Changes for version 1.108 - 2026-09-22
- Track Kubernetes v1.37.0: 11 new Kinds, 103 supporting types and 48 added fields, with upstream-derived resource plurals. Ten fields newly required upstream now fail construction when omitted.
- Add full-depth PrometheusOperator (v0.93.1), VolumeSnapshot (external- snapshotter v8.6.0) and ExternalSecrets (v2.10.0) providers, including all 19 ExternalSecrets generator Kinds.
- Model existing CRD providers to full depth and retain compatible older API tracks. Update Cilium to v1.20.1, Traefik to v3.7.12, K3s to v1.36.4+k3s1 and AgentSandbox to v1.0.0.
- Fix CertManager status conditions silently dropping live objects: Issuer, ClusterIssuer, Certificate and CertificateRequest now type their conditions with cert-manager's own condition classes, which require only type and status per the CRD, so real objects that omit message no longer fail to inflate.
- Constrain cert-manager IssuerCondition, CertificateCondition and CertificateRequestCondition status to the CRD's True/False/Unknown enum, enforced client-side at construction like the other schema enums; a status outside that set now fails to construct, matching upstream.
- Fix PrometheusOperator status conditions dropping live objects the same way: Alertmanager and Prometheus now use a PrometheusOperator condition class (lastTransitionTime, status and type required per the CRD, message and reason optional), so real objects that omit message no longer fail to inflate. WorkloadBinding, whose upstream condition is a distinct type with its type constrained to the Accepted enum, uses its own WorkloadBindingCondition class.
- Fix AutoGen's core-class reuse (D5, reuse_core) picking a shipped class that requires a field the schema's own required list leaves optional. A nested object generated from a caller-supplied openapi_spec, or by CRD::Emitter, no longer reuses a class whose extra required field would reject or silently drop a real object that omits it. When that filter removes the only shared apimachinery or core type a nested object matched, reuse no longer falls back to an unrelated class of the same shape from another API group; the object's own class is generated instead, so a provider's condition is modelled by that provider's class.
- Model Cilium and ExternalSecrets status conditions with each provider's own condition class instead of reusing Core::V1::NamespaceCondition for a look- alike shape that survives the required filter: Cilium's CiliumNetworkPolicy conditions are now NetworkPolicyCondition, and ExternalSecrets' SecretStore, ExternalSecret, PushSecret and GeneratorState status conditions each their own class. The field shape is unchanged, but a condition now blesses as the provider's class, and ExternalSecret's condition type is constrained to the CRD's Ready/Deleted enum, enforced client-side at construction.
- Add the three VolumeGroupSnapshot Kinds in v1, v1beta1 and v1beta2, with typed version-specific status fields. Bare names select the pinned upstream's storage v1beta2; exact GVKs select any served track.
- Add CRD loading/add_crd for objects, hashes, YAML/JSON and files. Generate every served version with exact GVKs and storage-version short names; retain the first bare-name binding when groups share a Kind.
- Generate nested OpenAPI objects at full depth, expose their source metadata and safely shorten deep class names. Reject unresolved references and use process-unique namespaces so later instances cannot inherit old schemas.
- Let generation keep a provider's own named type where its shape matches a core class (AutoGen reuse_core_except), and let the class emitter point a field at an absolute cross-version or core class without emitting a copy.
- Add single- and multi-version CRD schema export through to_crd and IO::K8s::CRD, including field options, JSON Bool defaults and supported ECMA262 patterns. Reject duplicate versions and unsupported Perl patterns.
- CRD schema round trips are not lossless: Quantity becomes Str, typed scalar maps become opaque maps, and arrays of Num, Quantity, Time or IntOrStr re-import as arrays of Str.
- Add CRD::Emitter rendering with name/role overlays and canonical Quantity recognition. Shared target paths require identical functional declarations; contextual POD may differ, but conflicting aliases fail.
- Extend the k8s DSL with Num, typed scalar maps, nested containers and schema/validation field options. Enforce scalar enum/range/pattern rules; defaults and schema-requiredness remain metadata, not client-side defaults.
- Preserve unknown fields at every modeled depth by default; strict => 1 rejects them. Opt-in unknown_kinds => 'unstructured' also preserves unresolved resource documents instead of failing GVK resolution.
- Make GVK resolution consistently exact and fail closed, including version conflicts, qualified map keys and bare names shadowed by Perl packages. kind, api_version and resource_plural reject setter arguments.
- Coerce nested hashrefs through direct constructors and FROM_HASH, preserve prebuilt objects and shallow-copy input/output containers. Inner references below opaque hashes remain shared.
- Make class-level JSON round trips recursive, handle fields named json and require UTF-8 bytes for from_json. Already-decoded non-ASCII character strings now fail instead of producing mojibake.
- Normalize Bool values consistently, including scalar references and JSON booleans. Scalar undef is omitted; undef in Bool arrays fails at the wire boundary. Num stays numeric; Quantity accepts the n and u suffixes.
- Extend generic List inflation to Kubernetes *List payloads, unknown envelope fields, strict mode and JSON round trips. item_class requires a fully qualified class; unverifiable list identity is not emitted.
- Make SpecBuilder object-aware on all API objects: typed paths, container vivification, hashref coercion and non-destructive errors. Builder roles declare their requirements; calling spec_* without a spec gives an error.
- Support Ingress path backends via add_path_match(service => ..., port => ...), including named ports; add_backend remains the default backend. Gateway/Traefik routing is unchanged, with Gateway path-type translation.
- Limit core NetworkPolicy DNS egress to CoreDNS in kube-system. Policies generated by allow_egress_to_dns no longer permit port 53 everywhere; other DNS destinations require an explicit rule. Cilium is unchanged.
- Give MiddlewareTCP a TCP-only builder. Its former HTTP-only builder methods now fail as missing methods; HTTP Middleware is unchanged.
- Require owner UIDs and reject a second controller in set_owner. Adding the same UID is an idempotent no-op; controller => 0 creates a non-controller reference without the controller flag.
- Remove unsupported status accessors from Traefik, K3s Addon and HelmChartConfig, and volumeClaimTemplatesPolicy from AgentSandbox v1alpha1 SandboxTemplate. Undeclared wire fields remain preserved outside strict mode.
- Embedded Pod/Job/PVC template structs and ResourceClaimTemplateSpec lose APIObject identity/convenience methods (missing-method errors); metadata remains, without the incorrect apiVersion/kind output.
- Remove imported helper functions accidentally exposed as public methods; genuine role methods and composition relationships remain unchanged.
- Cache successful class loads and precompute core-shape lookup. Removing a cached module from %INC no longer forces a reload through load_class; failed loads are still retried, and reuse_core can be disabled.
- Add pinned-source CRD drift/schema auditing and render/check/suggest tools, with data-driven exceptions and UTF-8-safe manifests. Correct API/role POD, declare Path::Tiny for tests and fix the distribution authority metadata.
Modules
Objects representing things found in the Kubernetes API
Base class for top-level Kubernetes API objects
AgentSandbox CRD resource map provider for IO::K8s
Isolated runtime environment for AI agents
Request for sandbox allocation
Reusable sandbox configuration template
Pre-warmed pool of sandbox instances
EmbeddedObjectMetadata
LocalObjectReference
NetworkPolicySpec
PersistentVolumeClaimTemplate
PodMetadata
PodReadinessGate
PodSchedulingGate
PodSchedulingGroup
PodTemplate
SandboxClaim
SandboxClaimSpec
SandboxClaimStatus
SandboxClaimStatusSandbox
SandboxSpec
SandboxStatus
SandboxTemplate
SandboxTemplateRef
SandboxTemplateSpec
SandboxWarmPool
SandboxWarmPoolRef
SandboxWarmPoolSpec
SandboxWarmPoolStatus
SandboxWarmPoolUpdateStrategy
ApplyConfiguration defines the desired configuration values of an object.
AuditAnnotation describes how to produce an audit annotation for an API request.
ExpressionWarning is a warning information that targets a specific expression.
JSONPatch defines a JSON Patch.
MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.
MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.
MutatingAdmissionPolicyBindingSpec is the specification of the MutatingAdmissionPolicyBinding.
MutatingAdmissionPolicySpec is the specification of the desired behavior of the admission policy.
MutatingWebhook describes an admission webhook and the resources and operations it applies to.
MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
Mutation specifies the CEL expression which is used to apply the Mutation.
NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
ParamKind is a tuple of Group Kind and Version.
ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.
RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.
ServiceReference holds a reference to Service.legacy.k8s.io
TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy
ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.
ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.
ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
Validation specifies the CEL expression which is used to apply the validation.
Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.
WebhookClientConfig contains the information to make a TLS connection with the webhook
ApplyConfiguration defines the desired configuration values of an object.
AuditAnnotation describes how to produce an audit annotation for an API request.
ExpressionWarning is a warning information that targets a specific expression.
JSONPatch defines a JSON Patch.
MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.
MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.
MutatingAdmissionPolicyBindingSpec is the specification of the MutatingAdmissionPolicyBinding.
MutatingAdmissionPolicySpec is the specification of the desired behavior of the admission policy.
Mutation specifies the CEL expression which is used to apply the Mutation.
NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
ParamKind is a tuple of Group Kind and Version.
ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.
TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy
ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.
ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
ValidatingAdmissionPolicyStatus represents the status of a ValidatingAdmissionPolicy.
Validation specifies the CEL expression which is used to apply the validation.
Variable is the definition of a variable that is used for composition.
ApplyConfiguration defines the desired configuration values of an object.
AuditAnnotation describes how to produce an audit annotation for an API request.
ExpressionWarning is a warning information that targets a specific expression.
JSONPatch defines a JSON Patch.
MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.
MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.
MutatingAdmissionPolicyBindingSpec is the specification of the MutatingAdmissionPolicyBinding.
MutatingAdmissionPolicySpec is the specification of the desired behavior of the admission policy.
Mutation specifies the CEL expression which is used to apply the Mutation.
NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
ParamKind is a tuple of Group Kind and Version.
ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.
TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy
ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.
ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.
Validation specifies the CEL expression which is used to apply the validation.
Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.
An API server instance reports the version it can decode and the version it encodes objects to when persisting objects in the backend.
Storage version of a specific resource.
Describes the state of the storageVersion at a certain point.
StorageVersionSpec is an empty spec.
API server instances report the versions they can decode and the version they encode objects to when persisting objects in the backend.
ControllerRevision implements an immutable snapshot of state data.
DaemonSet represents the configuration of a daemon set.
DaemonSetCondition describes the state of a DaemonSet at a certain point.
DaemonSetSpec is the specification of a daemon set.
DaemonSetStatus represents the current status of a daemon set.
DaemonSetUpdateStrategy is a struct used to control the update strategy for a DaemonSet.
Deployment enables declarative updates for Pods and ReplicaSets.
DeploymentCondition describes the state of a deployment at a certain point.
DeploymentSpec is the specification of the desired behavior of the Deployment.
DeploymentStatus is the most recently observed status of the Deployment.
DeploymentStrategy describes how to replace existing pods with new ones.
ReplicaSet ensures that a specified number of pod replicas are running at any given time.
ReplicaSetCondition describes the state of a replica set at a certain point.
ReplicaSetSpec is the specification of a ReplicaSet.
ReplicaSetStatus represents the current status of a ReplicaSet.
Spec to control the desired behavior of daemon set rolling update.
Spec to control the desired behavior of rolling update.
RollingUpdateStatefulSetStrategy is used to communicate parameter for RollingUpdateStatefulSetStrategyType.
StatefulSet represents a set of pods with consistent identities.
StatefulSetCondition describes the state of a statefulset at a certain point.
StatefulSetOrdinals describes the policy used for replica ordinal assignment in this StatefulSet.
StatefulSetPersistentVolumeClaimRetentionPolicy describes the policy used for PVCs created from the StatefulSet VolumeClaimTemplates.
A StatefulSetSpec is the specification of a StatefulSet.
StatefulSetStatus represents the current state of a StatefulSet.
StatefulSetUpdateStrategy indicates the strategy that the StatefulSet controller will use to perform updates.
BoundObjectReference is a reference to an object that a token is bound to.
SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
TokenRequest requests a token for a given service account.
TokenRequestSpec contains client provided parameters of a token request.
TokenRequestStatus is the result of a token request.
TokenReview attempts to authenticate a token to a known user. Note: TokenReview requests may be cached by the webhook token authenticator plugin in the kube-apiserver.
TokenReviewSpec is a description of the token authentication request.
TokenReviewStatus is the result of the token authentication request.
UserInfo holds the information about the user needed to implement the user.Info interface.
SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace. Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions checking.
NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
NonResourceRule holds information that describes a rule for the non-resource
ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means "in all namespaces". Self is a special case, because users should always be able to check whether they can perform an action
SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set
SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace. The returned list of actions may be incomplete depending on the server's authorization mode, and any errors experienced during the evaluation. SelfSubjectRulesReview should be used by UIs to show/hide actions, or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns. SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.
SubjectAccessReview checks whether or not a user or group can perform an action.
SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set
SubjectAccessReviewStatus
SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on the set of authorizers the server is configured with and any errors experienced during evaluation. Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission, even if that list is incomplete.
CrossVersionObjectReference contains enough information to let you identify the referred resource.
configuration of a horizontal pod autoscaler.
specification of a horizontal pod autoscaler.
current status of a horizontal pod autoscaler
Scale represents a scaling request for a resource.
ScaleSpec describes the attributes of a scale subresource.
ScaleStatus represents the current status of a scale subresource.
ContainerResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.
ContainerResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
CrossVersionObjectReference contains enough information to let you identify the referred resource.
ExternalMetricSource indicates how to scale on a metric not associated with any Kubernetes object (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).
ExternalMetricStatus indicates the current value of a global metric not associated with any Kubernetes object.
HPAScalingPolicy is a single policy which must hold true for a specified past interval.
HPAScalingRules configures the scaling behavior for one direction. These Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.
HorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified.
HorizontalPodAutoscalerBehavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively).
HorizontalPodAutoscalerCondition describes the state of a HorizontalPodAutoscaler at a certain point.
HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.
HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.
MetricIdentifier defines the name and optionally selector for a metric
MetricSpec specifies how to scale based on a single metric (only `type` and one other matching field should be set at once).
MetricStatus describes the last-read state of a single metric.
MetricTarget defines the target value, average value, or average utilization of a specific metric
MetricValueStatus holds the current value for a metric
ObjectMetricSource indicates how to scale on a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).
ObjectMetricStatus indicates the current value of a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).
PodsMetricSource indicates how to scale on a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.
PodsMetricStatus indicates the current value of a metric describing each pod in the current scale target (for example, transactions-processed-per-second).
ResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.
ResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
CronJob represents the configuration of a single cron job.
CronJobSpec describes how the job execution will look like and when it will actually run.
CronJobStatus represents the current state of a cron job.
Job represents the configuration of a single job.
JobCondition describes current state of a job.
JobSchedulingConfiguration composes the reusable workload-aware scheduling building blocks.
JobSpec describes how the job execution will look like.
JobStatus represents the current state of a Job.
JobTemplateSpec describes the data a Job should have when created from a template
PodFailurePolicy describes how failed pods influence the backoffLimit.
PodFailurePolicyOnExitCodesRequirement describes the requirement for handling a failed pod based on its container exit codes. In particular, it lookups the .state.terminated.exitCode for each app container and init container status, represented by the .status.containerStatuses and .status.initContainerStatuses fields in the Pod status, respectively. Containers completed with success (exit code 0) are excluded from the requirement check.
PodFailurePolicyOnPodConditionsPattern describes a pattern for matching an actual pod condition type.
PodFailurePolicyRule describes how a pod failure is handled when the requirements are met. One of onExitCodes and onPodConditions, but not both, can be used in each rule.
SuccessPolicy describes when a Job can be declared as succeeded based on the success of some indexes.
SuccessPolicyRule describes rule for declaring a Job as succeeded. Each rule must have at least one of the "succeededIndexes" or "succeededCount" specified.
UncountedTerminatedPods holds UIDs of Pods that have terminated but haven't been accounted in Job status counters.
CertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.
CertificateSigningRequestCondition describes a condition of a CertificateSigningRequest object
CertificateSigningRequestSpec contains the certificate request.
CertificateSigningRequestStatus contains conditions used to indicate approved/denied/failed status of the request, and the issued certificate.
ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates). ClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster, because they can be mounted by pods using the `clusterTrustBundle` projection. All service accounts have read access to ClusterTrustBundles by default. Users who only have namespace-level access to a cluster can read ClusterTrustBundles by impersonating a serviceaccount that they have access to. It can be optionally associated with a particular signer, in which case it contains one valid set of trust anchors for that signer. Signers may have multiple associated ClusterTrustBundles; each is an independent set of trust anchors for that signer. Admission control is used to enforce that only users with permissions on the signer can create or modify the corresponding bundle.
ClusterTrustBundleSpec contains the signer and trust anchors.
PodCertificateRequest encodes a pod requesting a certificate from a given signer. Kubelets use this API to implement podCertificate projected volumes
PodCertificateRequestSpec describes the certificate request. All fields are immutable after creation.
PodCertificateRequestStatus describes the status of the request, and holds the certificate data if the request is issued.
ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).
ClusterTrustBundleSpec contains the signer and trust anchors.
ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).
ClusterTrustBundleSpec contains the signer and trust anchors.
PodCertificateRequest encapsulates a pod's request for a certificate from a signer, as well as the signer's response, if any.
PodCertificateRequestSpec describes the certificate request. All fields are immutable after creation.
PodCertificateRequestStatus describes the status of the request, and holds the certificate data if the request is issued.
Lease defines a lease concept.
LeaseSpec is a specification of a Lease.
LeaseCandidate defines a candidate for a Lease object. Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
LeaseCandidateSpec is a specification of a Lease.
LeaseCandidate defines a candidate for a Lease object. Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
LeaseCandidateSpec is a specification of a Lease.
LeaseCandidate defines a candidate for a Lease object. Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
LeaseCandidateSpec is a specification of a Lease.
Represents a Persistent Disk resource in AWS. An AWS EBS disk must exist before mounting to a container. The disk must also be in the same AWS zone as the kubelet. An AWS EBS disk can only be mounted as read/write once. AWS EBS volumes support ownership management and SELinux relabeling.
Affinity is a group of affinity scheduling rules.
AppArmorProfile defines a pod or container's AppArmor settings.
AttachedVolume describes a volume attached to a node
AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
Binding ties one object to another; for example, a pod is bound to a node by a scheduler. Deprecated in 1.7, please use the bindings subresource of pods instead.
Represents storage that is managed by an external CSI volume driver (Beta feature)
Represents a source location of a volume to mount, managed by an external CSI driver
Adds and removes POSIX capabilities from running containers.
Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.
Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.
Represents a cinder volume resource in Openstack. A Cinder volume must exist before mounting to a container. The volume must also be in the same region as the kubelet. Cinder volumes support ownership management and SELinux relabeling.
Represents a cinder volume resource in Openstack. A Cinder volume must exist before mounting to a container. The volume must also be in the same region as the kubelet. Cinder volumes support ownership management and SELinux relabeling.
ClientIPConfig represents the configurations of Client IP based session affinity.
ClusterTrustBundleProjection describes how to select a set of ClusterTrustBundle objects and project their contents into the pod filesystem.
Information about the condition of a component.
ComponentStatus (and ComponentStatusList) holds the cluster validation info. Deprecated: This API is deprecated in v1.19+
ConfigMap holds configuration data for pods to consume.
ConfigMapEnvSource selects a ConfigMap to populate the environment variables with. The contents of the target ConfigMap's Data field will represent the key-value pairs as environment variables.
Selects a key from a ConfigMap.
ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configuration
Adapts a ConfigMap into a projected volume. The contents of the target ConfigMap's Data field will be presented in a projected volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. Note that this is identical to a configmap volume source without the default mode.
Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. ConfigMap volumes support ownership management and SELinux relabeling.
A single application container that you want to run within a pod.
ContainerExtendedResourceRequest has the mapping of container name, extended resource name to the device request name.
Describe a container image
ContainerPort represents a network port in a single container.
ContainerResizePolicy represents resource resize policy for the container.
ContainerRestartRule describes how a container exit is handled.
ContainerRestartRuleOnExitCodes describes the condition for handling an exited container based on its exit codes.
ContainerState holds a possible state of container. Only one of its members may be specified. If none of them is specified, the default one is ContainerStateWaiting.
ContainerStateRunning is a running state of a container.
ContainerStateTerminated is a terminated state of a container.
ContainerStateWaiting is a waiting state of a container.
ContainerStatus contains details for the current status of this container.
ContainerUser represents user identity information
DaemonEndpoint contains information about a single Daemon endpoint.
Represents downward API info for projecting into a projected volume. Note that this is identical to a downwardAPI volume source without the default mode.
DownwardAPIVolumeFile represents information to create the file containing the pod field
DownwardAPIVolumeSource represents a volume containing downward API info. Downward API volumes support ownership management and SELinux relabeling.
Represents an empty directory for a pod. Empty directory volumes support ownership management and SELinux relabeling.
EndpointAddress is a tuple that describes single IP address.
EndpointPort is a tuple that describes a single port.
EndpointSubset is a group of addresses with a common set of ports. The expanded set of endpoints is the Cartesian product of Addresses x Ports.
Endpoints is a collection of endpoints that implement the actual service.
EnvFromSource represents the source of a set of ConfigMaps
EnvVar represents an environment variable present in a Container.
EnvVarSource represents a source for the value of an EnvVar.
An EphemeralContainer is a temporary container that you may add to an existing Pod for user-initiated activities such as debugging. Ephemeral containers have no resource or scheduling guarantees, and they will not be restarted when they exit or when a Pod is removed or restarted. The kubelet may evict a Pod if an ephemeral container causes the Pod to exceed its resource allocation. To add an ephemeral container, use the ephemeralcontainers subresource of an existing Pod. Ephemeral containers may not be removed or restarted.
Represents an ephemeral volume that is handled by a normal storage driver.
Event is a report of an event somewhere in the cluster. Events have a limited retention time and triggers and messages may evolve with time. Event consumers should not rely on the timing of an event with a given Reason reflecting a consistent underlying trigger, or the continued existence of events with that Reason. Events should be treated as informative, best-effort, supplemental data.
EventSeries contain information on series of events, i.e. thing that was/is happening continuously for some time.
EventSource contains information for an event.
EvictionResponder allows you to specify the responder reacting to an Eviction. Responders should observe and communicate through the Eviction Resource API to help with the graceful eviction of a target (e.g. termination of a pod).
ExecAction describes a "run in container" action.
Represents a Fibre Channel volume. Fibre Channel volumes can only be mounted as read/write once. Fibre Channel volumes support ownership management and SELinux relabeling.
FileKeySelector selects a key of the env file.
FlexPersistentVolumeSource represents a generic persistent volume resource that is provisioned/attached using an exec based plugin.
FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin.
Represents a Flocker volume mounted by the Flocker agent. One and only one of datasetName and datasetUUID should be set. Flocker volumes do not support ownership management or SELinux relabeling.
Represents a Persistent Disk resource in Google Compute Engine. A GCE PD must exist before mounting to a container. The disk must also be in the same GCE project and zone as the kubelet. A GCE PD can only be mounted as read/write once or read-only many times. GCE PDs support ownership management and SELinux relabeling.
Represents a volume that is populated with the contents of a git repository. Git repo volumes do not support ownership management. Git repo volumes support SELinux relabeling. DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.
Represents a Glusterfs mount that lasts the lifetime of a pod. Glusterfs volumes do not support ownership management or SELinux relabeling.
Represents a Glusterfs mount that lasts the lifetime of a pod. Glusterfs volumes do not support ownership management or SELinux relabeling.
HTTPGetAction describes an action based on HTTP Get requests.
HTTPHeader describes a custom header to be used in HTTP probes
HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.
HostIP represents a single IP address allocated to the host.
Represents a host path mapped into a pod. Host path volumes do not support ownership management or SELinux relabeling.
ISCSIPersistentVolumeSource represents an ISCSI disk. ISCSI volumes can only be mounted as read/write once. ISCSI volumes support ownership management and SELinux relabeling.
Represents an ISCSI disk. ISCSI volumes can only be mounted as read/write once. ISCSI volumes support ownership management and SELinux relabeling.
ImageVolumeSource represents a image volume resource.
ImageVolumeStatus represents the image-based volume status.
Maps a string key to a path within a volume.
Lifecycle describes actions that the management system should take in response to container lifecycle events. For the PostStart and PreStop lifecycle handlers, management of the container blocks until the action is complete, unless the container process fails, in which case the handler is aborted.
LifecycleHandler defines a specific action that should be taken in a lifecycle hook. One and only one of the fields, except TCPSocket must be specified.
LimitRange sets resource usage limits for each kind of resource in a Namespace.
LimitRangeItem defines a min/max usage limit for any resource that matches on kind.
LimitRangeSpec defines a min/max usage limit for resources that match on kind.
LinuxContainerUser represents user identity information in Linux containers
LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.
LoadBalancerStatus represents the status of a load-balancer.
LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.
Local represents directly-attached storage with node affinity (Beta feature)
ModifyVolumeStatus represents the status object of ControllerModifyVolume operation
Represents an NFS mount that lasts the lifetime of a pod. NFS volumes do not support ownership management or SELinux relabeling.
Namespace provides a scope for Names. Use of multiple namespaces is optional.
NamespaceCondition contains details about state of namespace.
NamespaceSpec describes the attributes on a Namespace.
NamespaceStatus is information about the current status of a Namespace.
Node is a worker node in Kubernetes. Each node will have a unique identifier in the cache (i.e. in etcd).
NodeAddress contains information for the node's address.
Node affinity is a group of node affinity scheduling rules.
NodeAllocatableMappedResources describes mapped node allocatable resource allocations.
NodeAllocatableOverheadResources describes auxiliary overhead resource allocations.
NodeAllocatableResourceClaimStatus tracks the status of node-allocatable resources allocated to a ResourceClaim for a Pod.
NodeCondition contains condition information for a node.
NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22
NodeConfigStatus describes the status of the config assigned by Node.Spec.ConfigSource.
NodeDaemonEndpoints lists ports opened by daemons running on the Node.
NodeFeatures describes the set of features implemented by the CRI implementation. The features contained in the NodeFeatures should depend only on the cri implementation independent of runtime handlers.
NodePodPreemptionPolicy defines the node-level policies governing preemption for pods on this node.
NodeRuntimeHandler is a set of runtime handler information.
NodeRuntimeHandlerFeatures is a set of features implemented by the runtime handler.
A node selector represents the union of the results of one or more label queries over a set of nodes; that is, it represents the OR of the selectors represented by the node selector terms.
A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
NodeSpec describes the attributes that a node is created with.
NodeStatus is information about the current status of a node.
NodeSwapStatus represents swap memory information.
NodeSystemInfo is a set of ids/uuids to uniquely identify the node.
ObjectFieldSelector selects an APIVersioned field of an object.
ObjectReference contains enough information to let you inspect or modify the referred object.
PersistentVolume (PV) is a storage resource provisioned by an administrator. It is analogous to a node. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
PersistentVolumeClaim is a user's request for and claim to a persistent volume
PersistentVolumeClaimCondition contains details about state of pvc
PersistentVolumeClaimSpec describes the common attributes of storage devices and allows a Source for provider-specific attributes
PersistentVolumeClaimStatus is the current status of a persistent volume claim.
PersistentVolumeClaimTemplate is used to produce PersistentVolumeClaim objects as part of an EphemeralVolumeSource.
PersistentVolumeClaimVolumeSource references the user's PVC in the same namespace. This volume finds the bound PV and mounts that volume for the pod. A PersistentVolumeClaimVolumeSource is, essentially, a wrapper around another type of volume that is owned by someone else (the system).
PersistentVolumeSpec is the specification of a persistent volume.
PersistentVolumeStatus is the current status of a persistent volume.
Represents a Photon Controller persistent disk resource.
Pod is a collection of containers that can run on a host. This resource is created by clients and scheduled onto hosts.
Pod affinity is a group of inter pod affinity scheduling rules.
Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running
Pod anti affinity is a group of inter pod anti affinity scheduling rules.
PodCertificateProjection provides a private key and X.509 certificate in the pod filesystem.
PodCondition contains details for the current condition of this pod.
PodDNSConfig defines the DNS parameters of a pod in addition to those generated from DNSPolicy.
PodDNSConfigOption defines DNS resolver options of a pod.
PodExtendedResourceClaimStatus is stored in the PodStatus for the extended resources backed by DRA. It stores the generated name for the corresponding special ResourceClaim created by the scheduler.
PodIP represents a single IP address allocated to the pod.
PodOS defines the OS parameters of a pod.
PodReadinessGate contains the reference to a pod condition
PodResourceClaim references exactly one ResourceClaim, either directly or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim for the pod. It adds a name to it that uniquely identifies the ResourceClaim inside the Pod. Containers that need access to the ResourceClaim reference it with this name.
PodResourceClaimStatus is stored in the PodStatus for each PodResourceClaim which references a ResourceClaimTemplate. It stores the generated name for the corresponding ResourceClaim.
PodSchedulingGate is associated to a Pod to guard its scheduling.
PodSchedulingGroup is used to associate a Pod with the PodGroup runtime instance it belongs to for gang-scheduling purposes.
PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext.
PodSpec is a description of a pod.
PodStatus represents information about the status of a pod. Status may trail the actual state of a system, especially if the node that hosts the pod cannot contact the control plane.
PodTemplate describes a template for creating copies of a predefined pod.
PodTemplateSpec describes the data a pod should have when created from a template
PodVolumeHealth contains health information for a volume used by a pod, reported by the CSI node plugin via the kubelet.
PortworxVolumeSource represents a Portworx volume resource.
An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
Probe describes a health check to be performed against a container to determine whether it is alive or ready to receive traffic.
Represents a projected volume source
Represents a Quobyte mount that lasts the lifetime of a pod. Quobyte volumes do not support ownership management or SELinux relabeling.
Represents a Rados Block Device mount that lasts the lifetime of a pod. RBD volumes support ownership management and SELinux relabeling.
Represents a Rados Block Device mount that lasts the lifetime of a pod. RBD volumes support ownership management and SELinux relabeling.
ReplicationController represents the configuration of a replication controller.
ReplicationControllerCondition describes the state of a replication controller at a certain point.
ReplicationControllerSpec is the specification of a replication controller.
ReplicationControllerStatus represents the current status of a replication controller.
ResourceClaim references one entry in PodSpec.ResourceClaims.
ResourceFieldSelector represents container resources (cpu, memory) and their output format
ResourceHealth represents the health of a resource. It has the latest device health information. This is a part of KEP https://kep.k8s.io/4680 and historical health changes are planned to be added in future iterations of a KEP.
ResourceQuota sets aggregate quota restrictions enforced per namespace
ResourceQuotaSpec defines the desired hard limits to enforce for Quota.
ResourceQuotaStatus defines the enforced hard limits and observed use.
ResourceRequirements describes the compute resource requirements.
SELinuxOptions are the labels to be applied to the container
ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume
ScaleIOVolumeSource represents a persistent ScaleIO volume
A scope selector represents the AND of the selectors represented by the scoped-resource selector requirements.
A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.
SeccompProfile defines a pod/container's seccomp profile settings. Only one profile source may be set.
Secret holds secret data of a certain type. The total bytes of the values in the Data field must be less than MaxSecretSize bytes.
SecretEnvSource selects a Secret to populate the environment variables with. The contents of the target Secret's Data field will represent the key-value pairs as environment variables.
SecretKeySelector selects a key of a Secret.
Adapts a secret into a projected volume. The contents of the target Secret's Data field will be presented in a projected volume as files using the keys in the Data field as the file names. Note that this is identical to a secret volume source without the default mode.
SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace
Adapts a Secret into a volume. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names. Secret volumes support ownership management and SELinux relabeling.
SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence.
Service is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.
ServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secrets
ServiceAccountTokenProjection represents a projected service account token volume. This projection can be used to insert a service account token into the pods runtime filesystem for use against APIs (Kubernetes API Server or otherwise).
ServicePort contains information on service's port.
ServiceSpec describes the attributes that a user creates on a service.
ServiceStatus represents the current status of a service.
SessionAffinityConfig represents the configurations of session affinity.
SleepAction describes a "sleep" action.
Represents a StorageOS persistent volume resource.
Represents a StorageOS persistent volume resource.
Sysctl defines a kernel parameter to be set
TCPSocketAction describes an action based on opening a socket
The node this Taint is attached to has the "effect" on any pod that does not tolerate the Taint.
The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.
A topology selector requirement is a selector that matches given label. This is an alpha feature and may change in the future.
A topology selector term represents the result of label queries. A null or empty topology selector term matches no objects. The requirements of them are ANDed. It provides a subset of functionality as NodeSelectorTerm. This is an alpha feature and may change in the future.
TopologySpreadConstraint specifies how to spread matching pods among the given topology.
TypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.
Volume represents a named volume in a pod that may be accessed by any container in the pod.
volumeDevice describes a mapping of a raw block device within a container.
VolumeHealthCondition represents an adverse health condition reported for a volume.
VolumeHealthStatus contains health information for a volume reported by the CSI controller plugin.
VolumeMount describes a mounting of a Volume within a container.
VolumeMountStatus shows status of volume mounts.
VolumeNodeAffinity defines constraints that limit what nodes this volume can be accessed from.
Projection that may be projected along with other supported volume types. Exactly one of these fields must be set.
VolumeResourceRequirements describes the storage resource requirements for a volume.
VolumeStatus represents the status of a mounted volume. At most one of its members must be specified.
Represents a vSphere volume resource.
The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
WindowsSecurityContextOptions contain Windows-specific options and credentials.
Endpoint represents a single logical "backend" implementing a service.
EndpointConditions represents the current condition of an endpoint.
EndpointHints provides hints describing how an endpoint should be consumed.
EndpointPort represents a Port used by an EndpointSlice
EndpointSlice represents a subset of the endpoints that implement a service. For a given service there may be multiple EndpointSlice objects, selected by labels, which must be joined to produce the full set of endpoints.
ForNode provides information about which nodes should consume this endpoint.
ForZone provides information about which zones should consume this endpoint.
Event is a report of an event somewhere in the cluster. It generally denotes some state change in the system. Events have a limited retention time and triggers and messages may evolve with time. Event consumers should not rely on the timing of an event with a given Reason reflecting a consistent underlying trigger, or the continued existence of events with that Reason. Events should be treated as informative, best-effort, supplemental data.
EventSeries contain information on series of events, i.e. thing that was/is happening continuously for some time. How often to update the EventSeries is up to the event reporters. The default event reporter in "k8s.io/client-go/tools/events/event_broadcaster.go" shows how this struct is updated on heartbeats and can guide customized reporter implementations.
ExemptPriorityLevelConfiguration describes the configurable aspects of the handling of exempt requests. In the mandatory exempt configuration object the values in the fields here can be modified by authorized users, unlike the rest of the `spec`.
FlowDistinguisherMethod specifies the method of a flow distinguisher.
FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
FlowSchemaCondition describes conditions for a FlowSchema.
FlowSchemaSpec describes how the FlowSchema's specification looks like.
FlowSchemaStatus represents the current state of a FlowSchema.
GroupSubject holds detailed information for group-kind subject.
LimitResponse defines how to handle requests that can not be executed right now.
LimitedPriorityLevelConfiguration specifies how to handle requests that are subject to limits. It addresses two issues: How are requests for this priority level limited? What should be done with requests that exceed the limit?
NonResourcePolicyRule is a predicate that matches non-resource requests according to their verb and the target non-resource URL. A NonResourcePolicyRule matches a request if and only if both (a) at least one member of verbs matches the request and (b) at least one member of nonResourceURLs matches the request.
PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member of resourceRules or nonResourceRules matches the request.
PriorityLevelConfiguration represents the configuration of a priority level.
PriorityLevelConfigurationCondition defines the condition of priority level.
PriorityLevelConfigurationReference contains information that points to the "request-priority" being used.
PriorityLevelConfigurationSpec specifies the configuration of a priority level.
PriorityLevelConfigurationStatus represents the current state of a "request-priority".
QueuingConfiguration holds the configuration parameters for queuing.
ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) either (d1) the request does not specify a namespace (i.e., `Namespace==""`) and clusterScope is true or (d2) the request specifies a namespace and least one member of namespaces matches the request's namespace.
ServiceAccountSubject holds detailed information for service-account-kind subject.
Subject matches the originator of a request, as identified by the request authentication system. There are three ways of matching an originator; by user, group, or service account.
UserSubject holds detailed information for user-kind subject.
ExemptPriorityLevelConfiguration describes the configurable aspects of the handling of exempt requests. In the mandatory exempt configuration object the values in the fields here can be modified by authorized users, unlike the rest of the spec.
FlowDistinguisherMethod specifies the method of a flow distinguisher.
FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
FlowSchemaCondition describes conditions for a FlowSchema.
FlowSchemaSpec describes how the FlowSchema's specification looks like.
FlowSchemaStatus represents the current state of a FlowSchema.
GroupSubject holds detailed information for group-kind subject.
LimitResponse defines how to handle requests that can not be executed right now.
LimitedPriorityLevelConfiguration specifies how to handle requests that are subject to limits. It addresses two issues: How are requests for this priority level limited? What should be done with requests that exceed the limit?
NonResourcePolicyRule is a predicate that matches non-resource requests according to their verb and the target non-resource URL. A NonResourcePolicyRule matches a request if and only if both (a) at least one member of verbs matches the request and (b) at least one member of nonResourceURLs matches the request.
PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member of resourceRules or nonResourceRules matches the request.
PriorityLevelConfiguration represents the configuration of a priority level.
PriorityLevelConfigurationCondition defines the condition of priority level.
PriorityLevelConfigurationReference contains information that points to the "request-priority" being used.
PriorityLevelConfigurationSpec specifies the configuration of a priority level.
PriorityLevelConfigurationStatus represents the current state of a "request-priority".
QueuingConfiguration holds the configuration parameters for queuing.
ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) either (d1) the request does not specify a namespace (i.e., Namespace=="") and clusterScope is true or (d2) the request specifies a namespace and least one member of namespaces matches the request's namespace.
ServiceAccountSubject holds detailed information for service-account-kind subject.
Subject matches the originator of a request, as identified by the request authentication system. There are three ways of matching an originator; by user, group, or service account.
UserSubject holds detailed information for user-kind subject.
Eviction initiates an eviction process, which should ideally result in a graceful eviction of a .spec.target (e.g. termination of a pod). The evictionrequest-controller observes intents of all EvictionRequests and transforms them into Evictions. It manages the Eviction lifecycle. Requesters are preserved in .status.requesters even after they have withdrawn their request. If all requesters withdraw their eviction intent for a common target, the eviction will be canceled. Once all EvictionRequest corresponding to this Eviction .spec.target have been removed, this Eviction object will eventually be garbage collected. If the target is a pod, the .status.targetResponders is populated from Pod's .spec.evictionResponders. Responders should observe and communicate through the .status to help with the eviction of the target when they see their state == Active in .status.targetResponders. ResponderStatus struct should then be periodically updated to indicate the progress or completion of the eviction process by each responder in .status.responders. If .status.responders[].heartbeatTime is not updated within the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction is passed over to the next responder with a lower priority. If there are no other responders and the target is a pod, the last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will evict the pod using the imperative Eviction API (pods/<name>/eviction subresource).
EvictionPodReference contains enough information to locate the referenced pod inside the same namespace.
EvictionRequest defines a request that should ideally result in a graceful eviction of a .spec.target (e.g. termination of a pod). The evictionrequest-controller observes intents of all EvictionRequests and transforms them into Evictions. - .spec.requester is set as a label on the Eviction for easier lookup. - Each target can have a set of responders assigned to it. Eviction objects are observed by these responders, who implement the eviction logic and update the Eviction's status with progress. There is many-to-many relationship between EvictionRequests and Evictions in general. And many-to-one if the target is a pod. If all requesters withdraw their eviction intent for a common target, the eviction will be canceled. Deleting an EvictionRequest also counts as a withdrawal. Once all EvictionRequest of a target are removed, the corresponding Evictions are eventually garbage collected.
EvictionRequestPodReference contains enough information to locate the referenced pod inside the same namespace.
EvictionRequestSpec is a specification of an EvictionRequest.
EvictionRequestStatus represents the last observed status of the eviction request.
EvictionRequestTarget contains a reference to an object that should be evicted.
EvictionSpec is a specification of an Eviction.
EvictionStatus represents the last observed status of the eviction request.
EvictionTarget contains a reference to an object that should be evicted.
Requester allows you to identify the entity, that requested the eviction of the target.
ResponderStatus represents the last observed status of the eviction process of the responder. It should be only updated by the designated responder whose name is .name field.
TargetResponder allows you to specify the responder reacting to the Eviction. Responders should observe and communicate through the Eviction API (see .state) to help with the graceful eviction of a target (e.g. termination of a pod).
HTTPIngressPath associates a path with a backend. Incoming urls matching the path are forwarded to the backend.
HTTPIngressRuleValue is a list of http selectors pointing to backends. In the example: http://<host>/<path>?<searchpart> -> backend where where parts of the url correspond to RFC 3986, this resource will be used to match against everything after the last '/' and before the first '?' or '#'.
IPAddress represents a single IP of a single IP Family. The object is designed to be used by APIs that operate on IP addresses. The object is used by the Service core API for allocation of IP addresses. An IP address can be represented in different formats, to guarantee the uniqueness of the IP, the name of the object is the IP address in canonical format, four decimal digits separated by dots suppressing leading zeros for IPv4 and the representation defined by RFC 5952 for IPv6. Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1 Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
IPAddressSpec describe the attributes in an IP Address.
IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should not be included within this rule.
Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend. An Ingress can be configured to give services externally-reachable urls, load balance traffic, terminate SSL, offer name based virtual hosting etc.
IngressBackend describes all endpoints for a given service and port.
IngressClass represents the class of the Ingress, referenced by the Ingress Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be used to indicate that an IngressClass should be considered default. When a single IngressClass resource has this annotation set to true, new Ingress resources without a class specified will be assigned this default class.
IngressClassParametersReference identifies an API object. This can be used to specify a cluster or namespace-scoped resource.
IngressClassSpec provides information about the class of an Ingress.
IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
IngressLoadBalancerStatus represents the status of a load-balancer.
IngressPortStatus represents the error condition of a service port
IngressRule represents the rules mapping the paths under a specified host to the related backend services. Incoming requests are first evaluated for a host match, then routed to the backend associated with the matching IngressRuleValue.
IngressServiceBackend references a Kubernetes Service as a Backend.
IngressSpec describes the Ingress the user wishes to exist.
IngressStatus describe the current state of the Ingress.
IngressTLS describes the transport layer security associated with an ingress.
NetworkPolicy describes what network traffic is allowed for a set of Pods
NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8
NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
NetworkPolicyPort describes a port to allow traffic on
NetworkPolicySpec provides the specification of a NetworkPolicy
ParentReference describes a reference to a parent object.
ServiceBackendPort is the service port being referenced.
ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64). This range is used to allocate ClusterIPs to Service objects.
ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
ServiceCIDRStatus describes the current state of the ServiceCIDR.
IPAddress represents a single IP of a single IP Family. The object is designed to be used by APIs that operate on IP addresses. The object is used by the Service core API for allocation of IP addresses. An IP address can be represented in different formats, to guarantee the uniqueness of the IP, the name of the object is the IP address in canonical format, four decimal digits separated by dots suppressing leading zeros for IPv4 and the representation defined by RFC 5952 for IPv6. Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1 Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
IPAddressSpec describe the attributes in an IP Address.
ParentReference describes a reference to a parent object.
ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64). This range is used to allocate ClusterIPs to Service objects.
ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
ServiceCIDRStatus describes the current state of the ServiceCIDR.
Overhead structure represents the resource overhead associated with running a pod.
RuntimeClass defines a class of container runtime supported in the cluster. The RuntimeClass is used to determine which container runtime is used to run all containers in a pod. RuntimeClasses are manually defined by a user or cluster provisioner, and referenced in the PodSpec. The Kubelet is responsible for resolving the RuntimeClassName reference before running the pod. For more details, see https://kubernetes.io/docs/concepts/containers/runtime-class/
Scheduling specifies the scheduling constraints for nodes supporting a RuntimeClass.
Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod. A request to cause such an eviction is created by POSTing to .../pods/<pod name>/evictions.
PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
PodDisruptionBudgetStatus represents information about the status of a PodDisruptionBudget. Status may trail the actual state of a system.
AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
ClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, and adds who information via Subject.
PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.
Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
RoleBinding references a role, but does not contain it. It can reference a Role in the same namespace or a ClusterRole in the global namespace. It adds who information via Subjects and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace.
RoleRef contains information that points to the role being used
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.
AllocatedDeviceStatus contains the status of an allocated device, if the driver chooses to report it. This may include driver-specific information. The combination of Driver, Pool, Device, and ShareID must match the corresponding key in Status.Allocation.Devices.
AllocationResult contains attributes of an allocated resource.
CELDeviceSelector contains a CEL expression for selecting a device.
CapacityRequestPolicy defines how requests consume device capacity. Must not set more than one ValidRequestValues.
CapacityRequestPolicyRange defines a valid range for consumable capacity values.
CapacityRequirements defines the capacity requirements for a specific device request.
Counter describes a quantity associated with a device.
CounterSet defines a named set of counters that are available to be used by devices defined in the ResourcePool.
Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.
DeviceAllocationConfiguration gets embedded in an AllocationResult.
DeviceAllocationResult is the result of allocating devices.
DeviceAttribute must have exactly one field set.
DeviceCapacity describes a quantity associated with a device.
DeviceClaim defines how to request devices with a ResourceClaim.
DeviceClaimConfiguration is used for configuration parameters in DeviceClaim.
DeviceClass is a vendor- or admin-provided resource that contains device configuration and selectors. It can be referenced in the device requests of a claim to apply these presets. Cluster scoped.
DeviceClassConfiguration is used in DeviceClass.
DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.
DeviceConstraint must have exactly one field set besides Requests.
DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.
DeviceDerivedAttribute defines a derived attribute computed via CEL.
DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices. With FirstAvailable it is also possible to provide a prioritized list of requests.
DeviceRequestAllocationResult contains the allocation result for one request.
DeviceSelector must have exactly one field set.
DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. DeviceSubRequest is similar to ExactDeviceRequest, but doesn't expose the AdminAccess field as that one is only supported when requesting a specific device.
The device this taint is attached to has the effect on any claim which does not tolerate the taint and, through the claim, to pods using the claim.
DeviceTaintRule adds one taint to all devices which match the selector. This has the same effect as if the taint was specified directly in the ResourceSlice by the DRA driver.
DeviceTaintRuleSpec specifies the selector and one taint.
DeviceTaintRuleStatus provides information about an on-going pod eviction.
DeviceTaintSelector defines which device(s) a DeviceTaintRule applies to. The empty selector matches all devices. Without a selector, no devices are matched.
The ResourceClaim this DeviceToleration is attached to tolerates any taint that matches the triple using the matching operator.
ExactDeviceRequest is a request for one or more identical devices.
NetworkDeviceData provides network-related details for the allocated device. This information may be filled by drivers or other components to configure or identify the device within a network context.
NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity. The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive. Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device. Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both. Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
NodeAllocatableResource defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource. At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
NodeAllocatableResourceMapping defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource.
OpaqueDeviceConfiguration contains configuration parameters for a driver in a format defined by the driver vendor.
ResourceClaim describes a request for access to resources in the cluster, for use by workloads. For example, if a workload needs an accelerator device with specific properties, this is how that request is expressed. The status stanza tracks whether this claim has been satisfied and what specific resources have been allocated.
ResourceClaimConsumerReference contains enough information to let you locate the consumer of a ResourceClaim. The user must be a resource in the same namespace as the ResourceClaim.
ResourceClaimSpec defines what is being requested in a ResourceClaim and how to configure it.
ResourceClaimStatus tracks whether the resource has been allocated and what the result of that was.
ResourceClaimTemplate is used to produce ResourceClaim objects.
ResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.
ResourcePool describes the pool that ResourceSlices belong to.
ResourceSlice represents one or more resources in a pool of similar resources, managed by a common driver. A pool may span more than one ResourceSlice, and exactly how many ResourceSlices comprise a pool is determined by the driver.
ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
AllocationResult contains attributes of an allocated resource.
BasicDevice defines one device instance.
CELDeviceSelector contains a CEL expression for selecting a device.
Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.
DeviceAllocationConfiguration gets embedded in an AllocationResult.
DeviceAllocationResult is the result of allocating devices.
DeviceAttribute must have exactly one field set.
DeviceClaim defines how to request devices with a ResourceClaim.
DeviceClaimConfiguration is used for configuration parameters in DeviceClaim.
DeviceClass is a vendor- or admin-provided resource that contains device configuration and selectors. It can be referenced in the device requests of a claim to apply these presets. Cluster scoped. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
DeviceClassConfiguration is used in DeviceClass.
DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.
DeviceConstraint must have exactly one field set besides Requests.
DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices. A DeviceClassName is currently required. Clients must check that it is indeed set. It's absence indicates that something changed in a way that is not supported by the client yet, in which case it must refuse to handle the request.
DeviceRequestAllocationResult contains the allocation result for one request.
DeviceSelector must have exactly one field set.
The device this taint is attached to has the "effect" on any claim which does not tolerate the taint and, through the claim, to pods using the claim.
DeviceTaintRule adds one taint to all devices which match the selector. This has the same effect as if the taint was specified directly in the ResourceSlice by the DRA driver.
DeviceTaintRuleSpec specifies the selector and one taint.
DeviceTaintRuleStatus provides information about an on-going pod eviction.
DeviceTaintSelector defines which device(s) a DeviceTaintRule applies to. The empty selector matches all devices. Without a selector, no devices are matched.
OpaqueDeviceConfiguration contains configuration parameters for a driver in a format defined by the driver vendor.
PartitionTypeStatus reports allocatability for a single partition type, identified by the value of a grouping attribute.
PoolStatus contains status information for a single resource pool.
ResourceClaim describes a request for access to resources in the cluster, for use by workloads. For example, if a workload needs an accelerator device with specific properties, this is how that request is expressed. The status stanza tracks whether this claim has been satisfied and what specific resources have been allocated. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimConsumerReference contains enough information to let you locate the consumer of a ResourceClaim. The user must be a resource in the same namespace as the ResourceClaim.
ResourceClaimSpec defines what is being requested in a ResourceClaim and how to configure it.
ResourceClaimStatus tracks whether the resource has been allocated and what the result of that was.
ResourceClaimTemplate is used to produce ResourceClaim objects. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.
ResourcePool describes the pool that ResourceSlices belong to.
ResourcePoolStatusRequest triggers a one-time calculation of resource pool status based on the provided filters. Once status is set, the request is considered complete and will not be reprocessed. Users should delete and recreate requests to get updated information.
ResourcePoolStatusRequestSpec defines the filters for the pool status request.
ResourcePoolStatusRequestStatus contains the calculated pool status information.
ResourceSlice represents one or more resources in a pool of similar resources, managed by a common driver. A pool may span more than one ResourceSlice, and exactly how many ResourceSlices comprise a pool is determined by the driver. At the moment, the only supported resources are devices with attributes and capacities. Each device in a given pool, regardless of how many ResourceSlices, must have a unique name. The ResourceSlice in which a device gets published may change over time. The unique identifier for a device is the tuple <driver name>, <pool name>, <device name>. Whenever a driver needs to update a pool, it increments the pool.Spec.Pool.Generation number and updates all ResourceSlices with that new number and new resource definitions. A consumer must only use ResourceSlices with the highest generation number and ignore all others. When allocating all resources in a pool matching certain criteria or when looking for the best solution among several different alternatives, a consumer should check the number of ResourceSlices in a pool (included in each ResourceSlice) to determine whether its view of a pool is complete and if not, should wait until the driver has completed updating the pool. For resources that are not local to a node, the node name is not set. Instead, the driver may use a node selector to specify where the devices are available. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
ShareableCapacityStatus reports aggregate amounts for a single shareable capacity key.
ShareableSummaryStatus reports aggregate capacity for a pool that contains devices with AllowMultipleAllocations.
AllocatedDeviceStatus contains the status of an allocated device, if the driver chooses to report it. This may include driver-specific information. The combination of Driver, Pool, Device, and ShareID must match the corresponding key in Status.Allocation.Devices.
AllocationResult contains attributes of an allocated resource.
BasicDevice defines one device instance.
CELDeviceSelector contains a CEL expression for selecting a device.
CapacityRequestPolicy defines how requests consume device capacity. Must not set more than one ValidRequestValues.
CapacityRequestPolicyRange defines a valid range for consumable capacity values. - If the requested amount is less than Min, it is rounded up to the Min value. - If Step is set and the requested amount is between Min and Max but not aligned with Step, it will be rounded up to the next value equal to Min + (n * Step). - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set). - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy, and the device cannot be allocated.
CapacityRequirements defines the capacity requirements for a specific device request.
Counter describes a quantity associated with a device.
CounterSet defines a named set of counters that are available to be used by devices defined in the ResourcePool. The counters are not allocatable by themselves, but can be referenced by devices. When a device is allocated, the portion of counters it uses will no longer be available for use by other devices.
Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.
DeviceAllocationConfiguration gets embedded in an AllocationResult.
DeviceAllocationResult is the result of allocating devices.
DeviceAttribute must have exactly one field set.
DeviceCapacity describes a quantity associated with a device.
DeviceClaim defines how to request devices with a ResourceClaim.
DeviceClaimConfiguration is used for configuration parameters in DeviceClaim.
DeviceClass is a vendor- or admin-provided resource that contains device configuration and selectors. It can be referenced in the device requests of a claim to apply these presets. Cluster scoped. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
DeviceClassConfiguration is used in DeviceClass.
DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.
DeviceConstraint must have exactly one field set besides Requests.
DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.
DeviceDerivedAttribute defines a derived attribute computed via CEL.
DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices.
DeviceRequestAllocationResult contains the allocation result for one request.
DeviceSelector must have exactly one field set.
DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices. DeviceSubRequest is similar to Request, but doesn't expose the AdminAccess or FirstAvailable fields, as those can only be set on the top-level request. AdminAccess is not supported for requests with a prioritized list, and recursive FirstAvailable fields are not supported.
The device this taint is attached to has the "effect" on any claim which does not tolerate the taint and, through the claim, to pods using the claim.
The ResourceClaim this DeviceToleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.
NetworkDeviceData provides network-related details for the allocated device. This information may be filled by drivers or other components to configure or identify the device within a network context.
NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity. The mapping can be derived from either the count of allocated devices or the specific capacity consumed. These options are mutually exclusive. Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device. Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both. Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
NodeAllocatableResource defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource. At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
NodeAllocatableResourceMapping defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource.
OpaqueDeviceConfiguration contains configuration parameters for a driver in a format defined by the driver vendor.
ResourceClaim describes a request for access to resources in the cluster, for use by workloads. For example, if a workload needs an accelerator device with specific properties, this is how that request is expressed. The status stanza tracks whether this claim has been satisfied and what specific resources have been allocated. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimConsumerReference contains enough information to let you locate the consumer of a ResourceClaim. The user must be a resource in the same namespace as the ResourceClaim.
ResourceClaimSpec defines what is being requested in a ResourceClaim and how to configure it.
ResourceClaimStatus tracks whether the resource has been allocated and what the result of that was.
ResourceClaimTemplate is used to produce ResourceClaim objects. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.
ResourcePool describes the pool that ResourceSlices belong to.
ResourceSlice represents one or more resources in a pool of similar resources, managed by a common driver. A pool may span more than one ResourceSlice, and exactly how many ResourceSlices comprise a pool is determined by the driver. At the moment, the only supported resources are devices with attributes and capacities. Each device in a given pool, regardless of how many ResourceSlices, must have a unique name. The ResourceSlice in which a device gets published may change over time. The unique identifier for a device is the tuple <driver name>, <pool name>, <device name>. Whenever a driver needs to update a pool, it increments the pool.Spec.Pool.Generation number and updates all ResourceSlices with that new number and new resource definitions. A consumer must only use ResourceSlices with the highest generation number and ignore all others. When allocating all resources in a pool matching certain criteria or when looking for the best solution among several different alternatives, a consumer should check the number of ResourceSlices in a pool (included in each ResourceSlice) to determine whether its view of a pool is complete and if not, should wait until the driver has completed updating the pool. For resources that are not local to a node, the node name is not set. Instead, the driver may use a node selector to specify where the devices are available. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
AllocatedDeviceStatus contains the status of an allocated device, if the driver chooses to report it. This may include driver-specific information. The combination of Driver, Pool, Device, and ShareID must match the corresponding key in Status.Allocation.Devices.
AllocationResult contains attributes of an allocated resource.
CELDeviceSelector contains a CEL expression for selecting a device.
CapacityRequestPolicy defines how requests consume device capacity. Must not set more than one ValidRequestValues.
CapacityRequestPolicyRange defines a valid range for consumable capacity values. - If the requested amount is less than Min, it is rounded up to the Min value. - If Step is set and the requested amount is between Min and Max but not aligned with Step, it will be rounded up to the next value equal to Min + (n * Step). - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set). - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy, and the device cannot be allocated.
CapacityRequirements defines the capacity requirements for a specific device request.
Counter describes a quantity associated with a device.
CounterSet defines a named set of counters that are available to be used by devices defined in the ResourcePool. The counters are not allocatable by themselves, but can be referenced by devices. When a device is allocated, the portion of counters it uses will no longer be available for use by other devices.
Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.
DeviceAllocationConfiguration gets embedded in an AllocationResult.
DeviceAllocationResult is the result of allocating devices.
DeviceAttribute must have exactly one field set.
DeviceCapacity describes a quantity associated with a device.
DeviceClaim defines how to request devices with a ResourceClaim.
DeviceClaimConfiguration is used for configuration parameters in DeviceClaim.
DeviceClass is a vendor- or admin-provided resource that contains device configuration and selectors. It can be referenced in the device requests of a claim to apply these presets. Cluster scoped. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
DeviceClassConfiguration is used in DeviceClass.
DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.
DeviceConstraint must have exactly one field set besides Requests.
DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.
DeviceDerivedAttribute defines a derived attribute computed via CEL.
DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices. With FirstAvailable it is also possible to provide a prioritized list of requests.
DeviceRequestAllocationResult contains the allocation result for one request.
DeviceSelector must have exactly one field set.
DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices. DeviceSubRequest is similar to ExactDeviceRequest, but doesn't expose the AdminAccess field as that one is only supported when requesting a specific device.
The device this taint is attached to has the "effect" on any claim which does not tolerate the taint and, through the claim, to pods using the claim.
DeviceTaintRule adds one taint to all devices which match the selector. This has the same effect as if the taint was specified directly in the ResourceSlice by the DRA driver.
DeviceTaintRuleSpec specifies the selector and one taint.
DeviceTaintRuleStatus provides information about an on-going pod eviction.
DeviceTaintSelector defines which device(s) a DeviceTaintRule applies to. The empty selector matches all devices. Without a selector, no devices are matched.
The ResourceClaim this DeviceToleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.
ExactDeviceRequest is a request for one or more identical devices.
NetworkDeviceData provides network-related details for the allocated device. This information may be filled by drivers or other components to configure or identify the device within a network context.
NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity. The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive. Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device. Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both. Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
NodeAllocatableResource defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource. At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
NodeAllocatableResourceMapping defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource.
OpaqueDeviceConfiguration contains configuration parameters for a driver in a format defined by the driver vendor.
ResourceClaim describes a request for access to resources in the cluster, for use by workloads. For example, if a workload needs an accelerator device with specific properties, this is how that request is expressed. The status stanza tracks whether this claim has been satisfied and what specific resources have been allocated. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimConsumerReference contains enough information to let you locate the consumer of a ResourceClaim. The user must be a resource in the same namespace as the ResourceClaim.
ResourceClaimSpec defines what is being requested in a ResourceClaim and how to configure it.
ResourceClaimStatus tracks whether the resource has been allocated and what the result of that was.
ResourceClaimTemplate is used to produce ResourceClaim objects. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.
ResourcePool describes the pool that ResourceSlices belong to.
ResourceSlice represents one or more resources in a pool of similar resources, managed by a common driver. A pool may span more than one ResourceSlice, and exactly how many ResourceSlices comprise a pool is determined by the driver. At the moment, the only supported resources are devices with attributes and capacities. Each device in a given pool, regardless of how many ResourceSlices, must have a unique name. The ResourceSlice in which a device gets published may change over time. The unique identifier for a device is the tuple <driver name>, <pool name>, <device name>. Whenever a driver needs to update a pool, it increments the pool.Spec.Pool.Generation number and updates all ResourceSlices with that new number and new resource definitions. A consumer must only use ResourceSlices with the highest generation number and ignore all others. When allocating all resources in a pool matching certain criteria or when looking for the best solution among several different alternatives, a consumer should check the number of ResourceSlices in a pool (included in each ResourceSlice) to determine whether its view of a pool is complete and if not, should wait until the driver has completed updating the pool. For resources that are not local to a node, the node name is not set. Instead, the driver may use a node selector to specify where the devices are available. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
PriorityClass defines mapping from a priority class name to the priority integer value. The value can be any valid integer.
BasicSchedulingPolicy indicates that standard Kubernetes scheduling behavior should be used.
GangSchedulingPolicy defines the parameters for gang scheduling.
PodGroup represents a runtime instance of pods grouped together. PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from Workload.podGroupTemplates. PodGroup API enablement is toggled by the GenericWorkload feature gate.
PodGroupResourceClaim references exactly one ResourceClaim, either directly or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim for the PodGroup.
PodGroupResourceClaimStatus is stored in the PodGroupStatus for each PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the generated name for the corresponding ResourceClaim.
PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup. Exactly one policy must be set.
PodGroupSpec defines the desired state of a PodGroup.
PodGroupStatus represents information about the status of a pod group.
PodGroupTemplate represents a template for a set of pods with a scheduling policy.
PodGroupTemplateReference references a PodGroup template defined in some object (e.g. Workload). Exactly one reference must be set.
TopologyConstraint defines a topology constraint for a PodGroup.
TypedLocalObjectReference allows to reference typed object inside the same namespace.
Workload allows for expressing scheduling constraints that should be used when managing the lifecycle of workloads from the scheduling perspective, including scheduling, preemption, eviction and other phases. Workload API enablement is toggled by the GenericWorkload feature gate.
WorkloadPodGroupTemplateReference references the PodGroupTemplate within the Workload object.
WorkloadSpec defines the desired state of a Workload.
AllCompositeDisruptionMode means that children of a CompositePodGroup can only be disrupted or preempted together.
AllDisruptionMode specifies that children can only be disrupted together.
BasicSchedulingPolicy indicates that standard Kubernetes scheduling behavior should be used.
CompositeBasicSchedulingPolicy indicates that the groups belonging to the composite group should be scheduled independently.
CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted. Exactly one mode must be set.
CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group should be scheduled using all-or-nothing semantics.
CompositePodGroup represents a runtime instance of pod groups grouped together. CompositePodGroups are created by workload controllers (LWS, JobSet, etc...) from Workload.compositePodGroupTemplates. CompositePodGroup API enablement is toggled by the CompositePodGroup feature gate.
CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.
CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup. Exactly one policy must be set.
CompositePodGroupSpec defines the desired state of CompositePodGroup.
CompositePodGroupStatus represents information about the status of a composite pod group.
CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.
DisruptionMode defines how individual entities within a group can be disrupted. Exactly one mode can be set.
GangSchedulingPolicy defines the parameters for gang scheduling.
PodGroup represents a runtime instance of pods grouped together. PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from Workload.podGroupTemplates. PodGroup API enablement is toggled by the GenericWorkload feature gate.
PodGroupResourceClaim references exactly one ResourceClaim, either directly or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim for the PodGroup. It adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup. Pods that need access to the ResourceClaim define a matching reference in its own Spec.ResourceClaims. The Pod's claim must match all fields of the PodGroup's claim exactly.
PodGroupResourceClaimStatus is stored in the PodGroupStatus for each PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the generated name for the corresponding ResourceClaim.
PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup. Exactly one policy must be set. The policy is chosen at creation time by setting either the Basic or Gang field. The PodGroup may not change policy after creation. Fields within chosen policy may be updated after creation when their individual fields allow it.
PodGroupSpec defines the desired state of a PodGroup.
PodGroupStatus represents information about the status of a pod group.
PodGroupTemplate represents a template for a set of pods with a scheduling policy.
SingleCompositeDisruptionMode means that individual children of a CompositePodGroup can be disrupted or preempted independently.
SingleDisruptionMode specifies that children can be disrupted independently.
TopologyConstraint defines a topology constraint for a PodGroup.
TypedLocalObjectReference allows to reference typed object inside the same namespace.
Workload allows for expressing scheduling constraints that should be used when managing the lifecycle of workloads from the scheduling perspective, including scheduling, preemption, eviction and other phases. Workload API enablement is toggled by the GenericWorkload feature gate.
WorkloadPodGroupAllDisruptionMode indicates that all pods in the group must be disrupted together.
WorkloadPodGroupBasicSchedulingPolicy indicates standard Kubernetes scheduling behavior.
WorkloadPodGroupDisruptionMode defines how individual pods within a group can be disrupted. Exactly one mode must be set.
WorkloadPodGroupGangSchedulingPolicy defines the parameters for gang (all-or-nothing) scheduling.
WorkloadPodGroupResourceClaim references a dynamic resource claim that is shared across pods in the group.
WorkloadPodGroupSchedulingConstraints defines leaf-level scheduling constraints, such as topology.
WorkloadPodGroupSchedulingPolicy defines the scheduling policy for a group of pods managed by a workload controller. Exactly one policy must be set.
WorkloadPodGroupSingleDisruptionMode indicates that individual pods can be disrupted independently.
WorkloadReference references the Workload object together with the template that was used to create a particular PodGroup.
WorkloadSpec defines the desired state of a Workload.
AllCompositeDisruptionMode means that children of a CompositePodGroup can only be disrupted or preempted together.
AllDisruptionMode specifies that children can only be disrupted together.
BasicSchedulingPolicy indicates that standard Kubernetes scheduling behavior should be used.
CompositeBasicSchedulingPolicy indicates that the groups belonging to the composite group should be scheduled independently.
CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted. Exactly one mode must be set.
CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group should be scheduled using all-or-nothing semantics.
CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.
CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup. Exactly one policy must be set.
CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.
DisruptionMode defines how individual entities within a group can be disrupted. Exactly one mode can be set.
GangSchedulingPolicy defines the parameters for gang scheduling.
PodGroup represents a runtime instance of pods grouped together. PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from Workload.podGroupTemplates. PodGroup API enablement is toggled by the GenericWorkload feature gate.
PodGroupResourceClaim references exactly one ResourceClaim, either directly or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim for the PodGroup. It adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup. Pods that need access to the ResourceClaim define a matching reference in its own Spec.ResourceClaims. The Pod's claim must match all fields of the PodGroup's claim exactly.
PodGroupResourceClaimStatus is stored in the PodGroupStatus for each PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the generated name for the corresponding ResourceClaim.
PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup. Exactly one policy must be set. The policy is chosen at creation time by setting either the Basic or Gang field. The PodGroup may not change policy after creation. Fields within chosen policy may be updated after creation when their individual fields allow it.
PodGroupSpec defines the desired state of a PodGroup.
PodGroupStatus represents information about the status of a pod group.
PodGroupTemplate represents a template for a set of pods with a scheduling policy.
SingleCompositeDisruptionMode means that individual children of a CompositePodGroup can be disrupted or preempted independently.
SingleDisruptionMode specifies that children can be disrupted independently.
TopologyConstraint defines a topology constraint for a PodGroup.
TypedLocalObjectReference allows to reference typed object inside the same namespace.
Workload allows for expressing scheduling constraints that should be used when managing the lifecycle of workloads from the scheduling perspective, including scheduling, preemption, eviction and other phases. Workload API enablement is toggled by the GenericWorkload feature gate.
WorkloadReference references the Workload object together with the template that was used to create a particular PodGroup.
WorkloadSpec defines the desired state of a Workload.
CSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster. Kubernetes attach detach controller uses this object to determine whether attach is required. Kubelet uses this object to determine whether pod information needs to be passed on mount. CSIDriver objects are non-namespaced.
CSIDriverSpec is the specification of a CSIDriver.
CSINode holds information about all CSI drivers installed on a node. CSI drivers do not need to create the CSINode object directly. As long as they use the node-driver-registrar sidecar container, the kubelet will automatically populate the CSINode object for the CSI driver as part of kubelet plugin registration. CSINode has the same name as a node. If the object is missing, it means either there are no CSI Drivers available on the node, or the Kubelet version is low enough that it doesn't create this object. CSINode has an OwnerReference that points to the corresponding node object.
CSINodeDriver holds information about the specification of one CSI driver installed on a node
CSINodeSpec holds information about the specification of all CSI drivers installed on a node
CSINodeStatus contains health and status information for storage on a node.
CSIStorageCapacity stores the result of one CSI GetCapacity call. For a given StorageClass, this describes the available capacity in a particular topology segment. This can be used when considering where to instantiate new PersistentVolumes.
StorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned. StorageClasses are non-namespaced; the name of the storage class according to etcd is in ObjectMeta.Name.
StorageHealth contains storage backend health reported by a CSI driver on a node.
StorageHealthCondition represents an adverse health condition reported by a CSI driver for its storage backend on a node.
TokenRequest contains parameters of a service account token.
VolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node. VolumeAttachment objects are non-namespaced.
VolumeAttachmentSource represents a volume that should be attached. Right now only PersistenVolumes can be attached via external attacher, in future we may allow also inline volumes in pods. Exactly one member can be set.
VolumeAttachmentSpec is the specification of a VolumeAttachment request.
VolumeAttachmentStatus is the status of a VolumeAttachment request.
VolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
VolumeError captures an error encountered during a volume operation.
VolumeNodeResources is a set of resource limits for scheduling of volumes.
VolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
VolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
StorageVersionMigration represents a migration of stored data to the latest storage version.
Spec of the storage version migration.
Status of the storage version migration.
The names of the group, the version, and the resource.
Describes the state of a migration at a certain point.
StorageVersionMigration represents a migration of stored data to the latest storage version.
Spec of the storage version migration.
Status of the storage version migration.
StorageVersionMigration represents a migration of stored data to the latest storage version.
Spec of the storage version migration.
Status of the storage version migration.
CustomResourceColumnDefinition specifies a column for server side printing.
CustomResourceConversion describes how to convert different versions of a CR.
CustomResourceDefinition represents a resource that should be exposed on the API server. Its name MUST be in the format <.spec.name>.<.spec.group>.
CustomResourceDefinitionCondition contains details for the current condition of this pod.
CustomResourceDefinitionNames indicates the names to serve this CustomResourceDefinition
CustomResourceDefinitionSpec describes how a user wants their resource to appear
CustomResourceDefinitionStatus indicates the state of the CustomResourceDefinition
CustomResourceDefinitionVersion describes a version for CRD.
CustomResourceSubresourceScale defines how to serve the scale subresource for CustomResources.
Marker that enables the /status subresource for a CRD
CustomResourceSubresources defines the status and scale subresources for CustomResources.
CustomResourceValidation is a list of validation methods for CustomResources.
ExternalDocumentation allows referencing an external resource for extended documentation.
JSON represents any valid JSON value. These types are supported: bool, int64, float64, string, []interface{}, map[string]interface{} and nil.
JSONSchemaProps is a JSON-Schema following Specification Draft 4 (http://json-schema.org/).
JSONSchemaPropsOrArray represents a value that can either be a JSONSchemaProps or an array of JSONSchemaProps. Mainly here for serialization purposes.
JSONSchemaPropsOrBool represents JSONSchemaProps or a boolean value. Defaults to true for the boolean property.
JSONSchemaPropsOrStringArray represents a JSONSchemaProps or a string array.
SelectableField specifies the JSON path of a field that may be used with field selectors.
ServiceReference holds a reference to Service.legacy.k8s.io
ValidationRule describes a validation rule written in the CEL expression language.
WebhookClientConfig contains the information to make a TLS connection with the webhook.
WebhookConversion describes how to call a conversion webhook
APIGroup contains the name, the supported versions, and the preferred version of a group.
APIGroupList is a list of APIGroup, to allow clients to discover the API at /apis.
APIResource specifies the name of a resource and whether it is namespaced.
APIResourceList is a list of APIResource, it is used to expose the name of the resources supported in a specific group and version, and if the resource is namespaced.
APIVersions lists the versions that are available, to allow clients to discover the API at /api, which is the root path of the legacy v1 API.
Condition contains details for one aspect of the current state of this API Resource.
DeleteOptions may be provided when deleting an API object.
FieldSelectorRequirement is a selector that contains values, a key, and an operator that relates the key and values.
GroupResource specifies a Group and a Resource, but does not force a version. This is useful for identifying concepts during lookup stages without having partially valid types
GroupVersion contains the "group/version" and "version" string of a version. It is made a struct to keep extensibility.
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
ListMeta describes metadata that synthetic resources must have, including lists and various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.
ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.
OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.
Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.
ShardInfo describes the shard selector that was applied to produce a list response. Its presence on a list response indicates the list is a filtered subset.
Status is a return value for calls that don't return other objects.
StatusCause provides more information about an api.Status failure, including cases when multiple errors are encountered.
StatusDetails is a set of additional properties that MAY be set by the server to provide additional information about a response. The Reason field of a Status object defines what attributes will be set. Clients must ignore fields that do not match the defined type of each attribute, and should assume that any attribute may be empty, invalid, or under defined.
Event represents a single event to a watched resource.
Info contains versioning information. how we'll want to distribute that information.
Dynamically generate IO::K8s classes from OpenAPI schema
Precomputed core/apimachinery shape index for AutoGen's reuse_core
Turn CustomResourceDefinition manifests into IO::K8s classes
Render generated IO::K8s classes as house-style Perl source
cert-manager CRD resource map provider for IO::K8s
ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.
Challenge specifies a challenge offered by the ACME server for an Order.
An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow.
Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow.
The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/).
The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed.
ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
ObjectMeta overrides for the pod used to solve HTTP01 challenges.
If specified, the pod's security context
PodSpec defines overrides for the HTTP01 challenge solver pod.
Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges.
Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges.
ExternalAccountBinding is a reference to a CA external account of the ACME server.
ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates.
Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records.
Use the Akamai DNS zone management API to manage DNS01 challenge records.
Use the Microsoft Azure DNS API to manage DNS01 challenge records.
Use the Google Cloud DNS API to manage DNS01 challenge records.
Use the Cloudflare API to manage DNS01 challenge records.
Use the DigitalOcean DNS API to manage DNS01 challenge records.
Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records.
Use the AWS Route53 API to manage DNS01 challenge records.
Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records.
ACME specific status options.
SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773.
Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set.
CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource.
CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.
A Certificate resource should be created to ensure an up to date and signed X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
ARI stores the ACME Renewal Information that is fetched from the ACME server in accordance with RFC 9773.
ACME stores information that is fetched from the ACME CA server.
CertificateAdditionalOutputFormat defines an additional output format of a Certificate resource.
CertificateCondition contains condition information for a Certificate.
Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver.
Additional keystore output formats to be stored in the Certificate's Secret.
Private key options.
`renewal` allows configuration of how your certificate is renewed.
CertificateRenewalWindows is the definition for renewal windows
A CertificateRequest is used to request a signed certificate from one of the configured issuers.
CertificateRequestCondition contains condition information for a CertificateRequest.
Specification of the desired state of the CertificateRequest resource.
Status of the CertificateRequest.
Defines annotations and labels to be copied to the Certificate's Secret.
Specification of the desired state of the Certificate resource.
Status of the Certificate.
Challenge is a type to represent a Challenge request with an ACME server
ChallengeSpec
ChallengeStatus
A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields.
An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields.
IssuerCondition contains condition information for an Issuer.
Reference to the issuer responsible for issuing the certificate.
Desired state of the Issuer resource.
Status of the Issuer.
JKS configures options for storing a JKS keystore in the `spec.secretName` Secret resource.
LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.
Permitted contains the constraints in which the names must be located.
x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
Order is a type to represent an Order with an ACME server
OrderSpec
OrderStatus
OtherName
PKCS12 configures options for storing a PKCS12 keystore in the `spec.secretName` Secret resource.
ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route).
Auth configures how cert-manager authenticates.
Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity by passing a bound ServiceAccount token.
The SecretAccessKey is used for authentication.
SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object.
A reference to a service account that will be used to request a bound token (also known as "projected token").
AWS authenticates with Vault using AWS IAM authentication.
AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource.
Auth configures how cert-manager authenticates with the Vault server.
ClientCertificate authenticates with Vault by presenting a client certificate during the request's TLS handshake.
Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend.
Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server.
Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.
Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted or SaaS policy zone.
NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration using OAuth 2.0 Client Credentials.
TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
Requested set of X509 certificate subject attributes.
Cilium CRD resource map provider for IO::K8s
AWSGroup is an structure that can be used to whitelisting information from AWS integration
IngressAddressing is the addressing information for Ingress listener.
ENI represents an AlibabaCloud Elastic Network Interface
AlibabaCloud is the AlibabaCloud specific status of the node.
AlibabaCloud is the AlibabaCloud IPAM specific configuration.
AllocationIP is an IP which is available for allocation, or already has been allocated
Authentication is the required authentication type for the allowed traffic, if any.
Subnet is the subnet the ENI is associated with
VPC is the VPC information to which the ENI is attached to
AzureAddress is an IP address assigned to an AzureInterface
AzureInterface represents an Azure Interface
Azure is the Azure IPAM specific configuration.
Azure is the Azure specific status of the node.
Subnet is the subnet the interface is attached to.
BGPAdvertisement defines which routes Cilium should advertise to BGP peers.