 kind: Role
|
|
|
5070 metadata:
|
|
|
5071 name: cert-manager:leaderelection
|
|
|
5072 namespace: kube-system
|
|
|
5073 labels:
|
|
|
5074 app: cert-manager
|
|
|
5075 app.kubernetes.io/name: cert-manager
|
|
|
5076 app.kubernetes.io/instance: cert-manager
|
|
|
5077 app.kubernetes.io/component: "controller"
|
|
|
5078 app.kubernetes.io/version: "v1.10.1"
|
|
|
5079 rules:
|
|
|
5080 - apiGroups: ["coordination.k8s.io"]
|
|
|
5081 resources: ["leases"]
|
|
|
5082 resourceNames: ["cert-manager-controller"]
|
|
|
5083 verbs: ["get", "update", "patch"]
|
|
|
5084 - apiGroups: ["coordination.k8s.io"]
|
|
|
5085 resources: ["leases"]
|
|
|
5086 verbs: ["create"]
|
|
|
5087 ---
|
|
|
5088 # Source: cert-manager/templates/webhook-rbac.yaml
|
|
|
5089 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
5090 kind: Role
|
|
|
5091 metadata:
|
|
|
5092 name: cert-manager-webhook:dynamic-serving
|
|
|
5093 namespace: cert-manager
|
|
|
5094 labels:
|
|
|
5095 app: webhook
|
|
|
5096 app.kubernetes.io/name: webhook
|
|
|
5097 app.kubernetes.io/instance: cert-manager
|
|
|
5098 app.kubernetes.io/component: "webhook"
|
|
|
5099 app.kubernetes.io/version: "v1.10.1"
|
|
|
5100 rules:
|
|
|
5101 - apiGroups: [""]
|
|
|
5102 resources: ["secrets"]
|
|
|
5103 resourceNames:
|
|
|
5104 - 'cert-manager-webhook-ca'
|
|
|
5105 verbs: ["get", "list", "watch", "update"]
|
|
|
5106 # It's not possible to grant CREATE permission on a single resourceName.
|
|
|
5107 - apiGroups: [""]
|
|
|
5108 resources: ["secrets"]
|
|
|
5109 verbs: ["create"]
|
|
|
5110 ---
|
|
|
5111 # Source: cert-manager/templates/cainjector-rbac.yaml
|
|
|
5112 # grant cert-manager permission to manage the leaderelection configmap in the
|
|
|
5113 # leader election namespace
|
|
|
5114 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
5115 kind: RoleBinding
|
|
|
5116 metadata:
|
|
|
5117 name: cert-manager-cainjector:leaderelection
|
|
|
5118 namespace: kube-system
|
|
|
5119 labels:
|
|
|
5120 app: cainjector
|
|
|
5121 app.kubernetes.io/name: cainjector
|
|
|
5122 app.kubernetes.io/instance: cert-manager
|
|
|
5123 app.kubernetes.io/component: "cainjector"
|
|
|
5124 app.kubernetes.io/version: "v1.10.1"
|
|
|
5125 roleRef:
|
|
|
5126 apiGroup: rbac.authorization.k8s.io
|
|
|
5127 kind: Role
|
|
|
5128 name: cert-manager-cainjector:leaderelection
|
|
|
5129 subjects:
|
|
|
5130 - kind: ServiceAccount
|
|
|
5131 name: cert-manager-cainjector
|
|
|
5132 namespace: cert-manager
|
|
|
5133 ---
|
|
|
5134 # Source: cert-manager/templates/rbac.yaml
|
|
|
5135 # grant cert-manager permission to manage the leaderelection configmap in the
|
|
|
5136 # leader election namespace
|
|
|
5137 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
5138 kind: RoleBinding
|
|
|
5139 metadata:
|
|
|
5140 name: cert-manager:leaderelection
|
|
|
5141 namespace: kube-system
|
|
|
5142 labels:
|
|
|
5143 app: cert-manager
|
|
|
5144 app.kubernetes.io/name: cert-manager
|
|
|
5145 app.kubernetes.io/instance: cert-manager
|
|
|
5146 app.kubernetes.io/component: "controller"
|
|
|
5147 app.kubernetes.io/version: "v1.10.1"
|
|
|
5148 roleRef:
|
|
|
5149 apiGroup: rbac.authorization.k8s.io
|
|
|
5150 kind: Role
|
|
|
5151 name: cert-manager:leaderelection
|
|
|
5152 subjects:
|
|
|
5153 - apiGroup: ""
|
|
|
5154 kind: ServiceAccount
|
|
|
5155 name: cert-manager
|
|
|
5156 namespace: cert-manager
|
|
|
5157 ---
|
|
|
5158 # Source: cert-manager/templates/webhook-rbac.yaml
|
|
|
5159 apiVersion: rbac.authorization.k8s.io/v1
|
|
|
5160 kind: RoleBinding
|
|
|
5161 metadata:
|
|
|
5162 name: cert-manager-webhook:dynamic-serving
|
|
|
5163 namespace: cert-manager
|
|
|
5164 labels:
|
|
|
5165 app: webhook
|
|
|
5166 app.kubernetes.io/name: webhook
|
|
|
5167 app.kubernetes.io/instance: cert-manager
|
|
|
5168 app.kubernetes.io/component: "webhook"
|
|
|
5169 app.kubernetes.io/version: "v1.10.1"
|
|
|
5170 roleRef:
|
|
|
5171 apiGroup: rbac.authorization.k8s.io
|
|
|
5172 kind: Role
|
|
|
5173 name: cert-manager-webhook:dynamic-serving
|
|
|
5174 subjects:
|
|
|
5175 - apiGroup: ""
|
|
|
5176 kind: ServiceAccount
|
|
|
5177 name: cert-manager-webhook
|
|
|
5178 namespace: cert-manager
|
|
|
5179 ---
|
|
|
5180 # Source: cert-manager/templates/service.yaml
|
|
|
5181 apiVersion: v1
|
|
|
5182 kind: Service
|
|
|
5183 metadata:
|
|
|
5184 name: cert-manager
|
|
|
5185 namespace: cert-manager
|
|
|
5186 labels:
|
|
|
5187 app: cert-manager
|
|
|
5188 app.kubernetes.io/name: cert-manager
|
|
|
5189 app.kubernetes.io/instance: cert-manager
|
|
|
5190 app.kubernetes.io/component: "controller"
|
|
|
5191 app.kubernetes.io/version: "v1.10.1"
|
|
|
5192 spec:
|
|
|
5193 type: ClusterIP
|
|
|
5194 ports:
|
|
|
5195 - protocol: TCP
|
|
|
5196 port: 9402
|
|
|
5197 name: tcp-prometheus-servicemonitor
|
|
|
5198 targetPort: 9402
|
|
|
5199 selector:
|
|
|
5200 app.kubernetes.io/name: cert-manager
|
|
|
5201 app.kubernetes.io/instance: cert-manager
|
|
|
5202 app.kubernetes.io/component: "controller"
|
|
|
5203 ---
|
|
|
5204 # Source: cert-manager/templates/webhook-service.yaml
|
|
|
5205 apiVersion: v1
|
|
|
5206 kind: Service
|
|
|
5207 metadata:
|
|
|
5208 name: cert-manager-webhook
|
|
|
5209 namespace: cert-manager
|
|
|
5210 labels:
|
|
|
5211 app: webhook
|
|
|
5212 app.kubernetes.io/name: webhook
|
|
|
5213 app.kubernetes.io/instance: cert-manager
|
|
|
5214 app.kubernetes.io/component: "webhook"
|
|
|
5215 app.kubernetes.io/version: "v1.10.1"
|
|
|
5216 spec:
|
|
|
5217 type: ClusterIP
|
|
|
5218 ports:
|
|
|
5219 - name: https
|
|
|
5220 port: 443
|
|
|
5221 protocol: TCP
|
|
|
5222 targetPort: "https"
|
|
|
5223 selector:
|
|
|
5224 app.kubernetes.io/name: webhook
|
|
|
5225 app.kubernetes.io/instance: cert-manager
|
|
|
5226 app.kubernetes.io/component: "webhook"
|
|
|
5227 ---
|
|
|
5228 # Source: cert-manager/templates/cainjector-deployment.yaml
|
|
|
5229 apiVersion: apps/v1
|
|
|
5230 kind: Deployment
|
|
|
5231 metadata:
|
|
|
5232 name: cert-manager-cainjector
|
|
|
5233 namespace: cert-manager
|
|
|
5234 labels:
|
|
|
5235 app: cainjector
|
|
|
5236 app.kubernetes.io/name: cainjector
|
|
|
5237 app.kubernetes.io/instance: cert-manager
|
|
|
5238 app.kubernetes.io/component: "cainjector"
|
|
|
5239 app.kubernetes.io/version: "v1.10.1"
|
|
|
5240 spec:
|
|
|
5241 replicas: 1
|
|
|
5242 selector:
|
|
|
5243 matchLabels:
|
|
|
5244 app.kubernetes.io/name: cainjector
|
|
|
5245 app.kubernetes.io/instance: cert-manager
|
|
|
5246 app.kubernetes.io/component: "cainjector"
|
|
|
5247 template:
|
|
|
5248 metadata:
|
|
|
5249 labels:
|
|
|
5250 app: cainjector
|
|
|
5251 app.kubernetes.io/name: cainjector
|
|
|
5252 app.kubernetes.io/instance: cert-manager
|
|
|
5253 app.kubernetes.io/component: "cainjector"
|
|
|
5254 app.kubernetes.io/version: "v1.10.1"
|
|
|
5255 spec:
|
|
|
5256 serviceAccountName: cert-manager-cainjector
|
|
|
5257 securityContext:
|
|
|
5258 runAsNonRoot: true
|
|
|
5259 seccompProfile:
|
|
|
5260 type: RuntimeDefault
|
|
|
5261 containers:
|
|
|
5262 - name: cert-manager-cainjector
|
|
|
5263 image: "quay.io/jetstack/cert-manager-cainjector:v1.10.1"
|
|
|
5264 imagePullPolicy: IfNotPresent
|
|
|
5265 args:
|
|
|
5266 - --v=2
|
|
|
5267 - --leader-election-namespace=kube-system
|
|
|
5268 env:
|
|
|
5269 - name: POD_NAMESPACE
|
|
|
5270 valueFrom:
|
|
|
5271 fieldRef:
|
|
|
5272 fieldPath: metadata.namespace
|
|
|
5273 securityContext:
|
|
|
5274 allowPrivilegeEscalation: false
|
|
|
5275 capabilities:
|
|
|
5276 drop:
|
|
|
5277 - ALL
|
|
|
5278 nodeSelector:
|
|
|
5279 kubernetes.io/os: linux
|
|
|
5280 ---
|
|
|
5281 # Source: cert-manager/templates/deployment.yaml
|
|
|
5282 apiVersion: apps/v1
|
|
|
5283 kind: Deployment
|
|
|
5284 metadata:
|
|
|
5285 name: cert-manager
|
|
|
5286 namespace: cert-manager
|
|
|
5287 labels:
|
|
|
5288 app: cert-manager
|
|
|
5289 app.kubernetes.io/name: cert-manager
|
|
|
5290 app.kubernetes.io/instance: cert-manager
|
|
|
5291 app.kubernetes.io/component: "controller"
|
|
|
5292 app.kubernetes.io/version: "v1.10.1"
|
|
|
5293 spec:
|
|
|
5294 replicas: 1
|
|
|
5295 selector:
|
|
|
5296 matchLabels:
|
|
|
5297 app.kubernetes.io/name: cert-manager
|
|
|
5298 app.kubernetes.io/instance: cert-manager
|
|
|
5299 app.kubernetes.io/component: "controller"
|
|
|
5300 template:
|
|
|
5301 metadata:
|
|
|
5302 labels:
|
|
|
5303 app: cert-manager
|
|
|
5304 app.kubernetes.io/name: cert-manager
|
|
|
5305 app.kubernetes.io/instance: cert-manager
|
|
|
5306 app.kubernetes.io/component: "controller"
|
|
|
5307 app.kubernetes.io/version: "v1.10.1"
|
|
|
5308 annotations:
|
|
|
5309 prometheus.io/path: "/metrics"
|
|
|
5310 prometheus.io/scrape: 'true'
|
|
|
5311 prometheus.io/port: '9402'
|
|
|
5312 spec:
|
|
|
5313 serviceAccountName: cert-manager
|
|
|
5314 securityContext:
|
|
|
5315 runAsNonRoot: true
|
|
|
5316 seccompProfile:
|
|
|
5317 type: RuntimeDefault
|
|
|
5318 containers:
|
|
|
5319 - name: cert-manager-controller
|
|
|
5320 image: "quay.io/jetstack/cert-manager-controller:v1.10.1"
|
|
|
5321 imagePullPolicy: IfNotPresent
|
|
|
5322 args:
|
|
|
5323 - --v=2
|
|
|
5324 - --cluster-resource-namespace=$(POD_NAMESPACE)
|
|
|
5325 - --leader-election-namespace=kube-system
|
|
|
5326 ports:
|
|
|
5327 - containerPort: 9402
|
|
|
5328 name: http-metrics
|
|
|
5329 protocol: TCP
|
|
|
5330 securityContext:
|
|
|
5331 allowPrivilegeEscalation: false
|
|
|
5332 capabilities:
|
|
|
5333 drop:
|
|
|
5334 - ALL
|
|
|
5335 env:
|
|
|
5336 - name: POD_NAMESPACE
|
|
|
5337 valueFrom:
|
|
|
5338 fieldRef:
|
|
|
5339 fieldPath: metadata.namespace
|
|
|
5340 nodeSelector:
|
|
|
5341 kubernetes.io/os: linux
|
|
|
5342 ---
|
|
|
5343 # Source: cert-manager/templates/webhook-deployment.yaml
|
|
|
5344 apiVersion: apps/v1
|
|
|
5345 kind: Deployment
|
|
|
5346 metadata:
|
|
|
5347 name: cert-manager-webhook
|
|
|
5348 namespace: cert-manager
|
|
|
5349 labels:
|
|
|
5350 app: webhook
|
|
|
5351 app.kubernetes.io/name: webhook
|
|
|
5352 app.kubernetes.io/instance: cert-manager
|
|
|
5353 app.kubernetes.io/component: "webhook"
|
|
|
5354 app.kubernetes.io/version: "v1.10.1"
|
|
|
5355 spec:
|
|
|
5356 replicas: 1
|
|
|
5357 selector:
|
|
|
5358 matchLabels:
|
|
|
5359 app.kubernetes.io/name: webhook
|
|
|
5360 app.kubernetes.io/instance: cert-manager
|
|
|
5361 app.kubernetes.io/component: "webhook"
|
|
|
5362 template:
|
|
|
5363 metadata:
|
|
|
5364 labels:
|
|
|
5365 app: webhook
|
|
|
5366 app.kubernetes.io/name: webhook
|
|
|
5367 app.kubernetes.io/instance: cert-manager
|
|
|
5368 app.kubernetes.io/component: "webhook"
|
|
|
5369 app.kubernetes.io/version: "v1.10.1"
|
|
|
5370 spec:
|
|
|
5371 serviceAccountName: cert-manager-webhook
|
|
|
5372 securityContext:
|
|
|
5373 runAsNonRoot: true
|
|
|
5374 seccompProfile:
|
|
|
5375 type: RuntimeDefault
|
|
|
5376 containers:
|
|
|
5377 - name: cert-manager-webhook
|
|
|
5378 image: "quay.io/jetstack/cert-manager-webhook:v1.10.1"
|
|
|
5379 imagePullPolicy: IfNotPresent
|
|
|
5380 args:
|
|
|
5381 - --v=2
|
|
|
5382 - --secure-port=10250
|
|
|
5383 - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
|
|
|
5384 - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
|
|
|
5385 - --dynamic-serving-dns-names=cert-manager-webhook
|
|
|
5386 - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE)
|
|
|
5387 - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc
|
|
|
5388
|
|
|
5389 ports:
|
|
|
5390 - name: https
|
|
|
5391 protocol: TCP
|
|
|
5392 containerPort: 10250
|
|
|
5393 - name: healthcheck
|
|
|
5394 protocol: TCP
|
|
|
5395 containerPort: 6080
|
|
|
5396 livenessProbe:
|
|
|
5397 httpGet:
|
|
|
5398 path: /livez
|
|
|
5399 port: 6080
|
|
|
5400 scheme: HTTP
|
|
|
5401 initialDelaySeconds: 60
|
|
|
5402 periodSeconds: 10
|
|
|
5403 timeoutSeconds: 1
|
|
|
5404 successThreshold: 1
|
|
|
5405 failureThreshold: 3
|
|
|
5406 readinessProbe:
|
|
|
5407 httpGet:
|
|
|
5408 path: /healthz
|
|
|
5409 port: 6080
|
|
|
5410 scheme: HTTP
|
|
|
5411 initialDelaySeconds: 5
|
|
|
5412 periodSeconds: 5
|
|
|
5413 timeoutSeconds: 1
|
|
|
5414 successThreshold: 1
|
|
|
5415 failureThreshold: 3
|
|
|
5416 securityContext:
|
|
|
5417 allowPrivilegeEscalation: false
|
|
|
5418 capabilities:
|
|
|
5419 drop:
|
|
|
5420 - ALL
|
|
|
5421 env:
|
|
|
5422 - name: POD_NAMESPACE
|
|
|
5423 valueFrom:
|
|
|
5424 fieldRef:
|
|
|
5425 fieldPath: metadata.namespace
|
|
|
5426 nodeSelector:
|
|
|
5427 kubernetes.io/os: linux
|
|
|
5428 ---
|
|
|
5429 # Source: cert-manager/templates/webhook-mutating-webhook.yaml
|
|
|
5430 apiVersion: admissionregistration.k8s.io/v1
|
|
|
5431 kind: MutatingWebhookConfiguration
|
|
|
5432 metadata:
|
|
|
5433 name: cert-manager-webhook
|
|
|
5434 labels:
|
|
|
5435 app: webhook
|
|
|
5436 app.kubernetes.io/name: webhook
|
|
|
5437 app.kubernetes.io/instance: cert-manager
|
|
|
5438 app.kubernetes.io/component: "webhook"
|
|
|
5439 app.kubernetes.io/version: "v1.10.1"
|
|
|
5440 annotations:
|
|
|
5441 cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca"
|
|
|
5442 webhooks:
|
|
|
5443 - name: webhook.cert-manager.io
|
|
|
5444 rules:
|
|
|
5445 - apiGroups:
|
|
|
5446 - "cert-manager.io"
|
|
|
5447 - "acme.cert-manager.io"
|
|
|
5448 apiVersions:
|
|
|
5449 - "v1"
|
|
|
5450 operations:
|
|
|
5451 - CREATE
|
|
|
5452 - UPDATE
|
|
|
5453 resources:
|
|
|
5454 - "*/*"
|
|
|
5455 admissionReviewVersions: ["v1"]
|
|
|
5456 # This webhook only accepts v1 cert-manager resources.
|
|
|
5457 # Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
|
|
5458 # this webhook (after the resources have been converted to v1).
|
|
|
5459 matchPolicy: Equivalent
|
|
|
5460 timeoutSeconds: 10
|
|
|
5461 failurePolicy: Fail
|
|
|
5462 # Only include 'sideEffects' field in Kubernetes 1.12+
|
|
|
5463 sideEffects: None
|
|
|
5464 clientConfig:
|
|
|
5465 service:
|
|
|
5466 name: cert-manager-webhook
|
|
|
5467 namespace: cert-manager
|
|
|
5468 path: /mutate
|
|
|
5469 ---
|
|
|
5470 # Source: cert-manager/templates/webhook-validating-webhook.yaml
|
|
|
5471 apiVersion: admissionregistration.k8s.io/v1
|
|
|
5472 kind: ValidatingWebhookConfiguration
|
|
|
5473 metadata:
|
|
|
5474 name: cert-manager-webhook
|
|
|
5475 labels:
|
|
|
5476 app: webhook
|
|
|
5477 app.kubernetes.io/name: webhook
|
|
|
5478 app.kubernetes.io/instance: cert-manager
|
|
|
5479 app.kubernetes.io/component: "webhook"
|
|
|
5480 app.kubernetes.io/version: "v1.10.1"
|
|
|
5481 annotations:
|
|
|
5482 cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca"
|
|
|
5483 webhooks:
|
|
|
5484 - name: webhook.cert-manager.io
|
|
|
5485 namespaceSelector:
|
|
|
5486 matchExpressions:
|
|
|
5487 - key: "cert-manager.io/disable-validation"
|
|
|
5488 operator: "NotIn"
|
|
|
5489 values:
|
|
|
5490 - "true"
|
|
|
5491 - key: "name"
|
|
|
5492 operator: "NotIn"
|
|
|
5493 values:
|
|
|
5494 - cert-manager
|
|
|
5495 rules:
|
|
|
5496 - apiGroups:
|
|
|
5497 - "cert-manager.io"
|
|
|
5498 - "acme.cert-manager.io"
|
|
|
5499 apiVersions:
|
|
|
5500 - "v1"
|
|
|
5501 operations:
|
|
|
5502 - CREATE
|
|
|
5503 - UPDATE
|
|
|
5504 resources:
|
|
|
5505 - "*/*"
|
|
|
5506 admissionReviewVersions: ["v1"]
|
|
|
5507 # This webhook only accepts v1 cert-manager resources.
|
|
|
5508 # Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
|
|
5509 # this webhook (after the resources have been converted to v1).
|
|
|
5510 matchPolicy: Equivalent
|
|
|
5511 timeoutSeconds: 10
|
|
|
5512 failurePolicy: Fail
|
|
|
5513 sideEffects: None
|
|
|
5514 clientConfig:
|
|
|
5515 service:
|
|
|
5516 name: cert-manager-webhook
|
|
|
5517 namespace: cert-manager
|
|
|
5518 path: /validate
|
